Industrie 4.0 - Security 0.1? Zur Notwendigkeit von Security Testing Prof. Dr. Hartmut Pohl, Jochen Klein
Information Security (INFOSEC) Informationssicherheit Zustand eines IT-Systems, mit folgenden Sachzielen: Confidentiality: Informationen nur für Berechtigte zugreifbar Integrity: Genauigkeit und Vollständigkeit, Verarbeitungsmethoden geschützt Availability: Nutzung von Daten und Anwendungen durch Berechtigte Authenticity: Daten stammen vom behaupteten Berechtigten ISO/IEC 270xx
Natanz Uranium Enrichment Facility Iranian President Mahmoud Ahmadinejad visits the Natanz uranium enrichment facilities, where a closed computer network was infected by malware introduced via a small flash drive softscheck
Professional Attacks Example: Stuxnet and Derivatives 100 % Stuxnet 2006 Code Red 2006 Flame 2007 Roter Oktober 2007 Duqu 2009 Mahdi 2011 Gauss 2012 Disttrack, Shamoon 2012 miniflame 2012 Narilam 2012 Havex 2014 Stealth Storm Worm 2007 0 % Viruses, Worms, Spam, Phishing, Spyware, Adware, (Botnets) Skript Kiddies, Students, Everybody Targeted
Attack Surface, Attack Paths Internet Successful Attacks essential exploiting Vulnerabilities: No Vulnerability no Attack! Attack Paths Attack Surface Organisation Information System Permitted Port Undetected, unpublished, unpatched Vulnerabilities Firewall, Intrusion Detection, Applications, Servers, SQL, IIS, Mails, FTP, CRM Patched Vulnerabilities Anti-Virus Assets - Data Encryption, Keys 5 idefense Vupen WabiSabiLabi ZDI
Vulnerability Lifecycle Black Risk Vulnerability-free Phase seemingly! Grey Risk Vulnerability discovered, used White Risk Vulnerability fully disclosed: Manufacturer Product Shipment Vulnerability discovered Attack: Exploit developed Vulnerability published Exploit published Patch published 1 Zero-Day-Vulnerability - nobody knows 2 Manufacturer knows unpublished 3 Manufacturer publishes Vulnerability 4 Manufacturer patches
Vulnerability Lifecycle Black Risk Vulnerability-free Phase seemingly! Grey Risk Vulnerability discovered, used White Risk Vulnerability fully disclosed: Manufacturer Zero Day Product Shipment Vulnerability discovered Attack: Exploit developed Vulnerability published Exploit published Patch published 1 Zero-Day-Vulnerability - nobody knows 2 Manufacturer knows unpublished 3 Manufacturer publishes Vulnerability 4 Manufacturer patches
Indispensible Security Measures Grundschutz ISO 27000 Family Access Control, Passwords Anti-Virus Scanner Firewall Encryption: Key Generation, Key Management IDS/IPS
Software Security Tested Kommerzielle Software Webapplications, ERM, CRM, SCM, ERP, E-Business, CIM, Apps für mobile Devices Sicherheitssoftware Firewalls, Router, Gateways, Verschlüsselung, Intrusion Detection Industrial Control Systems (PLC/SPS) Embedded Systems Smart Grid / Smart Meter Gateway Security, Energiemanagement und Smart Home
Security Testing Process ISO 27034: Identifying Zero-Day-Vulnerabilities Security Analysis: Requirements Architecture Analysis Threat Modeling Attack Paths, Attack Surface Static Source Code Analysis Conformity Testing, Covert Functions Explorative Testing: Manual Auditing Penetration Testing Dynamic Analysis: Fuzzing Exploits, Patches Secure Design Secure Implementation Requirements Product Security Design Implementation Release Verification Presentation Reports ISO 27034
Threat Modeling: Data Flow Diagram Advanced Metering Infrastructure (AMI) External-powered Meter Battery-powered Meter Electricity Gas Water Heat Metered Value Metered Value SMGW Admin Trusted Time Service Time Synchronization Firmware Download Measured Values - Tariffs Network Status Wake-up Call... LMN Smart Meter Gateway Customer Information Security Module HAN Authorized External Entity CLS Data Verteilnetzbetreiber (VNB) Messstellenbetreiber (MSB) Messdienstleister (MDL) Lieferant (LF) WAN Prosumer Visual Display Service Technician Controllable Local System (CLS)
Principle Fuzzing Process Fuzzer 0000 0000 1111 1111 1 2 Target Expert Advice: Identification, Rating Report Patch, Fix
Full Fuzzing Process Test System Target System Identification Input Interfaces Code Coverage Proprietary Developed Fuzzer Proprietary Developed Attack Strings Fuzzer 0000 0000 1111 1111 1 Target 2 Encryption I/A DB Target Processor ARM, AMD, IBM, Intel, Nvidia, PLC, Power PC, Qualcomm, Sun, Snapdragon, Target OS Android, CardOS, JCOB, Nucleus, OS X, QNX, Unix, VxWorks, Windows, S7, Monitor-Client Monitor/Debugger Expert Activities Expert Advice: Identification, Rating Proof of Concept Exploits Report Patch, Fix
Security Testing Achievements Method No. Vulnerabilities No. Tools used Architecture Analysis: Threat Modeling 112 (986) 1 Static Source Code Analysis 17 3-5 Penetration Testing 0 (76) 4 + Dynamic Analysis: Fuzzing 27 5-7 Sum 156 > 13
Indispensible Security Measures Security Level 0: Grundschutz ISO 27000 Family Access Control, Passwords Anti-Virus Scanner Firewall Encryption: Key Generation, Key Management IDS/IPS
Security Success 5 effective Methods: Security Requirements Threat Modeling Static Source Code Analysis Penetration Testing Dynamic Analysis: Fuzzing Many Tools of > 300 Every Software and Firmware (Hardware) All Processors & Operating Systems Every Software Development Process Common Criteria / Protection Profiles
Live Presentation Identifying Zero-Day-Vulnerabilities in PLC
Industrie 4.0 - Security 0.1? Zur Notwendigkeit von Security Testing Prof. Dr. Hartmut Pohl Hartmut.Pohl@softScheck.com + 49 (2241) 255 430 softscheck GmbH Köln Büro: Bonnerstr. 108. 53757 Sankt Augustin www. softscheck.com