cybersecurity for dummies - itron · pdf file2 2 today’s electric grid markets and...
Post on 06-Feb-2018
218 Views
Preview:
TRANSCRIPT
CYBERSECURITY FOR DUMMIES
2 2
Todays Electric Grid
Markets and Operations Generation Transmission Distribution Customer Use
One-way flow of electricity
Centralized, bulk generation
Limited automation
Limited situational awareness
Consumers lack data to manage energy usage
Smart Grid = Electric Grid + Intelligence
Two way flow of electricity and Information
Interconnected systems
Threats to the Grid
Deliberate attacks
Disgruntled employees
Industrial espionage
Unfriendly states
Organized crime
Inadvertent threats
Equipment failures
User/Administrator errors
Natural phenomena
Weather hurricanes, earthquakes
Solar activity
Trends Impacting Security
Increasing interconnections at all levels
Insecure connections
Connectivity of control systems to other networks
Increasing reliance on automation
Reliance on external communications
Adoption of standardized technologies with known
vulnerabilities
Widespread availability of technical information about
control systems
Smart sensors and controls with enhanced capability and functionality
Top Information System Security IssuesConcern Addressed by
Bypassing Controls Authentication, Policies, Audit
Integrity Violation Encryption and message authentication
Authorization Violation Strong Authentication
Indiscretion Policies
Intercept/Alter Encryption and message authentication.
Illegitimate Use Strong authentication and policies
Information Leakage Policies
Spoof Strong authentication, sealed encryption
Masquerade Strong authentication and encryption
Availability Assessment and correction of vulnerabilities
Eavesdropping/Privacy Encryption
HACKERS AND BAD ACTORS
Hacks Happen
Measuring the allegedly interfering signals coming out of the smart meter
Attempt to stop smart meter communications by putting foil over the meter.
Images courtesy of www.flickr.com
One way to deter an attacker.
Our goal is not to prevent an attack, but to increase the level of work required for the attack to be successful and minimize any effect of the attack.
Vulnerabilities, Threats, Attacks
A vulnerability is a weakness that could be exploited
A threat is a potential occurrence with an undesirable
outcome
An attack is an intentional attempt to exploit a
vulnerability
Hardware and software attacks
Threat/Adversary Model
An Adversaries:
Capabilities
+ Resources
+ Intent
+ Motivation
+ Access
+ Risk Aversion
Threat
Example: An adversary with high capabilities and
low resources - low motivation is not a threat
SECURITY CONCEPTS
Pillars of Information Assurance
Confidentiality
Integrity
Authorization
Authentication
Non-repudiation
Availability
Confidentiality
Ensure that information is
disclosed only to those who
are authorized to view it.
Integrity
Ensure that information has
not been changed
accidentally or deliberately,
and that it is accurate and
complete.
Authentication
The process of confirming
the claimed user or device
Authorization
The approval, permission, or
empowerment to do
something.
Non-Repudiation
The ability to prove that a
specific user and only that
specific user sent a
message and that it hasn't
been modified.
Availability
Ensuring timely and
reliable access to and use
of information.
SECURITY CONTROLS
Security Controls
The safeguards or countermeasures prescribed for
an information system to protect the confidentiality,
integrity, and availability of the system and its
information.
Administrative
Physical
Technical
Administrative Controls
Policies
Change passwords ever 90 days
Personnel Screening
Background checks
System Activity Monitoring
URL monitoring
Change Control Procedures
Patch control
Security Awareness Training
Hallway posters
Physical Controls
Badge access
Cameras
Fences
Lighting
Security guards
Locks
Tamper seals
Technical Security Controls
Access Control
Audit and Accountability
Identification and Authorization
Communications Protection
System Integrity
Access Control
Access Control ensures
that resources are only
granted to those users
who are entitled to them.
Access Control uses
Authentication
Authorization
Monitoring,
User roles
User permissions.
Audit and Accountability Periodic audits determine the
adequacy of the security
requirements, ensure
compliance with security policy,
and are used to detect breaches.
Audits depend on logged events
Date and time of event
Component
Type of event
User/subject id
Non-repudiation
Identification and Authentication
Verifying the identity of a
user, process or device.
User ID/Password, Digital
Certificates, serial numbers
Uniquely identifies users
process, or devices
Communications Protection
Protect the Smart Grid System and
communications links between
components from intrusions.
Management traffic separated from
data traffic,
Limit the effects of denial-of-service
attacks
Firewalls between system boundaries.
Encryption, cryptographic hashing,
digital signatures and certificates.
System Integrity
Data have not been modified
nor deleted in an unauthorized
or undetected manner.
Software patch management,
firmware downloads, system
monitoring, software testing,
event monitoring, secure hash.
SECURITY TECHNOLOGY
Security Technology
Encryption
Asymmetric, symmetric
Encryption key management
Cryptographic Hashing
SHA (secure hash algorithm)
HMAC (hashed message authentication code)
Digital Signatures
RSA digital signatures
Elliptical Curve Cryptography (ECC) digital signatures
Certificates
Logs
Encryption Encryption combines
confusion with diffusion
Confusion obscure the
relationship between you
real message and the
encrypted message
Diffusion spread the
message out
The secret to encryption
is the key
Asymmetric and
Symmetric
Encryption Keys
Symmetric Key
encryption uses
the same key
value to encrypt
and decrypt
Asymmetric key
encryption uses
different key
values to encrypt
and decrypt
Encryption Key Management
Creating, distributing and deleting
keys securely
Symmetric key management
Asymmetric key management
Pre-placed keys, over the air key
updates
Cryptographic Hashing
A cryptographic secure hash
algorithm (SHA) takes an
arbitrary block of data and
returns a fixed-size bit string.
it is infeasible to find a message
that has a given hash,
it is infeasible to modify a message
without the hash being changed,
it is infeasible to find two different
messages with the same hash.
HMAC is a signed hash
Digital Signatures
Digital Signatures are a way to
cryptographically authenticate a
message
Signature is calculated using
the private key and sent to
the receiver
Signature can only be verified
using the public key
RSA digital signatures (DSA)
and ECC digital signatures
(ECDSA)
Digital Certificates
An electronic document
which uses a digital
signature to bind a public
key with an identity , such
as:
The name of a person
The name of an
organization,
Street address
Domain name
X.509 Certificate format
Field Name Description
Public Key Reconstruction Data Device's public key signed by the CA's private key
Subject Contains the IEEE address associated with thecertificate
Issuer Identity of the CA that issued the certificate
Attributes An extra set of data associated with the device whoseauthenticity is guaranteed by the CA.
ECC Implied Certificate format
Logs Event logs are critical to information security
HAN logs
Meter exception and normal alerts
Filed Area Router logs
Head End System
Logs need to be collected, stored and analyzed.
Date Time Priority Hostname Message
04-21-2010 17:09:30 User.Info 192.168.174.8 Wed Apr 21 21:09:29 2010 nohost sys_log.c: SN:9797 [INFO] Syslog heartbeat
04-21-2010 17:09:30 User.Info 192.168.174.8Wed Apr 21 21:09:29 2010 nohost Event Log: SN:9797 [INFO] Heartbeat Wed Apr 21
21:09:29 2010 UTC - free H 17092 - free NP 546 - NP LW 530 M 0 0 2 0 0
Layered Security
Application layer security
Ensures
top related