steve parker - the internet of everything: cyber-defense in an age of ubiquitous vulnerability
TRANSCRIPT
The Internet of Things Everything: Cyber-defense In an Age of
Ubiquitous Vulnerability
EnergySec Hawaii Educational SessionsFebruary 24, 2016
Steven ParkerPresident
2
I’m Getting Old
3
It’s getting weird out there!
4
Introduction The Internet of Things Everything– Planes, trains, and automobiles– Home electronics, smart meters, light bulbs– Kids toys, smart phones, home security– Refrigerators, washing machines– Transformers, Traffic Lights, Drones–What’s left?
Attack pathways surround us. What’s next?
Let’s provoke thought, not fear!
5
Approach and Goals Discuss technology that falls outside
the normal scope of protection for mission critical systems, yet could be used tactically to impact critical operations
Explore possible attack methods utilizing these technologies
Discuss possible actions to mitigate the impact of the scenarios
6
ThesisIn the near future, “cyber attacks” will be used to support nearly every traditional attack tactic from the non-cyber world.
To paraphrase Jack Whitsitt, Cybersecurity isn’t about cyber, or security, or technology. It is about your mission.
7
We Can’t Protect Everything
Protection Paradigms– Air Gaps– Layered Defense– ”Borderless” networks– Resiliency– Impact Levels
8
Scoping – NERC CIP StyleA Cyber Asset that if rendered unavailable, degraded, or misused would, within 15 minutes of its required operation, misoperation, or non-operation, adversely impact one or more Facilities, systems, or equipment, which, if destroyed, degraded, or otherwise rendered unavailable when needed, would affect the reliable operation of the Bulk Electric System. Redundancy of affected Facilities, systems, and equipment shall not be considered when determining adverse impact. Each BES Cyber Asset is included in one or more BES Cyber Systems. A Transient Cyber System is not a BES Cyber Asset.
9
But We Must Protect the Mission
Survival Paradigms– Redundancy – Backup Systems– Recovery–Manual Operation– Alternative Procedures– People?
10
Resiliency – NERC CIP StyleEach Responsible Entity shall have one or more documented recovery plans that collectively include each of the applicable requirement parts in CIP‐009‐5 Table R1 – Recovery Plan Specifications. [Violation Risk Factor: Medium] [Time Horizon: Long Term Planning].
11
Roadmap to Achieve Energy Delivery Systems Cybersecurity
By 2020, resilient energy delivery systems are designed, installed, operated, and maintained to survive a cyber incident while sustaining critical functions.
12
Dependencies Things we choose not to protect, or protect less
– Corporate/Business Networks– HVAC– Email– Support Systems– Others?
Things outside of our control– Power– Water– Internet– GPS– Telecommunications– Certificate Authorities– Supply Chain– Others?
13
PowerWithout Power, nearly everything breaks.
Do you own manual can opener?
Gas pipeline/power generation interdependency (ERCOT issue)
How long will your generator run?
Are you on a well?
Is your iPhone charged?
14
Water
15
Internet/Communications Do you depend on cloud services?– Is your recovery plan on a hosted instance of
Sharepoint? Internet based VPN tunnels? Cellular backhaul?– Metering, Operations, ???
Facebook/Twitter/National Weather Service Operational coordination, SCADA, Customer
interactions What else?
16
GPS
17
Certificate Authorities
18
Supply Chain
19
Tactical Cyber Attacks
20
Tactical Cyber Attacks
21
Tactical Cyber Attacks
Deli.Meat.Scale.
22
Tactical Cyber Attacks
For western intelligence agencies, the blowout was a watershed event. Hackers had shut down alarms, cut off communications and super-pressurized the crude oil in the line, according to four people familiar with the incident who asked not to be identified because details of the investigation are confidential. The main weapon at valve station 30 on Aug. 5, 2008, was a keyboard.
23
ScenariosWould you like to play a game?
Brainstorm plausible-ish scenarios in which cyber attacks can impact mission critical operations
Electric Power Airlines Manufacturing Roll your own
