welcome to the world of insecure critical infrastructure and … · 28 2nd dimension : security...
TRANSCRIPT
1
Welcome to the World of Insecure Critical Infrastructure
andRoadmap for Protection
ACinfotec RedTeam
2
Who we are
Pornsook Kornkitichai - Senior security architect and consultant; ACinfotec Co.,Ltd;
• GPEN, eCPPT, C|EH
• MSc in Computer Science; University of Oxford
• Royal Thai Government Scholarship
• BEng in Computer Engineering;1st class honour; Chulalongkorn University
• Research Interest: Cyber Crime, Cyber Warfare, Art of attack and defence
Nuttakorn Dhiraprayudti - Security consultant; ACinfotec Co.,Ltd;
• CISSP, CISA, eCPPT, PECB 22301 Implementer
• MSc in Information Security; Royal Holloway, University of London
• BEng in Computer Engineering; Chulalongkorn University
• Research Interest: Computer Forensics, Penetration Testing
3
Outline
• A glimpse of ICS/SCADA world
• Insecurity of ICS/SCADA
• Demo
• How to secure
• ICS/SCADA VS Traditional Penetration Testing
• Our services and approaches
4
ICS in brief
ICS (Industrial Control System)
1. SCADA (Supervisory Control And Data Acquisition)
2. DCS (Distributed Control System)
Our industry, our society, and our way of life
depend upon these systems!!!
5
ICS in our daily life
Refinery Plant
Smart Grid
Water Plant
Chemical Processing
Rig
Building Automation System
Data Center
HVAC System
Transportation System
6
Common Components
Controller
Field Device
HMI SCADA Server
Controller
Field Device
Field Device
Field Device
9
When SCADA went wrong
On June 10, 1999, a pipeline owned by Olympic Pipeline Company ruptured and gasoline leaked into two creeks in Bellingham, Washington. The gasoline ignited, resulting in a fireball that killed 3 persons, injured 8 other persons, caused significant property damage, and released approximately ¼ million gallons of gasoline, causing substantial environmental damage.
11
Hackers know it very well
110
243
347
0
100
200
300
400
2010 2011 2012
# ICS Vulnerabilites by ICS-CERT
12
Everybody says it is insecure
ICS/SCADA in the old days,
Photo: http://www.gizmodo.com.au/2012/10/the-awesome-control-rooms-that-run-the-world/
13
SCADA in the old days
but ICS/SCADA is now “DIGITALLY CONNECTED”
All rights reserved by Christie Digital
16
also web-accessible
I can find PLC.
Photo: http://dailypayne.com.s60471.gridserver.com/wp-content/uploads/2010/01/day-9-i-see-you.jpg
17
Document Manual
Security is disabled by default. To log in, enter any name; you do not need a password or domain name
S5-LAN-LINK has a special protocol for communication with the PC. For this communication you need a DLL. In this document this DLL will be written down. There is no security of this protocol.
The option of configuring user passwords with special characters is supported in WINCC flexible 2007 or higher. Passwords which contain special characters are not supported in previous version of WinCC Flexible.
A password which contains special characters is reset to the default value “100” if you convert a project as of WinCC flexible 2007 or higher into a previous version. Define a new password without special characters after having completed the conversion.
20
What if your ICS/SCADA system is online?
“It took only 18 hours to find the first signs of attack on one of the honeypots. “
Who’s Really Attacking Your ICS Equipment?
Percentage of attacks per country
25
ICS Challenges
• Updating OS Patch
• Updating Antivirus Definition
• Cost of testing environment
• Connection between corporate and ICS network
• No security built-in; plain-text protocol, lack of authentication
• Gap between Engineering skills and IT security skills
• External Threats - Cyber Terrorist
• Internal Threats - Disgruntled employees
• Etc.
28
2nd Dimension : Security Standard & Guideline
Critical Infrastructure Sectors Sector Specific Security Standard
Energy NIST SP800-82, NERC CIP, ISA-99/IEC62443
Public Health and Healthcare ISO 27799, HIPAA
Banking and Finance PCI DSS, ISO 27015 (FDIS)
ChemicalCommercial FacilitiesDamsCommercial Nuclear Reactors, Material and Waste
CFATS, NEI-0404
Telecommunications ISO 27011
Drinking Water and Water Treatment Systems CFATS
Transportation SystemsAgriculture and FoodDefense Industrial BaseGovernment FacilitiesInformation TechnologyPostal and Shipping
No specific
https://www.dhs.gov/homeland-security-presidential-directive-7
29
3rd Dimension : Assessment Framework
• Port Scan could crash the system because of strange payloads and overwhelming packets.
• With embedded devices which are not Windows/Unix, you will have more problems.
• Most control systems use simple HTTP GET/POST requests, automated tools could shutdown the mission-critical functions.
• Traditional Pentest tools are not enough for ICS protocols. We need better and more specific tools to tackle the ICS world.
“You need elaborate plans and procedures to conductsecurity assessment against ICS environment.”
Danger of Traditional Pentest
30
• Layered-approach Security Assessment based on
NERC CIP, CPNI, ISA-99/IEC62443, ISO27001, SANS
• ICS/SCADA Architecture Review
• Smart Grid Security Assessment
• Safety and availability
• With elite team members
Our services & approaches
31
References• http://www.incognitolab.com
• http://ics-cert.us-cert.gov/sites/default/files/Year_in_Review_FY2012_Final_0.pdf
• http://www.co.whatcom.wa.us/archives/whatcomcreek/
• http://www.f-secure.com/weblog/archives/00002083.html
• http://365.rsaconference.com/servlet/JiveServlet/previewBody/3697-102-1-4855/BR-208_Bencsath.pdf
• http://blog.trendmicro.com/trendlabs-security-intelligence/whos-really-attacking-your-ics-devices/
• https://www.yokogawa.com/za/cp/overview/pdf/CS_Risk_Assessment.pdf
• http://www.cpni.gov.uk/Documents/Publications/2011/2011034-scada-securing_the_move_to_ipbased_scada_plc_networks_gpg.pdf
• http://www.redtigersecurity.com