Cyber Security of SCADA Systems Testbed Development May1013 Group Members: Ben Kregel Justin Fitzpatrick Michael Higdon Rafi Adnan Adviser: Dr. Manimaran

What is SCADA? Supervisory Control and Data Acquisition ► Use in critical infrastructures, utilities ► Sensing, decision making and control associated with real-time operation

WWW Sensor 1 Sensor 2 RTU 1 RTU 2 Scalance Host 1Host Control Center Scalance Substation 2Substation 1 SCADA Network Topology

Problem & Solution ► Problem  Significantly dated SCADA systems  Security concerns in the past  Security risks in today’s internet age  Open to attacks from the outside ► Solution  Design and implementation of SCADA test beds for use in security evaluation, testing and simulations.

► The National SCADA Test Bed (NSTB) with DOE  Primary goals: ► Industry awareness and collaboration ► Developing solutions and risk mitigation strategies ► Developing intelligent, inherently secure and dependable control systems and infrastructures ► National standards and guidelines for secure control systems ► Research goals geared toward answering and satisfying the problem and need statement of this project as well as industry needs. Project Need

► FR01. Establish an operational SCADA test bed. ► FR02. Incorporate security features into the SCADA test bed. ► FR03. Integrate a live resistive current load ► FR04. Conduct simulations and analysis on the test bed. ► FR05. Conduct attack scenarios for the test bed. Functional Requirements

► NFR01. Users shall be able to try to hack into the system with any means necessary. ► NFR02. Users shall be able to run software with no problems. ► NFR03. Users shall be able to change settings on relays for testing. ► NFR04. The software shall be updated by Siemens. ► NFR05. All our research shall be fully documented. ► NFR06. Maintain proper communication between network hardware. Non-Functional Requirements

► Develop system software fluency  Individual program operations ► Develop SCADA test bed  Establish functionality between all devices  Incorporate security practices ► Integrate hardware simulation  Develop a simulated load  Configure current protection methods  Manual control and telemetry from control center ► Cyber security evaluation and testing Goals

► Complete report on the simulation system used ► Reports on vulnerabilities from attack simulations ► Documentation on how to reproduce and combat said vulnerabilities Deliverables

► Personnel  Research and development dependent project  High level of software and device complexity  Extremely high learning curve for the software ► Software and Facilities  Software programs provided by Siemens  Teleconferencing session with representatives from Siemens  Necessary training and skills  Efficient operation of the software ► Assistance of two grad students  Test bed setup  Security testing Resource Requirements

Schedule ► Establish a software model  Substations and generation  October 2009 ► Integrate hardware into software  Establish a full test bed  December 2009 ► Test vulnerabilities and holes in system  Fixing broken elements of the system  Jan-May 2010

Project Schedule

Work Breakdown

Risks ► Lack of proper training:  SCADA test bed operation is crucial  Proper software and device training  Training sessions ► Malfunctioning software or test bed equipment:  Sensitive and expensive devices  Improper use could result in breakdown  Corruption in the system database  Nature of our work is to test the vulnerability of the system  Being careful not to damage any of the equipment

Implementation

► Control Center ► Remote Terminal Unit (RTU) ► Sensors High Level Components

WWW Sensor 1 Sensor 2 RTU 1 RTU 2 Scalance Host 1Host Control Center Scalance Substation 2Substation 1 SCADA Network Topology

Functional Testing ► Progressive testing of the SCADA system  Separate “phases” ► Remotely open and close a circuit breaker ► Integrate a resistive load ► Observe real-time current on the system ► Over-current tripping on the relays

WWW Sensor 1 Sensor 2 RTU 1 RTU 2 Scalance Host 1Host Control Center Scalance Substation 2Substation 1 SCADA Network Topology

Control Center  Spectrum Power TG  Managing databases  Establishing communications  Monitoring current or voltage levels, trip breakers.  Analog telemetry from relays  Binary statuses for breakers

WWW Sensor 1 Sensor 2 RTU 1 RTU 2 Scalance Host 1Host Control Center Scalance Substation 2Substation 1 SCADA Network Topology

► Point-to-point data protection between SCALANCE cells ► Real-time data encryption ► Remote access through gateways SCALANCE

WWW Sensor 1 Sensor 2 RTU 1 RTU 2 Scalance Host 1Host Control Center Scalance Substation 2Substation 1 SCADA Network Topology

► SICAM PAS (Power Automation System) ► Operates between the control center and sensory relay devices ► Responsible for interpreting sensory data and communicating this data to a control center Remote Terminal Units (RTU)

WWW Sensor 1 Sensor 2 RTU 1 RTU 2 Scalance Host 1Host Control Center Scalance Substation 2Substation 1 SCADA Network Topology

► Siemens DIGSI 4 ► Sensor components at remote substations ► Measure and capture real-time transient current data ► Act as a circuit-breaker and trip in the event of over-current Relays

Security Testing ► Nmap  Port scanning  Communication Port ► Wireshark  Packet capture  DNP 3.0 Protocol  Relay Open/Close request packet ► Attack Development  Disrupt operation of SCADA system

Security Testing ► Disrupt communication between the control center and the remote substations ► ARP poisoning  Man-in-the-Middle attack  Filtered out original command requests  Replicated commands from the control center but the relay reported no change in the status of the circuit ► Results  Successfully filters command request  Control center command lockout

Accomplishments ► Attack-defense testing and impact analysis: 1.Successful setup and configuration of our SCADA network 2.Incorporation of SCALANCE devices in VPN mode 3.Remote control of relay circuit breakers 4.Integration of an actual resistive load 5.Implementation of circuit breaker tripping in the event of an over- current detection 6.Compromising the operation of the SCADA system 1. Denial of Service attacks 2. Man-in-the-Middle attacks

Conclusions & Lessons Learned ► Scope of the project  Simple attacks  Local SCADA network ► Possibility of more sophisticated attacks ► Better understanding and management of the software and devices  More efficient operation of the system  Allows for more in-depth security evaluations

Discussion