Advanced Services Cyber Security 101 © ABB February, 18 2013 | Slide 1

Cyber Security What is Cyber Security? “Measures taken to protect a computer or computer system (as on the Internet) against unauthorized access or attack” Merriam-Webster’s dictionary © ABB Group | Slide ‹#›

Cyber Security Security breaches Control System Personal computer Hacking Malicious software Unauthorized use © ABB Group | Slide ‹#›

Cyber Security Stuxnet: The first malware targeting industrial control systems © ABB Group | Slide ‹#›

Cyber Security Bill Would Have Businesses Foot Cost Of Cyber war © ABB Group | Slide ‹#›

Cyber Security Vulnerability disclosure growth by year 1 new vulnerability every hour, every day. © ABB Group | Slide ‹#› Source: IBM X-Force®

Cyber Security Security Cost The cost of security measures should be balanced against the achieved risk reduction Risk = (probability of successful attack) x (potential consequences) Optimal security for minimum cost Cost of security According to a study by the Ponemon Institute, the cross-industry average cost of a cyber security breach in 2011 was $5.9 MUSD Cost Probable cost of a security breach Security Level © ABB Group | Slide ‹#›

Cyber Security Enterprise IT vs. Industrial Control Systems Primary risk impact Information disclosure, financial Safety, health, environment, financial Availability 95 – 99% (accept. downtime/year: 18.25 - 3.65 days) 99.9 – 99.999% (accept. downtime/year: 8.76 hrs – 5.25 minutes) Typical System Lifetime 3-5 years 15-30 years Problem response Reboot, patching/upgrade Fault tolerance, online repair Confidentiality Availability Integrity Availability Integrity Confidentiality © ABB Group | Slide ‹#›

Cyber Security Why traditional approaches don’t work Action Consequence Lock out accounts after three bad password tries Operator has no control over process for 10 minutes Install patches as soon as they are released and reboot A control system reboot means shutting down the whole plant, and it might take days to get everything running again Frequently update antivirus scan engine and virus definitions False positives might have fatal consequences Use of crypto functions to protect data in transit Real time constraints cannot be met due to limited resources on embedded devices Use of firewalls and intrusion detection systems Do you speak IEC 60870-5-104, IEC 61850, OPC, HART, ProfiNet, Modbus... Use of intrusion prevention systems One false positive might have fatal consequences Information Systems Security is a good starting point, but approaches and technologies need to be applied with care © ABB Group | Slide ‹#›

Cyber Security If it’s worth having it’s worth stealing Source Code Diagrams, Plans and Blueprints Design documents and Metrics data Mechanisms for infrastructure improvements Certificates and Credentials Source: MSI Microsolved Inc. © ABB Group | Slide ‹#›

Cyber Security Aurora Project The generator room at the Idaho National Laboratory was remotely accessed by a hacker and a $1 Million diesel-electric generator was destroyed. ______________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________ © ABB Group | Slide ‹#›

Cyber Security Iranshahr ______________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________ © ABB Group | Slide ‹#›

Cyber Security Damage from within Companies are really just people—and most people fear being labeled “the bad guy.” That fear puts the company at risk. No one person should have enough power to completely destroy company assets or infrastructure. Regular security audits are a key to protecting the company. Security audits should include simulations that cover dealing with disgruntled or terminated employees. ______________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________ © ABB Group | Slide ‹#›

Procedures and Protocols Shamoon Destroyed 30.000+ computers. Insider "Not a single drop of oil was lost.“ CEO Khalid Al-Falih "In our experience in conducting hundreds of vulnerability assessments in the private sector, in no case have we ever found the operations network, the SCADA system or energy management system separated from the enterprise network. On average, we see 11 direct connections between those networks.” Source: Sean McGurk, The Subcommittee on National Security, Homeland Defense, and Foreign Operations May 25, 2011 hearing. ______________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________ © ABB Group | Slide ‹#›

Cyber Security Airgaps Source: Tofino Sercurity. © ABB Group | Slide ‹#›

Cyber Security Protection Basic Advanced Procedures and Policies Whitelisting Update management Intrusion detection Antivirus Intrusion prevention Account management Firewalls Services and ports … Software management © ABB Group

Cyber Security Share information © ABB Group | Slide ‹#›

Cyber Security Remote access Support Center Service Center Internet Virtual Support Engineer © ABB Group November 12, 2018 | Slide 18

Cyber Security www.abb.com/cybersecurity 9AKK105713A6280 A © ABB Group

© ABB Group November 12, 2018 | Slide 20