How to Detect Attacks and Supervise Rail Systems? CYRAIL Final Conference Paris, 18.09.2018 How to Detect Attacks and Supervise Rail Systems? Taha Abdelmoutaleb Cherfia fortiss

Assessment of Existing IDS Solutions Identifying and analyzing the current open source and commercial intrusion detection solutions for IT and OT systems.

Intrusion Detection Intrusion detection is the process of monitoring the events occurring in a computer system or network and analysing them for signs of possible incidents, which are violations or imminent threats of violation of computer security policies, acceptable use policies, or standard security practices. Analysis Collection Response

Intrusion Detection System An intrusion detection system (IDS) is a hardware/software that automates the intrusion detection process.

IDS Characteristics An intrusion detection system has to fulfil the following requirements: Accuracy: IDS must detect and distinguish malicious activities from the legitimate ones. Performance: IDS must be able to perform real-time intrusion detection. Completeness: IDS should not fail to detect and intrusion. Fault tolerance: IDS must itself be resistant and robust against malicious attacks. Scalability: IDS must be able to monitor the worst-case number of events in a large network topology

IDS Taxonomy Host-based Intrusion Detection System (HIDS): HIDS is a software application which resides on and monitors a single host and the events occurring within that host for malicious activities. Network-based Intrusion Detection System (NIDS): NIDS is a standalone hardware device that monitors networks traffic for particular network segments or devices to identify malicious activities.

Intrusion Detection Methodologies Signature-based intrusion detection is the process of comparing signatures against observed events to identify possible incidents. Anomaly-based intrusion detection is the process of comparing definitions of what activity is considered normal against observed events to identify significant deviations. Audit Data Knowledge Base Attack Match ? Audit Data Knowledge Base Attack Statistically Anomalous?

Technical Assessment Exhaustive study on current intrusion detection solutions to assess their applicability to railways. HIDS NIDS . HYBRID IDS UTM Firewalls CyRail – Internal Review © fortiss GmbH March 08, 2018

Technical Assessment 26 open-source and commercial intrusion detection solutions 8 5 13 Open-source and Commercial IT solutions Commercial IT + OT solutions Industrial-focused solutions

Assessment Criteria Asset Discovery Type Protocol Country Response Capacity Maturity Solution Detection Mode Integration Capacity

Railways IDS Solutions Country: Israel Type: Industrial Detection Mode: Anomaly Protocol: Unknown Asset : Unknown Response : Yes Integration: Unknown Maturity: Weak Country: Israel Type: Industrial Detection Mode: Hybrid Protocol: DPI / OT Asset : Yes Response : Yes Integration: SIEM Maturity: Good Country: United Kingdom Type: Industrial Detection Mode: Anomaly Protocol: N/A Asset Discovery: N/A Response : Yes Integration: SIEM Maturity: Weak Country: France Type: Industrial Detection Mode: Anomaly Protocol: DPI / OT Asset Discovery: Yes Response : Unknown Integration: SIEM Maturity: Medium Cylus RadiFlow RazorSecure Sentryo

Deployment of Intrusion Detection Solutions Proposing a flexible deployment scheme of the intrusion detection solutions on the different zones of CyRail’s operational scenario.

NIDS Solutions 1 = NIDS for CI 1 NIDS monitoring internet networks for critical infrastructures They are designed by cyber security experts and then implement attack detection rules (attack patterns and behaviour). They have to be deployed in a way they can analyse the IN/OUT internet network traffic. Eg. GateWatcher and KeelbackNet. 1 Network-based Intrusion Detection System

Industrial NIDS Solutions Specialized in the industrial protocols, based on operational knowledge of the processes and communications. They are mostly designed to detect anomalies. Eg. Claroty, Cyberbit, CyberX, Cylus, Cypres, ICS², Indegy, NexDefense, Nozomi, Radiflow, SecurityMatters and Sentryo. 2 Network-based Intrusion Detection System

HIDS Solutions 3 = HIDS 3 Host-based Intrusion Detection System Eg. RazorSecure. 3

FW/IPS Solutions 4 = FW/IPS 4 Firewall Intrusion Prevention System Located at the border of a zone. E.g. Stormshield. 4

IT NIDS Solutions 5 = IT NIDS 5 Intrusion Detection System IT-extended IDS They can fit IT networks monitoring, due to their origin. Their capability to address industrial networks is more limited than industrial NIDS. Eg. Checkpoint, TippingPoint, Cisco IPS, Fortinet, Forcepoint, Leidos and Juniper. Intrusion Detection System

Deployment of Intrusion Detection Solutions 1 = NIDS for CI 5 2 = Industrial NIDS 1 3 = HIDS 2 4 = FW/IPS 4 3 5 = IT NIDS

Facts and Figures Europe has a strong representation of industrial IDS companies. Most Industrial IDS vendors are recent SMEs. Fast growing market, but not mature enough yet.