Using PI to Aggregate & Correlate Security Events to Detect Cyber Attacks Dale Peterson Digital Bond, Inc.

Agenda Hardening the PI Server – Architecture considerations – Using Bandolier to audit PI server security Using PI to Detect Cyber Attacks – Dept of Energy funded research project – Digital Bond’s Portaledge

PI Security 101 Architecture – Put PI servers in the right zone or zones Do not allow access to control center for PI Do not use two Ethernet cards and become a bridge Leverage PI to PI communication to move between zones of different security levels Is access to your PI data mission critical?

PI Security 101 OSIsoft provides guidance on securing PI Digital Bond has yet to see it followed!!! – piadmin username and password for PI trusts Bandolier – A Dept. of Energy funded research project

Identifying the Problem How do we establish an optimal / best possible secure configuration for our control system servers? How do we verify that this configuration has not changed over time? Can we do this using existing security tools at a low or no additional cost?

Solution: Bandolier Collaborate with vendor and asset owner partners to identify the optimal security configuration Assess and extract security configuration data Create audit files that can be used in Nessus and other scanners Deliver through subscriber content and vendor support channels

Multiple Levels of Audit Tests Operating System Settings Policies Account Management Logging Ownership and Permissions Services Processes Windows Registry Configuration Files Supporting Application Settings Web Servers Application Servers Database Servers SSH Servers LDAP Servers Authentication Libraries Control System Application Settings Authentication and Authorization Configuration Files Default Accounts Logging Application File Ownership and Permissions Services

Bandolier Security Audit File Batch file extracts security parameters from PI – Runs piconfig and a few other programs and dumps results to a file that can be audited ~222 Security Audit Checks – 26 Application Checks – 196 Operating System Checks

NERC CIP Compliance Aid CIP-007 R1: Test Procedures CIP-007 R2: Ports and Services CIP-007 R5: Accounts and Services CIP-007 R8: Vulnerability Assessment See the SCADApedia Page

Nessus Compliance Check Plugin Only uses one Nessus plugin! Safer than traditional scanning – Secure management connection. NOT a Nessus scan! Evaluates the “known good” not “known bad” Exporting to OVAL/XCCDF for use in other vulnerability scanners and security tool

Bandolier Costs and Requirements Prerequisites – Digital Bond Site Subscription $100 / Year – Nessus Professional Feed Subscription $1,200 / Year Many organizations already have a Nessus subscription – Administrator credentials for PI server

Questions

Detecting Cyber Attacks Security log events are everywhere – Firewalls, routers, switches – IDS/IPS – Server and workstation operating systems – SCADA and DCS applications, field devices, … Aggregate and evaluate events – Multiple events can decrease false positives – Multiple events can better

Security Event Managers (SEM) A class of IT security product – ArcSight and LOGIIC Aggregates & correlates security events – Used to detect attacks and forensics Weakness – Does not have interfaces to bring in control system information

Question? What do we use in control systems to aggregate and analyze information? A Historian A PI Server

PI Historian Advantages over SEM Already exist on many control systems – Especially in the energy sector Already interface to control system devices and applications Interface to IT devices and applications Has an advanced correlation capability, ACE

Portaledge A Digital Bond research project – Funded by the US Department of Energy – OSIsoft is a major partner and contributor Goal: Use PI Server as a SCADA SEM – Aggregate security events – Correlate security events using ACE – Alert when cyber attacks are detected

Event Taxonomy Availability Process Manipulation Reconnaissance Meta Events Process Manipulation Event Triggers Availability Event Triggers - Computer System - Field Device - Network Device - Perf Degradation - … - Computer System - Field Device - Network Device - Perf Degradation - … Reconnaissance Event Triggers Reconnaissance Event Triggers - Change in Scale - Change in Display - Firmware upload - … - Change in Scale - Change in Display - Firmware upload - … -Web Crawling - File Probing - Error Reaction Web Crawling - File Probing - Error Reaction -... Event Class Trigger Event Meta Event C C

Event Class Events One or more Events in an Event Class with a commonality generate an Event Class Event – Commonalities: time, IP address, … Will contain a chain of Events – Length and diversity of chains can be used to measure confidence – Chains can be used for escalation process

Event Classes Availability Communication Enumeration Escalation Exploitation Obfuscation Process Manipulation Reconnaissance

Release Packages Subscriber content on digitalbond.com – $100 / year, YES that’s all – Business model is to get research deployed – FREE for 3 months for event attendees who ask me for a free subscription Requires appropriate PI licenses – PI Server, SMT, ACE, Datalink, Excel

Release Package - I Spreadsheet to create PI Tags with SMT plugin – Will require some customization for IP address – Will require copy / paste for multiple data sources Spreadsheet to create modules, alias and properties in the Module Database – Alias PI Tag names for use in ACE These are common functions for PI Admins

Release Package - II ACE Modules – ACE Module DLL and related files – VB.NET files for customization if desired – Context spreadsheet to load ACE module using the SMT Module Database Plugin Documentation – Detailed Portaledge documentation on SCADApedia – Notes and instructions available

Release Package - III DataLink Display – Basic display that shows a scroll of Events – Customers can display results in a variety of ways PI Users are highly experienced on displaying data – Future research to build security dashboard Better way to display alerts so operators can escalate Security metrics to show the security state of the system

Release Schedule Released Today – Availability Event Class – Computer System Availability Event – Field Device Availability Event – Network Device Availability Event – Performance Degradation Availability Event [3] – Simple Network Availability Event Next – Enumeration Event Class All complete in 2009

Questions

Contact Info Dale Peterson, for -Bandolier, Portaledge and other research -SCADA Security Blog and SCADApedia -Whitepapers, podcasts, presentations, …