1. הקריה למחקר גרעיני - נגב Nuclear Research Center – Negev (NRCN) Society of Electrical and Electronics Engineers in Israel (SEEEI) 2012 Eran Salfati, Amir Ellenbogen, Meir Arad, Yagil Kadmon Security Standards Implementation To Improve ICS and SCADA Security

2. Introduction. Cyber Attacks. ICS Weakness. Security Model. Case Study. Subjects

3. Introduction. Introduction. Cyber Attacks. ICS Weakness. Security Model. Case Study. Subjects

4. Introduction ICS - ICS - Industrial Control System: SCADA - SCADA - Supervisory Control and Data Acquisition DCS - DCS - Distributed Control Systems PLC - PLC - Programmable Logic Controllers

5. What is a Cyber Attack? A cyber attack can include a wide variety of computer-based events that could impact: Confidentiality: violate the security of data or software. Unauthorized access (internal or external) by those without appropriate authorization and “need to know”. Integrity: unauthorized modification, destroy of data, systems, and information. Availability: deny access to systems, networks, services, or data.

6. Introduction. Cyber Attacks. Cyber Attacks. ICS Weakness. Security Model. Case Study. Subjects

7. Attack Vectors

8. ICS Security Vs IT Security

9. Cyber Incidents types

10. Introduction. Cyber Attacks. ICS Weakness. ICS Weakness. Security Model. Case Study. Subjects

11. ICS Weakness 1. No Authentication  What is the “identity” of an automated system?  How would policies such as “change password monthly” be applied on systems that supposed to run un attended for years?  How do you manage rights for each person? 2. No Patching  Systems have never needed security patches in the past.  Old: Install a system, replace it in 5 years.  New: Install a system, patch it every month.

12. ICS Weakness 3. Denial about how much they are connected to the internet  Belief: not connection at all.  Reality:  numerous uncontrolled connections.  Reality: even network that are separate get connected via  roaming USB drives and laptops.

13. Introduction. Cyber Attacks. ICS Weakness. Security Model. Security Model. Case Study. Subjects

14. Awareness Standardization Efforts International Society for Automation International Electro technical Commission National Institute for Standards and Technology United State Computer Emergency Readiness Team

15. ISA 99 Work Products

16. The cyber security program must be designed to: Prevention and Mitigation – Coordinates activities to reduce the likelihood of success and severity of impact of a cyber attack through risk-mitigation activities. Defense-in Depth – Apply and maintain protective strategies to ensure the capability to detect, respond to, and recover from cyber attacks. Control Systems Security Program (CSSP)

17. A-I-M A – Assess. I – Implement. M – Maintain. Security Model

18. A – Assess Risk assessments and critical asset identification. Perform a ICS & SCADA assessment. Perform a risk analysis Create a security policy.

19. A – Assess

21.  Design for desired security level.  Deploy protective measures.  Mitigation.  Test Security. I – Implement The System Security Plan Network Separation Hardening Monitoring

22. Update assessment. Review and update risk analysis. Update security policy. Apply Standards to Future Projects. Continue to Test your Protected System. M – Maintain

23. Introduction. Cyber Attacks. ICS Weakness. Security Model. Case Study. Case Study. Subjects

24. Case Study This case study is referring to the following SCADA security viewpoints: 1) Different security stations (computers) on one control network. 2) HMI software product. 3) Restrict access. 4) Cycle pass codes. 5) No connection to other networks.

25. Physical & Hardware hardring 1) Restricted number of technicians responsible for maintenance. 2) No CD-ROM drive 3) No internet access. 4) No keyboard – touch screen interface only. 5) Segregated control network, no connection to other networks. 6) Each computer is locked in a restricted room or cabinet. Case Study

26. Software Restrictions 1) No Windows games loaded. 2) Only runtime versions deployed. 3) Development computer located in a restricted access room. 4) Boot up automatically starts application in “run” mode. 5) In run mode the Windows key and alt key are disabled. 6) Only a unique key sequence can interrupt the runtime application. Case Study