CT230 - Industrial Network and
Cybersecurity Threats
Amadou Diaw
Business Development Leader
Rockwell Automation - CSM Consulting Services
Rev 5058-CO900F
Copyright © 2014 Rockwell Automation, Inc. All Rights Reserved.
Physical Layer
COMPANY INTERNAL - Internal Use Only
Copyright © 2014 Rockwell Automation, Inc. All Rights Reserved.
2
The Network is Slow!!!
Top hosts,
conversations,
protocols
Voice
Virus
Hacking
Multicast
DNS
Peer-to-peer
Worms
What’s really
happening on
my network?
COMPANY INTERNAL - Internal Use Only
Copyright © 2014 Rockwell Automation, Inc. All Rights Reserved.
3
Internet
Modern ICS
Enterprise Network
Workplaces
Firewall
Enterprise
Optimization
Suite
Enterprise
Network
IP
Third Party
Application
Server
Mobile
Operator
Services
Network
Connectivity
Server
Historian
Server
Application
Server
Engineering
Workplace
Control
Network
Serial, OPC
or Fieldbus
Redundant
Device Network
Third Party
Controllers,
Servers, etc.
Serial
COMPANY INTERNAL - Internal Use Only
RS485
Copyright © 2014 Rockwell Automation, Inc. All Rights Reserved.
Wireless = RF SIGNAL…
The 2.4GHz and 5GHz RF represent the
physical layer for 802.11 wireless LANs
2.4GHz 802.11b/g and 5GHz 802.11a
Not just 802.11 WiFi devices use these
frequencies
Radar
Bluetooth
Other Wi-Fi Networks
Bluetooth, analog video cameras, cordless
phones, microwave ovens, motion sensors,
florescent lights
The RF environment for good WiFi
performance
Relatively free of interfering 802.11 and non802.11 devices
Adequate signal strength over the target
coverage area
COMPANY INTERNAL - Internal Use Only
2.4/5 GHz
Cordless Phones
Microwave Ovens
Copyright © 2014 Rockwell Automation, Inc. All Rights Reserved.
5
IS CRITICAL
of industrial network operators have
faced a large scale
McAfee and the Center for Strategic and International Studies (CSIS)
April 2012
CYBERATTACKS ARE
a day is the average costs per
24 hours of
McAfee and the Center for Strategic and International Studies (CSIS)
April 2012
IS ESSENTIAL
was spent on
in 2011
PriceWaterhouseCoopers LLP, Nov 2011
COMPANY INTERNAL - Internal Use Only
Copyright © 2014 Rockwell Automation, Inc. All Rights Reserved.
Anatomy of a Zero-day Attack
COMPANY INTERNAL - Internal Use Only
Copyright © 2014 Rockwell Automation, Inc. All Rights Reserved.
Are you Protected?
“Some organizations will be a target regardless of what they do, but most
become a target because of what they do…”
Compromising network security is a $6 billion global underground industry of
which $300 million is directly tied to manufacturing
“If your organization is a target of choice, understand as much as you can
about what your opponent is likely to do and how far they are willing to go.”
Source : 2013 DBIR
COMPANY INTERNAL - Internal Use Only
Copyright © 2014 Rockwell Automation, Inc. All Rights Reserved.
ICS Security in the News
COMPANY INTERNAL - Internal Use Only
Copyright © 2014 Rockwell Automation, Inc. All Rights Reserved.
9
Maroochy Shire Sewage Plant
In the spring of 2000, a former employee of
an Australian organization that develops
manufacturing software applied for a job
with a local government, and was rejected.
Over a 2-month period, this person used a
radio transmitter on as many as 46
occasions to remotely break into the
controls of a sewage treatment system.
He altered electronic data for the sewage
pumping stations and caused malfunctions
in their operations.
This led to releasing about 264,000 gallons
of raw sewage into nearby rivers and
parks.
Reference: courtesy of Clinton Webb, Central Tech
COMPANY INTERNAL - Internal Use Only
Copyright © 2014 Rockwell Automation, Inc. All Rights Reserved.
10
… and how did “they” get it?
JAC Motors
4R3
Ford Motor Company
F-150
COMPANY INTERNAL - Internal Use Only
Copyright © 2014 Rockwell Automation, Inc. All Rights Reserved.
Nothing is beyond reach
“Computer spies have broken into the Pentagon's
$300 billion Joint Strike Fighter project
-- the Defense Department's costliest
weapons program ever...
“the intruders were able to
copy and siphon off several
terabytes of data related to
design and electronics
systems, officials say, potentially making it easier to defend against the craft.”
http://online.wsj.com/article/SB124027491029837401.html#ixzz1dQEQ283S
COMPANY INTERNAL - Internal Use Only
Copyright © 2014 Rockwell Automation, Inc. All Rights Reserved.
… and how did “they” get it?
Chengdu Aircraft
Industry Group
J20
Lockheed Martin
F-35
COMPANY INTERNAL - Internal Use Only
Copyright © 2014 Rockwell Automation, Inc. All Rights Reserved.
Demo Time
Rev 5058-CO900F
Copyright © 2014 Rockwell Automation, Inc. All Rights Reserved.
Manufacturing Security
Infographic
Source : 2013 DBIR
Sixty Two Percent
91%
of breaches took less than a day to
execute
took
Months or Years to
Discover
53%
took months to
Only 1 out of 10 were discovered
by an internal resource…
COMPANY INTERNAL - Internal Use Only
Contain
Copyright © 2014 Rockwell Automation, Inc. All Rights Reserved.
Real-world Threats to Industrial Systems
Cyber Attack
Effects & Impacts
Conficker (2008)
Worm that enabled remote access with payload replacement capability –
Windows OS affected including Windows industrial PCs.
Operation Aurora
(2009)
Attacks aimed at high tech, security and defense contractors alleged to
access and potentially alter source code repositories.
Stuxnet (2010)
Duqu (2011)
Nitro Malware (2011)
Computer worm that facilitated the manipulation of PLC logic and operator’s
view to disrupt a process and damage assets.
Targeted Remote Access Trojan (RAT) alleged to enable reconnaissance and
intelligence-gathering as precursor to attack.
Remote Access Trojan (RAT) targeting chemical and 19 other organizations
in other industries for corporate espionage.
Copyright © 2012 Rockwell Automation, Inc. All rights reserved.
Security Threat Actors
Human
System
• Malicious
• Ignorant
• Misconfiguration
• Lack of Privilege
Control
Copyright © 2012 Rockwell Automation, Inc. All rights reserved.
17
Security Threat Vectors
Application of
patches
Natural or Man-made
disasters
Worms and
viruses
Theft
Sabotage
Unauthorized
access
Denial of
Service
Unauthorized actions
by employees
Unauthorized
remote access
Unintended
employee actions
Security risks increase potential for disruption to
system uptime, safe operation, and a loss of intellectual property
Copyright © 2012 Rockwell Automation, Inc. All rights reserved.
Industrial Control Systems in PPD-21
Defined Critical Infrastructure Sectors
Chemical
Commercial Facilities
Critical Manufacturing
Dams
Defense Industrial Base
Energy
Food and Agriculture
Nuclear Reactors
Transportation
Water/Wastewater
Government Facilities
Industrial Control Systems are core to
operations of Critical Infrastructure Processes
Copyright © 2012 Rockwell Automation, Inc. All rights reserved.
19
Industrial Network Security Trends
Established Industrial Security Standards
International Society of Automation
ISO/IEC-62443 (Formerly ISA-99)
Industrial Automation and Control Systems (IACS) Security
Defense-in-Depth
IDMZ Deployment
National Institute of Standards and Technology
NIST 800-82
Industrial Control System (ICS) Security
Defense-in-Depth
IDMZ Deployment
Department of Homeland Security / Idaho National Lab
DHS INL/EXT-06-11478
Control Systems Cyber Security: Defense-in-Depth Strategies
Defense-in-Depth
IDMZ Deployment
A secure application depends on multiple layers of protection.
Industrial security must be implemented as a system.
Copyright © 2012 Rockwell Automation, Inc. All rights reserved.
20
CT231 - Industrial Network and
Cybersecurity Solutions
Amadou Diaw
Business Development Leader
Rockwell Automation - CSM Consulting Services
Rev 5058-CO900B
Copyright © 2012 Rockwell Automation, Inc. All rights reserved.
NIST CYBERSECURITY FRAMEWORK
Functions
NIST FRAMEWORK CORE
Categories
Subcategories
Information
An undertanding of how to
manage cybersecurity risks to
systems, assets, data and
capabilities
Asset management, business
environment, governance, risk
assessment, risk management
strategy
ISA99 / IEC-62443
NIST SP 800-XX
DHL INL/EXT-06-11478
DHS CRR
TSA TSSCWG
NERC-CIP XXX
PROTECT
The controls and safeguards
necessary to protect or deter
cybersecurity threats
Access controls, awreness and
training, data security, data
protection processes,
maintenance, protective
technologies
ISA99 / IEC-62443
NIST SP 800-XX
DHL INL/EXT-06-11478
DHS CRR
TSA TSSCWG
NERC-CIP XXX
DETECT
Continuous monitoring to
provide proactive and realtime alerts of cybersecurityrelated events
Anomalities and events,
continuous monitoring, detection
processes
ISA99 / IEC-62443
NIST SP 800-XX
DHL INL/EXT-06-11478
DHS CRR
TSA TSSCWG
NERC-CIP XXX
RESPOND
Incident-response activities
Response planning,
communications, analysis,
mitigation, improvements
ISA99 / IEC-62443
NIST SP 800-XX
DHL INL/EXT-06-11478
DHS CRR
TSA TSSCWG
NERC-CIP XXX
RECOVER
Business continuity plans to
maintain resilience and
recover capabilities after a
cyber breach
Recovery Planning, improvements,
communications
ISA99 / IEC-62443
NIST SP 800-XX
DHL INL/EXT-06-11478
DHS CRR
TSA TSSCWG
NERC-CIP XXX
Reference: www.pwc.com/cybersecurity
IDENTIFY
Copyright © 2012 Rockwell Automation, Inc. All rights reserved.
22
.
Network CyberSecurity Services Overview
ASSESS
DESIGN/PLAN
IMPLEMENT
AUDIT
MANAGE/MONITOR
COMPANY INTERNAL - Internal Use Only
Assess the current
state of the security
program, design,
policy
Assess the current
state of the network
design,
implementation
Design and plan a
network infrastructure
Installation,
procurement and
configuration of a
network
Audit current architecture
compared to governing
body (ODVA, IEEE,
ANSI/ TIA)
Manage, maintain
and monitor uptime
and issues on the
network and SANs
environment
Assess the current
state of a
manufacturing data
center
Design and plan
security program,
policy, infrastructure,
business continuity
plan
Implementation of a
security program,
infrastructure design,
policy training
Design and plan a
SANs infrastructure
Installation,
procurement and
configurations of a
SANs infrastructure
Audit security program
compared to governing
body (NERC CIP, ISA 99, NIST 800-53, NIST
800-82
Managed Security
Services (Incident
response, disaster
recovery, monitoring)
Copyright © 2014 Rockwell Automation, Inc. All Rights Reserved.
LOGICAL NETWORK DESIGN CONSIDERATIONS
Rev 5058-CO900F
Copyright © 2014 Rockwell Automation, Inc. All Rights Reserved.
Holistic Defense-in-Depth
Copyright © 2012 Rockwell Automation, Inc. All rights reserved.
25
Holistic Defense-in-Depth
EtherNet/IP Industrial Automation and Control System Network
Open by default to allow both technology
coexistence and device interoperability for
Industrial Automation and Control System
(IACS) Networks
Secure by configuration and architecture:
Configuration
Harden the infrastructure through holistic
defense-in-depth - multiple layers of security
Architecture
Structure the infrastructure to defend the edge
- Industrial DMZ (IDMZ)
Copyright © 2012 Rockwell Automation, Inc. All rights reserved.
26
Industrial Network Security Trends
EtherNet/IP Industrial Automation & Control System Network
Flat and Open
IACS Network Infrastructure
Structured and Hardened
IACS Network Infrastructure
Copyright © 2012 Rockwell Automation, Inc. All rights reserved.
27
Holistic Defense-in-Depth
Critical Elements to Industrial Security
A balanced Industrial Security Program must address both Technical and
Non-Technical Elements
Non-technical controls - rules for environments:
e.g. business practices, standards, policies, procedures,
risk management, education and awareness programs
Technical controls – technology to provide restrictive measures for nontechnical controls: e.g. Firewalls, Group Policy Objects, Layer 3 access
control lists (ACLs), Physical Access
Security is only as strong as the weakest link
“one-size-fits-all”
Vigilance and attention to detail are KEY to the long-term security success
Copyright © 2012 Rockwell Automation, Inc. All rights reserved.
28
CPwE Industrial Network Security Framework
Copyright © 2012 Rockwell Automation, Inc. All rights reserved.
29
Industrial Network Security Framework
CPwE Architectures
Internet
Enterprise
External DMZ/
Firewall
Identity Services
Enterprise Zone: Levels 4-5
Industrial Demilitarized Zone (IDMZ)
Physical or Virtualized Servers
• Patch Management
• AV Server
• Application Mirror
• Remote Desktop Gateway Server
Industrial Zone: Levels 0-3
Authentication, Authorization and Accounting (AAA)
Core
Switches
Wireless LAN
Controller (WLC)
Active
Control System Engineers
Control System Engineers
in Collaboration with IT
Network Engineers
(Industrial IT)
Standby
Distribution
Switch Stack
Level 3 – Site Operations
FactoryTalk
Client
IT Security Architects in
Collaboration with Control
Systems Engineers
SSID
2.4 GHz
Level 2 – Area Supervisory Control
LWAP
SSID
5 GHz
I/O
Controller
Controller
Level 1 - Controller
Soft
Starter
WGB
MCC
Level 0 - Process
I/O
Drive
Copyright © 2012 Rockwell Automation, Inc. All rights reserved.
30
IDMZ - Industrial DeMilitarized Zone
Copyright © 2012 Rockwell Automation, Inc. All rights reserved.
31
Network Security Framework
Industrial Demilitarized Zone
Enterprise Network
Level 5
Level 4
E-Mail, Intranet, etc.
Site Business Planning and Logistics Network
Remote
Gateway
Services
Patch
Management
Application
Mirror
Enterprise
Security
Zone
Firewall
AV
Server
Web Services
Operations
Web
E-Mail
CIP
Application
Server
Industrial
DMZ
Firewall
Level 3
Level 2
FactoryTalk
Application
Server
FactoryTalk
Directory
Engineering
Workstation
Remote
Access
Server
Site Operations
and Control
Area
Supervisory
Control
Operator
Interface
FactoryTalk
Client
FactoryTalk
Client
Operator
Interface
Engineering
Workstation
Basic Control
Level 1
Level 0
Batch
Control
Sensors
Discrete
Control
Drive
Control
Drives
Continuous
Process
Control
Actuators
Industrial
Security
Zone
Safety
Control
Robots
Cell/Area
Zone
Process
Logical Model – Industrial Automation and Control System (IACS)
Converged Multi-discipline Industrial Network
No Direct Traffic Flow between Enterprise and Industrial Zone
Copyright © 2012 Rockwell Automation, Inc. All rights reserved.
32
Industrial Demilitarized Zone (IDMZ)
Industrial Network Security Framework
All network traffic from either side of the IDMZ terminates in the IDMZ; network traffic does not
directly traverse the IDMZ
Only path between zones
No common protocols in each logical firewall
No control traffic into the IDMZ, CIP stays home
No primary services are permanently
housed in the IDMZ
Trusted? Untrusted?
Disconnect Point
Replicated
Services
IDMZ
IDMZ shall not permanently house data
Application data mirror and reverse proxies
to move data into and out of the Industrial Zone
Limit outbound connections from the IDMZ
Enterprise
Security
Zone
No Direct
Traffic
Disconnect Point
Industrial
Security
Zone
Trusted
Be prepared to “turn-off” access via the firewall
Copyright © 2012 Rockwell Automation, Inc. All rights reserved.
33
Industrial Demilitarized Zone (IDMZ)
Industrial Network Security Framework
Permit Secure
Remote Access
to Industrial
Assets
Permit Data from
the Industrial
Zone to
Enterprise
Stakeholders
Wide Area Network (WAN)
Physical or Virtualized
Servers
• ERP, Email
• Active Directory (AD),
AAA – Radius
• Call Manager
Block Untrusted Access
to Industrial Zone
Web
Reports
Plant Manager
Engineer
Untrusted
WLC (Enterprise)
Remote
Access
Core
switches
Firewall (Inspect Traffic)
Permit
Physical or Virtualized Servers
• Patch Management
Remote
• AV Server
Desktop
• Application Mirror
Gateway
Block
Industrial
Demilitarized Zone
(IDMZ)
Web
Proxy
Firewall (Inspect Traffic)
Physical or Virtualized Servers
• Application Servers & Services
• Network Services – e.g. DNS, AD,
DHCP, AAA
• Storage Array
Enterprise Zone
Levels 4-5
ISE (Enterprise)
Block
Permit
Firewalls
(Active/Standby)
Industrial Zone
Levels 0-3
Core
switches
Remote
Access
Server
Level 3
Site Operations
WLC
(Active)
WLC
(Standby)
Distribution
switch
LWAP
Block Untrusted Access
to Enterprise Zone
Untrusted
WGB
PAC
Levels 0-2
Cell/Area Zone
FactoryTalk Client
IO
Drive
MCC
PAC
PAC
Copyright © 2012 Rockwell Automation, Inc. All rights reserved.
34
Translate Logical-to-Physical Design
Translates logical network architecture into physical infrastructure design – using a methodology that
reduces operating costs, speeds new hardware implementation, and ensures that future growth
requirements are considered and properly planned
Rockwell Automation
NSS Services
Logical Architecture
+
Panduit
Advisory Services
Physical Design
=
Reliable, Scalable,
Upgradeable Design
Translate
into Design
Taking Design Phase for granted =
Copyright © 2012 Rockwell Automation, Inc. All rights reserved.
PHYSICAL NETWORK DESIGN CONSIDERATIONS
Rev 5058-CO900B
Copyright © 2012 Rockwell Automation, Inc. All rights reserved.
Infrastructure Investment
Compared to Longevity
Software
Networking
Operations
Cabling
• 60%
• 2 to 5 years
• 23%
• 5 Years
• 10%
• 5 Years
• 7%
• 20+ years (or forever!)
80% of network problems
are caused by only 7% of invested budget.
Copyright © 2012 Rockwell Automation, Inc. All rights reserved.
Think of your Network from End-to-End
People in the Controls world tend to
Enterprise
Control Level
think of networks as the link between
Central Computer
Management Level
Local Control
System
the Control Panel and the device.
Industrial
Ethernet
Control
Network
DMZ Server
Office
Ethernet
Operator
Station
Server
Control
Computers
Field Level
Process
Control Level
Sensors
Analyzers
Field
Devices
Device
Network
SM
Copyright © 2012 Rockwell Automation, Inc. All rights reserved.
Zone Architecture Benefits
Traditional Cable Deployment
• Node to network room “home
runs”
Zone Architecture
• Flexibility for MAC’s
• Reduced installation time
• Simplified diagnostics
Copyright © 2012 Rockwell Automation, Inc. All rights reserved.
Network Infrastructure
Physical Layer Design Considerations
Copper Cabling
Systems
IN-FIELD™
IN-ROUTE™
IN-FRASTRUCTURE ™
Fiber Cabling
Systems
Grounding &
Bonding Systems
Cable
Management
Cable Ties and
Accessories
Fiber Routing
Systems
IN-PANEL™
IN-ROOM™
Zone Cabling
Systems
Managed
Network Systems
Cabinets &
Rack Systems
Identification
Solutions
Copyright © 2012 Rockwell Automation, Inc. All rights reserved.
40
Environmental Focus - M.I.C.E.
Physical Layer Design Considerations
M.I.C.E. provides a method of
categorizing the environmental
classes for each plant Cell/Area zone.
This provides for determination of the
level of “hardening” required for the
network media, connectors,
pathways, devices and enclosures.
The MICE environmental
classification is a measure of product
robustness:
Increased Environmental
Severity
Specified in ISO/IEC 24702
Part of TIA-1005 and ANSI/TIA-568-C.0
standards
TIA 1005
Office
Industrial
Examples of rating:
1585 Media : M3I3C3E3
M12: M3I3C3E3
RJ-45: M1I1C2E2
Copyright © 2012 Rockwell Automation, Inc. All rights reserved.
41
Network Distribution Installation Pitfalls
Physical Layer Design Considerations
Installation is critical for system performance,
security and testability.
Copyright © 2012 Rockwell Automation, Inc. All rights reserved.
42
Micro Data Center – IN-ROOM Solution
Physical Layer Design Considerations
Enterprise/Office
Patchfield used to uplink switch
to Levels 4 & 5 Enterprise
Server Patching
Cross connect between production
servers and switch
Firewall and DMZ
Logical buffer zone between the
Enterprise and Industrial Zones
Industrial Zone
Patchfield used to connect Layer 3 switch
to Layer 2 switches used on plant-floor
Copyright © 2012 Rockwell Automation, Inc. All rights reserved.
43
Validated Building Blocks
Physical Layer Design Considerations
Design your system using
cost effective and easy to
troubleshoot Network
Architecture
Fiber or
Copper
Leverage Reference Architecture & Validated Building Blocks
Industrial Data
Integrated Zoneand Reduce
Control Panel
Solutions
toCenter
Speed Deployment
Risks
Copyright © 2012 Rockwell Automation, Inc. All rights reserved.
44
Network Security Framework
Physical Port Security
Keyed solutions for
copper and fiber
Lock-in, Blockout
products secure
connections
Data Access Port
(keyed cable and jack)
Copyright © 2012 Rockwell Automation, Inc. All rights reserved.
45
Availability, Integrity and Confidentiality
Enterprise networks require C-I-A
Confidentiality of intellectual property matters most
Industrial Control Systems require A-I-C
Availability and integrity of control matters most
control data has low entropy—little need for confidentiality
Many ICS vendors provide “six 9’s” of availability
Ensuring availability is hard
Cryptography does not help (directly)
DOS protection, rate limiting, resource management, QoS, redundancy, robust
hardware with high MTBF
Security must not reduce availability!
Copyright © 2012 Rockwell Automation, Inc. All rights reserved.
Key Takeways
Rev 5058-CO900F
Copyright © 2014 Rockwell Automation, Inc. All Rights Reserved.
TAKE ACTION
Education and awareness:
Within your organization, for your customers or trusted partners
Establish an open dialog between Industrial Automation and IT groups
Establish an Industrial security policy, unique from and in addition to the Enterprise security policy
Holistic Defense-in-Depth approach: no single product, methodology, nor technology fully secures
IACS networks
Be aware of Industrial Automation and Control System Security Standards
IEC-62443 (Formerly ISA99), NIST 800-82, DHS External Report # INL/EXT-06-11478
Utilize standards, reference models and reference architectures
Work with trusted partners knowledgeable in industrial automation and security
"Good enough" security now, is better than "perfect" security ... never. (Tom West, Data General)
Copyright © 2012 Rockwell Automation, Inc. All rights reserved.
Additional Information
Rev 5058-CO900F
Copyright © 2014 Rockwell Automation, Inc. All Rights Reserved.
Rockwell Automation
Educational Tools & Content
EtherNet/IP Website:
http://ab.rockwellautomation.com/Networks-and-Communications/Ethernet-IP-Network
Network and Security Services Website:
http://www.rockwellautomation.com/services/networks/
http://www.rockwellautomation.com/services/security/
Network and Security Services Noggin Site:
https://noggin.gosavo.com/CustomPage/View.aspx?id=28994665
Reference Architectures
Reference Architectures
Design Guides
Converged Plant-wide Ethernet (CPwE)
Application Guides
Fiber Optic Infrastructure Application Guide
COMPANY INTERNAL - Internal Use Only
Copyright © 2014 Rockwell Automation, Inc. All Rights Reserved.
Rockwell Automation
Educational Tools & Content
KnowledgeBase Security Table of Contents
TCP/UDP Ports used by Rockwell Automation products
Network and Security Services Brochure
Whitepapers
Patch Management and Computer System Security Updates
Scalable Secure Remote Access Solutions for OEMs
Top 10 Recommendations for Plant-wide EtherNet/IP
Deployments
Securing Manufacturing Computer and Controller Assets
Production Software within Manufacturing Reference
Architectures
Achieving Secure Remote Access to plant-floor Applications and
Data
Design Considerations for Securing Industrial Automation and
Control System Networks - ENET-WP031A-EN-E
COMPANY INTERNAL - Internal Use Only
Copyright © 2014 Rockwell Automation, Inc. All Rights Reserved.
THANK YOU!
Rev 5058-CO900F
Copyright © 2014 Rockwell Automation, Inc. All Rights Reserved.