**Categorized Vulnerabilities**

**Chemical Sector Security Meeting**

**16 Jan 2003**

-   **Communications**

> Wireless rogue access points -- plug access point into wireless net
> allowing unauthorized communication
>
> Application of wireless in process control --

-   Roving operator -- wireless capability used to support operations
    and maintenance. This capability is not part of the process control
    functions.

-   Wireless devices integrated into the control system -- where
    wireless is a replacement for the means of communicating

> Communication Integrity -- two-way authentication, trusted channel
> between communicating devices; this includes defining information
> flows and flow directions and enforcing the defined flows; also
> includes range checking to ensure legitimate secure values
>
> Remote access:

-   Dial-up connections

-   Cable modem

-   DSL

-   Wireless

> Authenticate access to control system device(s), authenticate across
> boundaries
>
> (Physical/logical depiction of authentication rules/devices)
>
> Serial connection using leased line, dial-up or wireless connections.
>
> Need to define appropriate serial-mode protections

-   **Information Distribution -- Information Protection**

> Maintaining the confidentiality of system documentation and
> configuration evidence.

-   **Physical**

> Lack of alarms
>
> Lack of logging access
>
> Physical access controls
>
> Breakers, communication wiring, power backup, fire, temp, humidity
> controls
>
> Cleaning personnel
>
> No physical protection on field devices
>
> Security policy definition and security configuration definition

-   **Operating Systems**

> File permissions
>
> Internet access on SCADA host
>
> Having unused and unnecessary services enabled
>
> Maintaining secure configuration of O/S -- controlled updates of
> patches and service packs vice uncontrolled 'blind' application
>
> Use of external devices possibly bootable
>
> Registry access/configuration access

-   **Audit and Accountability**

> Recording relevant events and supporting information

-   **Authentication**

Re-authentication capability based upon command being invoked

-   **Security Alarms**

> Potential security policy violations recorded in audit log and
> reported
>
> Reporting mechanism -- TBD, should include sense of verifying
> authenticity of alarm condition

-   **Applications**

> EFM, contracts management, scheduling, etc. The resolution to this
> issue lies in where does the application lie and is it in or out of
> scope

1.  if in scope, what controls are in place

2.  if out of scope is the interface being effectively controlled

> (address o/s concerns and application concerns jointly)

-   **Firewall (to include other perimeter defense mechanisms)**

> DMZ definition
>
> Virus protection and content filtering
>
> Issues with 'pseudo-firewall' capabilities

-   **Network Security Architecture, Protection Domain Definition and
    Data Interchange between Protection Domains**

> Definition of security domains and protection domains
>
> Data Interchange and Network Architecture Issues
>
> Integration of business system with SCADA and no controls or isolation

-   **Field Devices**

> Defining access controls for field devices
>
> Weak authentication, no password, default passwords
>
> Layered defense mechanisms

No version management

> Record configuration change events (implement capability)

-   **Login access (more appropriately defined as Identification and
    Authentication)**

> Access control policies and rules
>
> Vendor direct unauthenticated access
>
> Remote-shell enabled
>
> FTP access
>
> Secure-login, single-user
>
> Vendor back-door
>
> Field-device access not authenticated or uses common credentials

-   **Systems Management (Configuration, Proprietary/Sensitive
    information, Operations)**

Defining and Maintaining Secure Configuration

Automate where possible -- data collection, comparison, backup

> Terminal services on wrong platform
>
> Inter-service agreements
>
> Defining and verifying configuration, maintaining
>
> DCS -- configuration done on engineering workstation,
> checked,verified. Device then installed into runtime environment.
> Configuration pushed to the device. Incorporate capability to ensure
> configuration is pushed to correct device.
>
> Roles and responsibilities

-   Granularity of controls for individuals authorized to administer and
    operate the system; restrictive authorizations/defaults

    -   e.g., passwords that expire on first use

    -   communication ports/services disabled (difficulty in defining
        what is the minimal configuration/capability required 'by
        default')

-   Consideration should be given to enabling operation outside the
    bounds of the enforced policy (maybe), possibly to include timeout

> Software version/baseline, delivered baseline, configuration baseline
>
> Layering of security mechanisms
>
> Filtering scripts, java, etc, etc. -- auto version upgrades
>
> Issues with compatibility with virus protection s/w
>
> Miscellaneous
>
> Requirement for vendor to be sensitive to design -- should not
> introduce known vulnerabilities into control networks