# Presentation: 477798

## Performance Testing: The Effects of  Antivirus Software on the Operation of PC Based HMI Software Joe Falco Manufacturing Engineering LaboratoryNational Institute of Standards and TechnologyFebruary 18, 2004

**Notes:**
Good afternoon. We’re going to start this afternoon session with a brief presentation on our Critical Infrastructure Protection Program. The program seeks to improve the cybersecurity of industrial control systems. It is our newest program; it was first funded about a year and a half ago.

## NIST Industrial Control Security Testbed Architecture

## Bottling Plant Simulation

- DeviceNet I/O network
- Three controller options
- PC-based software PLC
- Modicon hardware PLC
- DeltaV Hybrid Controller
- SQL database for data logging

## Water Distribution SCADA Simulation

- Ultrasonic Level Transmitters
- Analog Flow Meters
- Liquid Level Switches
- Centrifugal Pumps

- MTU Allen-Bradley ControlLogix/Flex IO
- RTUs Allen-Bradley SLC500
- DNP 3.0 Serial
- Ethernet

## Performance Testing

- 	Provide performance measures of PC based control software execution vs. modes of operation of concurrently executing security software
*	**	**Note:  Any results will be reported in aggregate,*
*          **	**          **or with any vendor-identifying information *
*          **	**          **removed.*

## Antivirus vs. HMI Performance

- Map functionality of both  antivirus software packages.
- Configure HMI software at upper and lower bounds.
- Record antivirus installation and default configurations.
- Test procedures least intrusive to most intrusive.
- Design test procedures to be repeatable.
- Monitor PC system resources (CPU, Network Traffic).
- Monitor communication packets from HMI to PLC.
- Compare loads with and without antivirus software.
- Inject test viruses from available access points.
- Include testing during virus definition updates.

## Antivirus/HMI Test Matrix

| HMI-1 vs. AV-1 | HMI-2 vs. AV-1 |
| --- | --- |
| HMI-1 vs. AV-2 | HMI-2 vs. AV-2 |

- HMI-1

- HMI-2

- AV-1

- AV-2

## Current Status

- Antivirus application functionality mapping completed
- HMI-1 programmed for lower end operation
- Performed preliminary testing between
- 	HMI-1, AV-1 and AV-2 applications

## Initial Testing

- Manual Scanning of Hard Drive
- Manual Scanning of Floppy Drive
- Active Scanning
- AV1 Manual Scan of Hard Drive over different CPU priority settings
- Data packets collected over 1 minute period
- Analyze single data variable packet – calculate time between consecutive messages.
- Baseline
- Antivirus mode of operation/ no virus
- Antivirus mode of operation/ virus present

## Manual Scan: Hard Drive

**Manual Scan: Hard Drive**

## Manual Scan: Floppy Drive

**Manual Scan: Floppy Drive**

## Active Scanning

**Active Scanning**

## AV1 : CPU Priority Settings

**AV1 : CPU Priority Settings**

## Next Steps

- Program HMI-1 application at an upper end.
- Program HMI-2 application at lower and upper end.
- Document a set of performance test methods based on results of initial testing.
- Perform testing across test methods.
- Continue efforts using other security applications such as personal firewalls and control applications such as software PLCs

## Summary

- Introduction to the NIST Process Control Security Testbed.
- Development of performance methods to assess the effects of security software on the performance of PC based control software.
- Presented initial test results for effects of antivirus software on the performance of HMI software.
- Discussed future activities in this area.