# Presentation: 853363

## Security:  Generic Vulnerabilities 

**and Protection Measures**

**Siemens Customer Association SECA XVII Conference**
**Houston, Texas**
**April 23, 2001**
**Jeff Dagle**
**Pacific Northwest National Laboratory**
**Richland, Washington**
**U.S. Department of Energy**
**Office of Critical Infrastructure Protection**

## Scope

**Follow-up to *****SCADA Security***** presented at SECA XVI in Brooklyn Park, MN October 9, 2000**
**Refer to the earlier presentation for context-setting background information**
**Today’s discussion provides an overview of common vulnerabilities observed, and an observation of where to find “low hanging fruit”**
**Issues raised here should be considered in the context of a broader risk management strategy**

## Outline

**Statement of threat**
**Typical vulnerabilities observed, trends**
**Standard countermeasures**
**Overarching security policy**
**Risk management strategy**
**Conclusions**

## The threat is real!

**Unstructured adversaries**
**Cracker, hacker, script-kiddie**
**Competitors**
**Criminals**
**Structured adversaries**
**Terrorists, hactivists**
**Organized crime**
**Foreign nations**
**Insiders**
**Witting**
**Unwitting**
**Half-witting**

## Sources of Vulnerabilities

**Exploits at the application, platform, or network level**
**Remote *****trusted***** access by**
**Other enterprise elements (e.g., front office, support functions, etc.)**
**Vendors, customers, business partners**
**Security coordinators, neighboring control areas, etc.**
**Unencrypted communications, lack of authentication**
**Improper privilege escalation**
**Password cracking**
**Insider threat**
**Lack of physical access control**
**Critical facilities**
**Remote locations (e.g., substations, communication facilities)**

## Vulnerability Concerns

**Confidentiality**
**Protecting information from unauthorized access**
**Important for deregulation, competitive intelligence**
**Integrity**
**Assuring valid data and control actions**
**Most critical for real-time control applications**
**Availability**
**Continuity of operations**
**Important for real-time control applications**
**Historically addressed with redundancy**

## Typical Vulnerabilities Observed

**Ports and services open to outside**
**Operating systems not “patched” with current releases**
**Dial-up modems (already ubiquitous, trend toward wireless)**
**Improperly configured equipment (firewall does not guarantee protection)**
**Improperly installed/configured software (e.g., default passwords)**
**Inadequate physical protection**
**Exploitation of pathways that inadvertently allow access to critical assets**
**Vulnerabilities related to “systems of systems”  (component integration)**

## Vulnerability Trends

**Much more interconnectivity**
**Internal and external networks merging**
**Functional, organization interconnection**
**Increased reliance on information systems**
**Information becoming inseparable from the core business**
**Increased standardization**
**Open protocols, common operating systems and platforms**
**Industry in transition**
**Deregulation, mergers, new systems and procedures**
**Driven to “do more with less”**

## Top 7 Management Errors 

**Pretend the problem will go away if they ignore it. **
**Authorize reactive, short-term fixes so problems re-emerge rapidly.**
**Fail to realize how much money their information and organizational reputations are worth. **
**Rely primarily on a firewall. **

**Source:  www.sans.org**

## Top 7 Management Errors (cont.)

**Fail to deal with the operational aspects of security: make a few fixes and then not allow the follow through necessary to ensure the problems stay fixed. **
**Fail to understand the relationship of information security to the business problem -- they understand physical security but do not see the consequences of poor information security. **
**Assign untrained people to maintain security and provide neither the training nor the time to make it possible to do the job.**

## Other Vulnerability Challenges

**Configuration management is not practiced beyond systems directly affecting physical operations**
**Interconnectivity and interdependencies not widely understood**
**Boundaries of systems and authorities (particularly information systems) are becoming blurred**
**Level of trust granted is frequently unwarranted**
**Partitioning logical systems to control access and limit influence is not widely practiced**
**No explicit vendor security validation**
**Limited incident detection, reporting, recovery, and forensics capability**

## Tenuous balance between public information and security needs
FERC disclosure requirements (market sensitive information)
Public franchise issues
Public-access web sites
Generally vulnerabilities are greater in:
Small organizations
Organizations experiencing major culture or mission changes
Need to cultivate security awareness and permeate throughout organization
General observation – wide variation within industry
Need exists to adopt common protection “standards”

**FERC disclosure requirements (market sensitive information)**
**Public franchise issues**
**Public-access web sites**
**Generally vulnerabilities are greater in:**
**Small organizations**
**Organizations experiencing major culture or mission changes**
**Need to cultivate security awareness and permeate throughout organization**
**General observation – wide variation within industry**
**Need exists to adopt common protection “standards”**

**Other Vulnerability Challenges (cont.)**

## IEEE Standard 1402-2000

**IEEE Guide for Electric Power Substation Physical and Electronic Security**
**Provides definitions, parameters that influence threat of intrusions, and gives a criteria for substation security**
**Cyber methods considered:**
**passwords**
**dial-back verification**
**selective access**
**virus scans**
**encryption and encoding**

## Additional Countermeasures to Consider

**Implement access control with strong passwords**
**Implement automatic reporting/intrusion detection features**
**Create a multi-tiered access hierarchy**
**Implement application level authentication and packet level data encryption**
**Consider implementing public key infrastructure (PKI)**
**When properly implemented, PKI certificates enable authentication, encryption, and non-repudiation of data transmissions**
**Implement properly configured firewalls and intrusion detection systems**
**Have a defined Enterprise-level computer network security policy**
- Ref:  *Concerns About Intrusion into Remotely Accessible Substation Controllers and SCADA Systems*,
- Schweitzer Engineering Laboratories, www.selinc.com

## Defense in Depth Strategy

**Multiple layers of defense**
**Strong network perimeter**
**Perimeter intrusion detection**
**Internal access control to mission-critical systems**
**Internal intrusion detection**
**Host-level hardening of mission-critical systems**
**Good configuration management**
**Effective policies and procedures**
**Security awareness, training, and management control**

## Overarching Security Polity

**Establish high-level accountability**
**Spanning both physical and cyber security**
**Develop security policies**
**Address security in the context of corporate goals**
**Implement security procedures**
**Actual implementation, not just on paper**
**Provide adequate training**
**General employees, system administrators, etc.**
**Evaluate security in the context of an overarching risk management plan**

## Risk Management Framework

**Capture no-cost (or very low cost) security improvements as a matter of standard operating procedure**
**Evaluate other security improvements in the context of risk reduction**
**Understand threat against the asset**
**Understand impact if the asset is compromised**
**Investigate alternative mitigation methods**
**Evaluate overall cost-effectiveness of the security countermeasure**
**Consider both cost to implement and cost to maintain**

## Elements of a Risk Management Strategy

**Deterrence**
**Decrease the probability of an aggressor’s attempt**
**Prevention**
**Decrease the probability of an aggressor’s success**
**Detection**
**Awareness of an aggressor’s activity**
**Mitigation**
**Limit the consequences of an aggressor’s action**
**Crisis management**
**Restoration**

## Response and Recovery

**Contingency planning, disaster recovery drills**
**Safety considerations**
**Backup systems, restoration plans**
**Preserve evidence**
**Carefully evaluate system for changes**
**Emphasizes the need for thorough and updated documentation, configuration management process**

## Other Issues

**Early detection is critical**
**Actively look for signs of malicious activity**
**Carefully evaluate trends, patterns**
**Notify appropriate authorities if malicious activity is detected**
**Actively participate in NERC/NIPC Indications &Warnings program**
**Ensure effective mechanisms are in place to follow-through**
**Conduct periodic vulnerability assessments**
**Comprehensive, independent evaluation**
**Include penetration testing, active vulnerability scanning to identify and/or validate potential vulnerabilities**
**Engage broader elements of the organization**

## Conclusions

**Systems are becoming more vulnerable**
**Standard, open protocols**
**Increasing interconnection with other systems and networks**
**Industry in transition**
**Focus countermeasures to protect the confidentiality, integrity, and availability of information assets**
**Utilize a comprehensive risk management strategy that bridges physical and cyber security**
**Deterrence**
**Prevention**
**Detection**
**Mitigation**
**Crisis Management**
**Restoration**
**People are a big part of the solution **
**	****(otherwise they are a big part of the problem) **

## For more information...

**Dr. Paula Scalingi**
**U.S. Department of Energy**
**(202) 586-7873**
**Paula.Scalingi@hq.doe.gov**
**Jeff Dagle**
**Pacific Northwest National Laboratory**
**(509) 375-3629**
**jeff.dagle@pnl.gov**