Surveillance Continue d’Activité et Localisation d’Agressions

SCADA (Supervisory Control And Data Acquisition) systems are used in many business sectors such as transportation, energy, telecom or water distribution. Most of these sectors are defined in Europe as mission critical sectors and, as a consequence, critical installations have to be protected. For malicious action or terrorism purpose, enter in a SCADA system allows capability to control the system with a wide impact on the process. This risk is increased by the distributed architecture of the process and the associated infrastructure: there are lot of sites and most of them are remotely controlled. There are plenty of solutions to protect a legacy infrastructure of an information system, but these solutions are not useful for industrial systems, because not taking into account the specificity of those systems. These industrial systems are controlling physical processes outside the IT systems, traditionally able to operate as autarkic systems with very dedicated equipment technology optimized to local process efficiency and software developed for constrained devices (in terms of capability of processing, storage or communication). In this context, the systems are not protected enough, and system design and operational processes were only marginally impacted by IT security concerns. In this global context of protection of the infrastructure and the networks, we plan to explore economically justifiable protection and improve the detection of intrusion to reduce and minimize remaining risks substantially. 1. Context and positioning SCADA (Supervisory Control And Data Acquisition) systems are used in many business sectors such as transportation, energy, telecoms or water distribution. Most of these sectors are defined in Europe as mission critical sectors and, as a consequence, critical installations have to be protected. For malicious action or terrorism purpose, enter in a SCADA system allows capability to control the system with a wide impact on the process. This risk is increased by the distributed architecture of the process and the associated infrastructure: there are lots of sites and most of them are remotely controlled. Studies in IT security have been made and are going on to protect these systems against intrusion and vulnerabilities exploit. The packaging of solutions used initially for the protection of legacy information systems has been adapted to be used in industrial environment. Nevertheless, the security cannot be perfect. The hypothesis that the conventional security measures can be bypassed by intruder seems to be realistic. In this context, the SCALA project has three main goals: Monitor the network and the system components to display an unusual status through an inspection system; Detect/isolate: define an algorithm to detect and to isolate (identify)as soon as possible actions made by an intruder using anomaly detection technique; Protect: improve the protection of the system against exogenous attack. Two types of results are expected, methodology and prototype of product: Create a methodology for risk analysis dedicated to industrial system used for process control : define the security concepts for industrial system; Prepare an awareness and educational training kit for operational and technical staff in order to improve operational processes by taking into account the security commitments; Identify and develop the instruments able to protect the integrity of the production system; Development of solutions for detection of abnormality of the behaviour of the system. In order to demonstrate the capabilities of the results, operators will be involved in the project. These operators operate sites in water and energy domains. As required by the call 2011, partnership has been made between German and French partners. The following chapters are focused on the French tasks of the project. 2. State of the art 2.1 SCADA system: a special case of cyberphysical systems The SCADA system is a special case of cyber-physical systems (CPS). A CPS is a system featuring a tight combination of, and coordination between, the system’s computational and physical elements. Unlike more traditional embedded systems, a full-fledged CPS is typically designed as a network of interacting elements with physical input and output instead of as standalone devices. A real world SCADA system can monitor and control hundreds to hundreds of thousands of Input/Output (I/O) points. As an example, a very simplified water distribution SCADA application would be to monitor water levels at various water sources like reservoirs and tanks and when the water level exceeds a preset threshold, to activate the pumping system to transfer water to tanks to low tank levels. The SCADA Host is usually industrial PC running sophisticated SCADA with treatment and HMI (Human Machine Interface) software. This software is used to exchange data with the remote sites and store the collected data in its centralized database. Logic can be configured in the SCADA Host software which then monitors and controls plant or equipment. The control may be automatic, or initiated by operator commands. SCADA systems have to monitor and to control two types of signals: Analog signals: levels, temperatures, pressures, flow rate, motor speed, etc. Digital signals: level switches, pressure switches, generator status, relays, motors, etc. There is typically another layer of equipment between the remote sensors/instruments and the central computer. This intermediate equipment (existing on the remote side) is used to digitalize and packetize the sensor signals so that they can be digitally transmitted via an industrial communications protocol over long distances to the central site. Typical equipment that handles this function is PLC’s (Programmable Logic Controllers) and RTU’s (Remote Terminal Units). SCADA systems cover much larger geographic areas. RTUs differ from PLCs in that RTUs are more suitable for wide geographical telemetry, often using wireless communications, while PLCs are more suitable for local area control (plants, production lines, etc.) where the system utilizes physical media for control. 2.2 Main characteristics of SCADA systems Detecting an intrusion and/or a failure in the SCADA system is a difficult task because CPS (including SCADA systems as a particular case) has specific characteristics: Input and possible feedback from the physical environment; Distributed management and control; Real-time performance requirements; Wide-distribution geographically, with components in locations that lack physical security; Multi-scale and systems of systems control characteristics. Feedback and input from the physical environment means the existence of communication channels which need to be “secured”. This characteristic is one that is specific to CPSs. An attacker does not need to break into the computer to affect such a system, but could cause a coordinated streak of physical actions that are sensed and which cause the system to respond in an unexpected manner. To protect efficiently such systems from this kind of attack requires an understanding of the system from the process point of view and not from the security point of view Large-scale CPSs involve management by multiple parties. The utilities manage their own parts of the whole system. Global decisions (induced by interconnections between utilities) affect the whole system. Many of the changes that need to be made across the system as whole must occur increasingly on small time-scale, meaning automation of local actions based on input from other organizations in other parts of the system. The structure of such systems is like a federation: systems are interconnected and control is distributed. CPSs have real-time requirements. Some actions must be made locally to take into account failure transmission elsewhere. The delayed reaction on the initial failure will result in cascading failures and possible permanent damage to equipment. Over time, these interactions have become more complex, and require reaction on smaller time-scales. This requires automated response, sometimes based on remote inputs from sensors and commands originating with other members of the federation. The real-time requirement also implies a requirement for performance (no overload of the whole system). CPSs are often geographically dispersed, with components in the field where they lack appropriate physical security. Such physical dispersion also makes it difficult to physically reset, or reload the software on a compromised device. Security solutions in such an environment must be tied in part to resilience of the application in spite of such compromise, rather than focus solely on preventing compromise of the component in the first place. CPSs may be multi-scale systems and systems-ofsystems. Since components in the systems of systems are necessarily part of multiple systems, with different ownership, management, and security requirements, what we once thought of as non-critical infrastructure can have critical consequences. CPSs are often using large networks. Any large network is a very “noisy” environment 1 even at the packet level [1]. Such noises may affect the performance of an Intrusion Detection Systems (IDS) by adding ambiguities into physical “analog” and “digital” sensing. Moreover, noise is also referring to the diversity of legitimate network traffic [2]. Zachary et al. [3] further argue that discerning between normal and malicious traffic is an ill-posed problem. Some of the mostly common used SCADA-specific protocols are byte-coding, such as ModBus, DNP3. When these protocols are tunneled over IP and used in conjunction with TCP, the security implication of the envisioned problem due to ambiguities would be more potentially damaging, if no proper attention is paid on. 2.3 Exploiting physical interactions to improve security The design of applications for security is crucial for a SCADA system. The common appr