Contextually-Aware AccessControls
Nancy Cam-Winget
Cisco Systems
Technical Trackwww.odva.org

ICS Implications of theInternet Expansion
IncreasedRisks

Increased
Network Usage

Unauthorized devices

More IP enabled devices

Unauthorized users

More device types

Infected Devices

Increased use of mobiledevices

Infected Users

Remote accessWho’s on the network?

Different types of users

Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 2www.odva.org

Network Security Trends

Internal threats from employees, vendors, contractors, infected devices

Increasingly, more attacks come from internal accessTechnical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 3www.odva.org

Why Contextual Access Control?
Is anyone allowed
Internet Access?
Can Remote Accessinto SCADA or ICS be
granted to anyone?
On any device?

Increased
Risks
Security (Protection) begins withShould all devices
begaining visibility of who, what,
when,allowed to communicate
where and how the systemwithisanybeing
device?
accessed
Should all users

Technical Track© 2014 ODVA, Inc.

Who can access SCADAor ICS or both?

communicate with anyuser or device?

Can they be granted
full access?

Are remote users allowed
to do any type ofoperation?

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 4www.odva.org

Contextual Based Access Control
WHERE
WHATWHENWHO

HOW
Building a Context
to determine Access

Access Control

Rule Name

Conditions

Access Control

Supervisor

ifSupervisor

then

SCADA and ICS

Employeeif

Employee, wired or wirelessthenICS

Contractor

ifContractor, 9am-5pm

thenICSICS device

ifICS Device, wired

thenICS and SCADA

Default

If no matches, thenTechnical Track© 2014 ODVA, Inc.

Deny Access2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 5www.odva.org

“Who” is connecting?
Policy Evaluator

Who can be determined by:- Device classification based on MAC address- Device classification based on fingerprinting- If a human is attached: identity based on usernameRole can de determined by:- Device classification- Group membership defined (e.g. Active Directory)- Combination of device + group membership

WiredVPN

Wireless

Device (with or without human) attempts to connect

Employees
Technical Track© 2014 ODVA, Inc.

ICS Things

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

Contractors/Guests
page 6www.odva.org

Connection Origin = “Where”
Policy Evaluator

Where is determined by connection type:- Wired- Wireless- Remote Access
Where is determined by the access edge device(e.g. Switch, Access Point, VPN server)

WiredVPN

Wireless

Device (with or without human) attempts to connect

Employees
Technical Track© 2014 ODVA, Inc.

ICS Things

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

Contractors/Guests
page 7www.odva.org

Building Context in action
SupplicantUsers,Endpoints

Guest User

2

Policy Servers evaluate identity information
 If policy requires device classification: Device Profiler classifies device type
 Guest Server manages temporary guest access WHEN can be aggregate WHO can be enriched to include device profile Context aggregation continues until overall policy can be evaluated andreturns authorization back to the Switch
WHO, WHERE and WHEN
can beestablished once a network session
Switchis beingICSinitiated:
Policy ServerNetwork“HOW”
canbeconstructed thru
End user / Endpoint attempts to(typically thru
access network temporary accessSwitch
Authentication can occur via device whitelisting,network authentication or guest accessservice redirection to allow
URLInitiates Context at the Switch to identify:
WHO “Compliance” or Posture Checking)

PLC
Device1 WHERE

3

Access Control based on policies
 Switch enforces access control based on policy (VLAN Assignment,dACL, RBACL)
Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

ProtectedResources
page 8www.odva.org

“How” are they connecting?
Policy EvaluatorHow can be determined by:• A combination of the device classification and“Posture” check• Posture check is the means to determine
if the device is installed with the right OS, patches
and applications

Posture Evaluator

WiredVPN

Wireless

Device (with or without human) attempts to connect

Employees
Technical Track© 2014 ODVA, Inc.

ICS Things

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

Contractors/Guests
page 9www.odva.org

Posture Policy Profiles
Corporate PC/HMI Policy:• Microsoft patches updated• McAfee AV installed, running,and current• Corp asset checks• Enterprise application running

Policy Evaluator

Contractor Policy:• Any AV installed,running, and current
Guest Policy: Accept Authentication(Internet Access Only- nocompliance check done)

Wired
ICS Policy:• Configuration verification• Version updates• Asset checks

VPN

Wireless

Device (with or without human) attempts to connect

Employees
Technical Track© 2014 ODVA, Inc.

ICS Things
2014 Industry Conference & 16th Annual Meeting
All rights reserved.

Contractors/Guests

page 10www.odva.org

Building Context in action
2Policy Servers evaluate identity information
 If policy requires device classification: Device Profiler classifies device type

SupplicantUsers,Endpoints

 Guest Server manages temporary guest access WHEN can be aggregate

Guest User WHO can be enriched to include device profile Context aggregation continues until overall policy can be evaluated andreturns authorization back to the Switch

Policy Servers requires Posture Check
PLC
Device2.5

 Temporary access is granted (thru URL redirection) to allow for Posturechecking based on Device Type (and User, user type) Posture result defines the “HOW”

Edge SwitchICSNetwork1

End user / Endpoint attempts toaccess network

Policy Server
PostureEvaluator

Switch Authentication can occur via device whitelisting,network authentication or guest access service
 Initiates Context at the Switch to identify:
 WHO
 WHERE

3

Access Control based on policies
 Edge Switch enforces access control based on policy (VLAN

Assignment, dACL, RBACL)
Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

Protected
Resources
page 11www.odva.org

“What” is being accessed?
Policy Evaluator

What can be determined by:
A Deep Packet Inspection probe to discover- Application type
- Protocol type
- Operations within application and/or protocol

Posture Evaluator“WHAT” further helps define policies WiredVPN
Wirelessto detect whether Users and Devices arecommunicating to the right sources andwith correct privileges
Device (with or without human) attempts to connect
Employees
Technical Track© 2014 ODVA, Inc.

ICS Things

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

Contractors/Guests
page 12www.odva.org

ICS Policies = more Context

Rule NameConditions

Access ControlSupervisor

ifSupervisor

thenSCADA and ICS

Employee

ifEmployee, wired or wirelessthenICS

Contractor

ifContractor, 9am-5pm

thenICSICS device

ifICS Device, wired

thenICS and SCADANo Updates

if

Active Device in Cell Area

thenBlock Update commands

Default

If no matches, thenTechnical Track© 2014 ODVA, Inc.

Deny Access2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 13www.odva.org

Context post-Edge Access

Access Switches establishes initial context:

Technical Track© 2014 ODVA, Inc.

WhoWhat

WhereWhenHMIWeb,CIP

wired

7:00am PST

I/OCIPwired

7:00am PST

Controller

CIP

wired

7:00am PST

Drive

CIP

wired

7:00am PST2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 14www.odva.org

}Context updates with DPI probing

WhoWhat

WhereWhenGroup

State

HMI

Web,CIPwired

7:00am PST

CA-3

Active

I/O

CIP

wired

7:00am PST

CA-3

Inactive

Controller

CIP

wired

7:00am PST

CA-3

Inactive

Drive

CIP

wired

7:00am PST

CA-3

Inactive

Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 15www.odva.org

Dynamic Context updates =Dynamic policy enforcement
WhoWhat

WhereWhenGroupStateHMIWeb,CIP

wired

7:00am PST

CA-3

ActiveContextI/OcreatedCIP
at EdgeAccesswired
7:00am PST

CA-3

Inactive

CA-3

Inactive

Controller

CIP

wired

7:00am PST

Drive

CIP

wired

7:00am PST

CA-3
Inactive
Context
Aggregatedby FW’s

Policies
evaluated
atConditions
Edge Access
Rule
Name

Access Control

Supervisor

ifSupervisor

Employeeif

Employee, wired or wirelessContractor

ifContractor, 9am-5pm

ICS device

ifICS Device, wired

No Updates

if

Active Device in Cell Area

Default

If no matches, then}Technical Track© 2014 ODVA, Inc.

then

SCADA and ICS

thenICS
Continuousevaluation enables
thenICS
Stateful(dynamic) policies
thenICS and SCADA
thenBlock Update commands

Deny Access2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 16www.odva.org}