WHITE PAPER

Industrial
Cybersecurity—
Essential to Assure
Availability, Safety and
Resilience

FOUNDATIONAL CONTROLS FORSECURITY, COMPLIANCE & IT OPERATIONS

Don’t believe there are realInternet-connected devices by the end of
2017, a pace that leads to an estimated
20.4 billion “things” operating in—andrunning—our world by 2020.

cyberthreats to your operations
network and control systems?
Data shows otherwise. Better
foundational industrial
cybersecurity practices canhelp prevent disruption to youroperations and financial risk to yourbottom line.
Industrial control systems (ICS) are
the workhorses of our physical world,
and those systems are becoming more
networked and more accessible by theday—often from anywhere on the planetwith an Internet connection. Security
experts worry that the growing dependence on Internet-connected devices,
also called the Internet of Things, or IoT,
is outpacing our ability to secure them.
As some have wittily observed, the “S” in
IoT stands for “security.”This security concern is particularly
warranted within industrial and criticalinfrastructure, where cyberthreats canresult in physical disruption, loss ofavailability and even risk to the environment and public safety.
On the other hand, many ICS professionals continue to feel that the actual threat
to plant operations and process controls
is light, given their highly purpose-built
industrial equipment, specialized communications protocols, air gaps, uniqueautomation systems and processes,
and safety instrumented systems.
Unfortunately, that’s not what the datashows in a National Cybersecurity andCommunications Integration Center/Industrial Control Systems Cyber
Emergency Response Team report for
the U.S. Dept. of Homeland Security.

Gartner Research in late 2016 predicted there will be 8.4 million

FY 2016 Incidents by Sector

FY 2016 Incidents by Sector (290 total)

Defense Industrial Base, 1
Financial Services, 2Emergency Services, 2
Food and Agriculture, 3
Chemical, 4Commercial Facilities, 5
Nuclear Reactors,
Materials and Waste, 7
Information
Technology, 7
Healthcare andPublic Health, 11Transportation
Systems, 14
Dams, 0

CriticalManufacturing, 63
Unknown, 15
Government
Facilities, 17

Communications, 62

Water, 18
Energy, 59

Fig. 1 Top three known critical infrastructures under attack are 1) Critical
Manufacturing 2) Communications and 3) Energy. Source: https://ics-cert.us-cert.
gov/Year-Review-2016 Incident Response Pie Charts FY2016

Disruption Can Be Costly
Disruption is also not just an operations
hit—the costs to the business overall
can be significant:»» When the Michigan Board of Water
and Light was hit by ransomwarein April 2016, the total impact for a
few days’ outage plus related costs
was disclosed later that year to
be in excess of $2 million. While it
was the corporate side of the utility
that was impacted, experts said
access to the operations side of theorganization would not have beendifficult, especially since the attack
came through email. This event
demonstrates that an incident canbe costly. Fortunately, they had cyber
insurance.

»» The biggest, and what is believed
to be the most costly, attack inhistory occurred in 2012 to Saudi
Aramco. A terrorist faction called“The Cutting Sword of Justice” used
Shamoon malware to take down
Saudi Aramco’s operations. The
company was impaired for months,
and costs were estimated to be wellover $1 billion dollars (since Saudi
Aramco is privately held and has
never disclosed its incident costs, it’s
not known for sure). However, over
35,000 computers had to be replaced,the entire global organization was
disconnected from the Internet to
reduce the scope of the attack, andbusiness processes were reduced topaper, pens and phones.

It’s Not All About
Hackers and Attacks
Here are a few other incidents illustrating three common and costly areas ofdisruption that can occur due to internal
employee or contractor errors, malware
propagation and equipment failures.
These errors and incidents, which occur
without any malicious intent, are very
common, are viable threats to operations, and are among top concerns byplant management due to disruption andcost.

Case Study andLessons Learned:
U.S. Water Utility Hacked
ICS security can and should be seen as
an essential requirement, supportingand enabling availability and safety.
Operations and process controls mustnot be disrupted, and this remains toppriority within nearly any industrial or
critical infrastructure organization.
Unfortunately, as the latest roundsof malware and ransomware have
impacted businesses globally, it’s
become obvious that cyber risks must
be addressed even in the most challenged industrial environments. Let’s
examine a recent industrial incident andthen summarize some useful industrial-specific security lessons learned foravailability and safety goals.
An unnamed water district, dubbed
the Kemuri Water Company (KWC) in
Verizon’s 2016 Data Breach Digest experienced unexplained patterns of valve
and duct movements over at least 60
days. It was discovered that attackers
were manipulating the chemicals used
to assure safe drinking water and also
altering the water flow rates, causing
disruptions to water distribution. Manyother activities had gone on unnoticed,
including theft of more than 2.5 million
unique data records, until Verizon’s
forensic investigation started.

Verizon’s forensic investigation foundthat three known threat actor IP
addresses had gained access multiple
times to the water district’s operations
technology (OT) and IT assets, including:a great candidate for easy hacking fromthe outside—with a potential high impact
to safety and availability. Let’s look at
each and how Belden’s cybersecurity
product suite could have helped:»» The supervisory control and data»» Weak password hygiene in theacquisition (SCADA) application, valve
and flow control applications, and the
PLC systems»» IT management systems»» Internet web server application»» Financial and customer accountinformation
KWC had no visibility or insight to the IP
addresses being used from global locations accessing their network, assets
and controllers, and manipulating theirfield I/O. They also hadn’t caught themillions of records being electronicallystolen from their site. What can belearned from the investigation into theircase?

Cybersecurity Lessons Learned
KWC had multiple foundational security
control weaknesses or exploitable vulnerabilities that Verizon said made themcustomer web application. Water
customers used an Internet payment
application to access their accounts
from laptops, desktops or mobile
devices. This application only required
weak credentials (user name andpassword—no second authentication
factor) to gain access to customers’
personally identifiable information(PII), payment data and water usage.
The first factor in the attack to
consider was that the web-facing
application server customers used
had a cross-site scripting vulnerability
the hackers could exploit. The
second factor was that the username
and password methodology forcreating user credentials was easy
to exploit. For both of these types
of weaknesses, Tripwire could havehelped.

In this case, physical harm and safety
was at risk, but luckily didn’t happen
due to alert functionality that caught
the chemical and flow control issues.
Also, it appeared that the type of outside
attackers who gained access were likely“hacktivists,” who are usually not motivated by financial gain. Indicators arethey were experimenting and shopping
their access around to others with more
knowledge of the unique environment.

What’s Wrong with This Picture?
Look at how KWC set up its network in
Fig. 2, as depicted in the Verizon 2016
Data Breach Digest. Can you tell where
they went wrong? (Here’s a hint: Notethe seven red callouts in the diagram.)

Fig. 2 KWC’s network architecture was a large factor in the success of their breach.
Legend: 1. Customer access to payment system, 2. External (Internet),
3. Internal (corporate access), 4. AS400, 5. PLC management, 6. Finance access (PII
access), 7. IT management. Credit: 2016 Verizon Data Breach Digest

-- Regardless of how rigorous or
weak any organization’s password
hygiene is, Tripwire solutions canalert on multiple login attempts
to a given asset, host or endpoint.
They can also test for password
length, password complexity andother password specific settings.
Over time, organizations canimprove credential requirements
as they educate users, andTripwire products can be adjusted
for more rigorous password
hygiene to reflect the business’
unique requirements.

-- Tripwire products can passively
monitor logs and correlate
events such as login attempts
and credentials. By monitoring
multiple types of host syslogs,
these correlations can reduce thetime it takes to see suspicious
behavior beginning to traverse the
networks and assets.

-- Tripwire has proven integrations
with many identity management
systems. The integrations can beused to create efficient workflows
with the context and details
needed when credential misuseor suspicious behaviors may
warrant an alert and follow-up.

-- With deep packet inspection
capability, Tofino’s Xenon security
appliances could have denied
attackers the ability to modify
to the programmable logic
controllers (PLCs). Tofino Xenon
can be deployed behind the switch
or router and in front of the PLC,
DCS, RTU, or IED to filter, basedon the contents within commonlyused industrial protocols such as
DNP3, Modbus/TCP, GOOSE andOPC DA. This seamlessly createssmaller, more secure network
segments. Tofino Xenon security
appliances are stealthy devices
with no IP address, making theminvisible to attackers. However,
Tripwire products can monitor
and report on configuration
settings for Tofino Xenon units,
giving operators visibility into
the units and to assure ideal

Disruption Can Be Costly, Part Two»» Oil pipeline shut down for six hours after software is
accidentally uploaded to a PLC on the plant network instead of
the test network. Net impact? $250K»» 13 auto assembly plants were shut down by a simple Internet
worm; 50,000 workers stop work for one hour while themalware is removed. Net impact? $14M»» Operators at a major US nuclear power plant forced to“scram” the reactor after cooling drive controllers crasheddue to “excessive network traffic.” Net impact? $2M
configuration state, and detect
unauthorized or inadvertent
modifications to firewall settings.

»» Direct Internet access to ICS (andbad network architecture). The
Internet-facing web server that
hosted the customer payment
application was directly connectedto the AS400 system, which in turnhoused the SCADA management
application, giving the administrator(and threat actors) direct access tointeract with the control system.
The water district’s valve and flow
control application on the AS400
was used by the three known threat
actors to manipulate the PLCs andsubsequently water chemistry.
Tripwire solutions can continuously
monitor for changes on servers,
workstations, HMIs, data historians,
databases, email servers/Active
Directory and more. In this case,
Hirschmann’s Industrial HiVision
network management software
can visualize devices it sees on the
network and could potentially havepresented a visual depiction of assets,making this poor network architecture
obvious. If modifications from an
ideal state allowed for the AS400 to
be directly connected to the Internet,
Tripwire’s products could have alerted
administrators that a change wasmade to the corresponding network
settings.

Tripwire solutions can alert on
suspicious logons, and would also
be able to monitor for unknown or
foreign IP address logon attempts
after normal business hours. Tripwire
can also track accounts, groupmembership, ports, applications andservices, DLLs and other changes that
may occur on the systems it monitors.
Hirschmann’s EAGLE20/30 industrial
firewall, if placed between the AS400
and the control system, can createa secure and protected zone to limit
access to its SCADA application.
To provide more robust protection
without requiring changes to
network architecture, Tofino security
appliances can be deployed similarly
in front of the field PLCs or DCS toinspect all incoming and outgoingtraffic and alert (and optionally deny)on any traffic that is unauthorized or
blacklisted.
Encrypting traffic is another wayof creating a secure network, as it
prevents man-in-the-middle attacks
and ensures traffic is received only
from trusted sources. Hirschmann’s
EAGLE20/30 and GarrettCom’s
Magnum 10RX, Magnum 5RX and
Magnum DX940 firewalls and routersprovide multiple types of encryption
techniques and VPN connectivity for
multiple remote sites and networks.

»» Privileged administrative user. The
lone AS400 system administrator

had no corporate oversight, and forconvenience was using the same login
credentials for remotely accessing
both the AS400 and the payment
application web server from his
laptop. Least-privilege rules would’ve
been difficult for this smaller utility
with only one system administrator.
However, there could’ve been somebetter practices in place.
Best practices for securing UNIXsystems often include restricting
remote administrative logons inseveral ways. First, by removing thecapability for the “root” user to log on
remotely. Second, by removing remotepassword authentication completely,
allowing only key exchanges forlogons. These minor changes areoften seen as inconveniences byadministrators and therefore areoften not implemented or reversed.
Tripwire’s ability to test for thesesettings could have rendered theattacker unable to log in in the firstplace.

approach by applying the concept of“zones and conduits” from international
security standard IEC 62443 as shownin Fig. 3. Many different security
features, such as network access
control, firewalling and address
spoofing detection, can be used tosignificantly harden the security
posture of the network. Industrial
HiVision can monitor the networkand display the security status of the
network devices, as well as provide
information on their software level
and configuration integrity.

»» Single Point of Failure. One AS400
served as the water district’s SCADA
Application system. The system wasold, operating system updates andpatches weren’t installed, and again,
one lone administrator was working
to make things easier—but not withsecurity in mind.

Tripwire solutions can continuously
monitor and assess systems,
configurations, hardware, softwareand firmware versions, and show
when patches are available but notapplied. Within industrial settings
it is not unusual for patching to belimited—if performed at all. The oldsaying, “If it ain’t broke, don’t fix it”
applies here. However, at least in
this case, the security of the AS400
would have benefited from being
continuously monitored by Tripwire
solutions, since its cyber risk washigh due to lack of updates andpatches.

It Can Happen to You
This is a clear example of how better
ICS and SCADA security practices could
have prevented process controls andbusiness activities from being disrupted.
For industrial firms, availability is a top»» Login credentials in cleartext
accessible from the Internet. The
login credentials and IP address
were found in clear text within
the initialization file (.ini)—an oldschool technique known as “security
through obscurity” (STO). The same
credentials worked to log into thepayment application web server. A
simpler way to say this? “Hey, here’s
how to log onto our systems—all ofthem…”
With a simple query, Tripwire products
can locate cleartext files that containadministrative credentials, PII or
payment card information. The ability
to locate and alert on improperlystored sensitive information can be
extremely valuable.

»» Harden your network infrastructure.
An automation network that isengineered with a security mindset
is a defensive asset in its own right.
Belden switches, routers and firewalls
from the Hirschmann, GarrettCom
and Tofino brands can be used tocreate a defense-in-depth network

Fig. 3 Reference architecture secured with Tripwire and Belden solutions.
Legend: TLC = Tripwire® Log Center ®, TE = Tripwire Enterprisepriority, and operations teams often see
industrial cybersecurity as unnecessary
due to their high trust environment.
It’s easy to believe “it could never
happen to us.” However, noting the weakor absent foundational ICS and SCADA
security in the Kemuri analysis should
give you pause to consider what yourenvironment holds—to some degree
similar risks are probably present.
It might be a stretch to catch plant engineers or contractors charging personal
devices on PLC or HMI USB ports, orallowing a contractor or family member
wireless access from the hidden routerin the back room, but these are just two
real-world examples among many. ICS
security best practices and awarenesstraining may be something to consider
for your own environment.

Getting Started»» Begin with a cybersecurity
assessment to discover gaps you
can then discuss and prioritizeinternally. Given how connected mostorganizations are becoming, consider
including the corporate side as well as
plant operations in the assessment.
Plus, IT may be where the budget
exists for taking this important firststep.

»» Determine what industrial security
standards and best practices
you need to work against. Most
assessments will work to identify
weaknesses and countermeasuresaccording to some type of industrial
cybersecurity standard appropriate toyour industry. For water and treatment
utilities, standards to consider are
the American Water Wastewater
Association’s Process Control
System Security Guidance for the
Water Sector, the National Instituteof Standards and Technology (NIST)
Cybersecurity Framework, and theInternational Society of Automation(ISA) Industrial Automation
and Control Systems Security/
International ElectrotechnicalCommission (IEC) 62443 standards.

You know my top concern? It’s my own guys. Well-meaning
as they may be, they cause most of my headaches. They’reconstantly tinkering with the control systems and sometimes
update the firmware with “improvements” without telling me(or anyone, really). So then when stuff goes wrong, I don’t know
why, they’re not always around and I don’t even know what toback out and replace with what. And that doesn’t even accountfor all the unexpected updates to our Windows systems that IT
surprises us with.
——Plant Manager with mixed industrial equipment environment

Summary
We will continue to see overall ICS cyberrisk increase as industrial and criticalinfrastructure becomes more interconnected and even field I/O becomesInternet-aware. With attackers andinsiders adapting and evolving their tactics, this will work to put physical assets
at even greater risk. As recent malware“CrashOverride” ( AKA Industroyer)and “Trisis” ( AKA Triton) have proven,knowledgeable industrial outsiders are
becoming increasingly sophisticatedabout how to levy disruption for thebiggest impact to our cyber-physicalassets. In the November 2017 Trisis malware attack against a Middle East utility,
researchers confirmed that attackers
used industrial protocols and safety systems to cause disruptions.
Regardless of the industry, these lessons learned should give rise to anunderstanding of how important andessential ICS security is to building
resilient organizations—that is, ones
that can suffer internal mistakes orcontractor errors and still avoid largescale outages or costs associatedwith disruption. Industrial and criticalinfrastructure organizations should
assess what’s most critical to theiroperations and profitability, leverage the most foundational basics forlayering defenses as much as theirenvironments will allow, and build
increased resiliency into their day-today operations.

To learn more about how Tripwire
can help protect your industrial
environment, visit
tripwire.com/solutions/industrial-control-systems/

Tripwire is a leading provider of security, compliance and IT operations solutions for enterprises, industrialorganizations, service providers and government agencies. Tripwire solutions are based on high-fidelity
asset visibility and deep endpoint intelligence combined with business context; together these solutions
integrate and automate security and IT operations. Tripwire’s portfolio of enterprise-class solutions
includes configuration and policy management, file integrity monitoring, vulnerability management,
log management, and reporting and analytics. Learn more at tripwire.com
The State of Security: Security News, Trends and Insights at tripwire.com/blog
Follow us on Twitter @TripwireInc » Watch us at youtube.com/TripwireInc©2018 Tripwire, Inc. Tripwire, Log Center/LogCenter, IP360 and Tripwire Axon are trademarks or registered trademarks of Tripwire, Inc.
All other product and company names are property of their respective owners. All rights reserved.

WPICSE2a1806