Cyber Security Assessment of Mission Critical SCADA Systems

March 19, 2012 (at 10 a.m.)

In this workshop we will explore key aspects involved in the assessment of the security posture of SCADA systems that are used to operate machines, such as the electric grid, that are designed for continuous operation. No prior knowledge of such critical infrastructure is required and the introduction to this class of system could well be eye opening to seasoned penetration testers. Traditional approaches to Assessments will be presented with the balance of the workshop providing an introduction to security processes developed by Edmond Rogers and Sergey Bratus in their experiences penetration testing critical infrastructure. There will be discussions on the use of well-known tools and considerations that should be made before using such tools on SCADA networks. To end the workshop, there will be a discussion of mitigation used for SCADA control networks.

Outline

Introductions and Overview of Scada Systems (1 Hour)

• Intros
• Overview of SCADA systems
• Components of SCADA systems
• Cyber Systems used in the Electric Grid
• Conclusions (Questions)

Performing Best Practice Assessments of Critical Systems (2 hours)

• [Discussion of white paper, co-wrote with Ray Parks from Sandia National Labs] – (http://energy.gov/sites/prod/files/oeprod/DocumentsandMedia/26-CIP_CyberAssessmentGuide.pdf)
• Overview of compliance best practices
• How best practice and requirements of SCADA systems clash
• Burdens due to legacy systems
• Challenges of how to comply with best practices

Presentation of Vulnerability Assessment Methodology as linked above

Discussion of Tools used to perform testing. (1 hour)

Recon Tools * Wireshark * Nmap * Kismet * NetAPT * Zigbee Tools (Sergey’s toolkit)

Active Probing * Man in the middle (Arp Poisioning): Ettercap & Arp-sk * Scapy * NfQueue * Metasploit * Fuzzers

Lunch break

Differences between penetration testing and vulnerability assessment (1 Hour)

Using traditional tools in a mission critical network * Using test networks * Scanning Representative systems * Engaging Operations

Field testing man in the middle against live SCADA protocols (Sergey) * ICCP * Others

Fuzzing protocols Q and A.

Examples from previous engagements (Closed Session, 1hour)

Mitigations for SCADA systems (1 Hour)

Use of IPSec * Advantages of IPSec * Disadvantages of IPSec * IPSec redefines the attack surface * How to address devices that do not support IPsec

DMZ Setups * Only allow traffic outbound to DMZ * Connections should not be allowed to initiate outside the protected network

Use of Traditional Methods (And their value) * IDS and IPS * Anti-virus * Host based software

Denouement (1 hour)

• Conclusions
• Follow-ups
• Q and A.

Beer and Whiskey

Sergey Bratus

Edmond Rogers