Write at LEAST one page (NOT A PARAGRAPH OR TWO)
Irfan Ali
SEC6084Ch7-8.pptxSCADA / ICS Risk & Audit SEC6084
Week 3
ICS 6084
Chapter 7 – Forensics Management
ICS/SCADA systems are collations of standard Windows systems or Unix-based systems, network devices, and specialized control systems (such as those based on programmable logic controllers [PLCs]). They are in effect a collection of integrated devices that incorporate the features of personal computers/servers with hardware-based control units.
There are over 1000 types.
Chapter 7 – Cont.
Components of an ICS/SCADA System
HMI – Mgmt system that allows the operator to interact.
RTU – Convert sensor signals allowing them to be digitally transmitted.
Supervisory system – process signals and send them to units.
PLC – Small integrated systems similar to a microprocessor but with size restrictions and power consumption considerations.
Networking system – backbone of traffic traveling between components in the system. May use device proprietary protocols.
Database and reporting systems – Include logging and performance and historical collation.
Chapter 7 – Cont.
All ICS/SCADA units are comprised of:
Microprocessor
Visual display
ROM – Usually contains OS and is loaded into RAM at boot.
RAM – Acting memory for programs and user data.
Main board
Measurement devices and sensors
Radio module and antenna
Battery and charging unit
Digital signal processor
Audio components (microphone and speakers)
Human input device
Chapter 7 – Cont.
SCADA Operating Systems
Microsoft Windows CE, 95, 98 (Embedded) – Numerous emulation tools.
Linux Variants – Image may be mounted in other Linux systems easily for analysis.
Chapter 7 – Cont.
Threats
Accidental antagonists.
Incidental antagonists. – They stumble upon you.
Insiders.
Competitors.
Cyber vandals.
Hackers.
Thieves.
Terrorists.
Military. – Foreign intelligence.
Organized crime.
Chapter 7 – Cont.
SCADA are often connected to Ethernet networks unintentionally – set and forget. (Shodan)
SCADA cyber events impact the physical world.
SCADA forensics differs from traditional IT forensics.
SCADA systems must remain available.
SCADA systems can be evidence poor compared to traditional IT systems.
Chapter 7 – Cont.
Forensics items of interest:
Logs – Time stamps to correlating activity.
Volatile memory – Running processes, services.
Dropper files – NIST.
Memory dumps.
Network trace files.
Chapter 7 – Cont.
Investigating
Keep detailed notes. Record time, date, other information.
Interview control engineer to learn more about the ICS prior to accessing and obtain:
Network diagram. – Ports/Protos, connections, VPNs.
Configuration details.
Change logs.
Authentication credentials.
*The configuration of ICS devices can vary dramatically across similar devices.
Chapter 7 – Cont.
Pre-Investigation Tasks
Determine scope.
Determine risk.
Define requirements.
Collect sys and net documentation.
List mandatory requirements – Legislative, compliance, regulatory.
Critical configurations – rule-sets, filter lists, settings, etc.
Detailed configuration documentation: Host name, network address, function, OS version and patch level, application settings, user accounts, integrity settings, interface details.
Detailed network diagrams.
Access policy.
Procedures and plans.
Known troubleshooting issues, FAQs.
Chapter 7 – Cont.
It is generally best to make a direct connection to a SCADA device via the console port rather than accessing it through a network connection.
If a direct connection via console port is not available then a SSH connection is preferable, if enabled.
Remember to run a tool that records all of the commands issued and the output of those commands.
Take screenshots and add notes.
Chapter 7 – Cont.
Volatile Data Collection Procedures
Do – Access via console port, record entire console session, run show commands from a script, record actual time and ICS device’s time, record volatile information.
Do not – Reboot, access device via network, run config commands, rely only on persistent information.
Chapter 7 – Cont.
Volatile information:
Provides current information about system.
Located in registry, cache, memory, registers, virtual memory, network connections, running processes, external device connections, routing tables, ARP cache, temporary file systems.
Chapter 7 – Cont.
SCADA Forensic Tools:
The standard forensic tools do not cover the majority of SCADA hardware available.
A hex dump is important to obtain.
A standard forensics tool may analyze a hex dump and be compared to the standard flashed image that should be installed.
Hex dump is also checked for known malware signatures.
Chapter 7 – Cont.
A “flasher” system is a specialist SCADA support tool designed for repairing or servicing of SCADA hardware and control systems (RTUs, PLCs).
Flashers benefit the auditor by allowing the dump of system memory.
Flashers enable the manipulation of flash memory on the system.
Chapter 7 – Cont.
SCADA Routers
Are attacked in order to: DoS, attack other systems, bypass firewalls/proxies/IDSs, sniffer on network, intercept and modify traffic.
Data to capture: ARP, routing tables, NAT information, ACL violations, interface statistics, protocol statistics, local logging.
Analyze DRAM and SRAM and NVRAM (Where configuration info resides.)
Chapter 7 – Cont.
Malicious Code and SCADA
A complete dump of all network traffic should be stored.
If there is an investigation the traffic may be analyzed.
Malicious code activity may be carved out and a timeline created.
Attackers are imaging devices, replacing entire OSs.
Shell attacks are popular.
Chapter 7 – Cont.
Intrusion Detection
NIDS and HIDS
First create a baseline of normal traffic.
Snort – de facto standard. (snort.org)
Chapter 7 – Cont.
Incident Handling
Examples: Compromise of system, denial of service, malicious use of resources, damaging systems.
Indicators: Strange process, CPU time maxed, intruder logged in, malware infection, remote connections to system ports.
Incident handling steps:
1. Protection of system.
2. Identification of problem.
3. Containment of problem.
4. Eradication of problem.
5. Recovering from the incident.
6. Follow-up analysis.
Chapter 7 – Cont.
It is important to know how long it will take staff to respond.
A secondary contact must be available.
Only authorized individuals may address the press.
Information must be logged by incident responders. May end up in court.
Types of information to log:
Dates/times of phone calls.
Dates/times of incident related events.
Time spent working on tasks.
People you contact, contact you.
Names of systems, programs, networks involved.
Chapter 7 – Cont.
Incident Handling Follow-up Analysis
A security incident report should be prepared.
Root cause analysis, corrective actions, lessons learned, historical information for knowledge base should be archived.
Chapter 7 – Cont.
Code Review
Black Box Testing
Equivalence partitioning
Boundary value analysis
All-pairs testing
Fuzzing
Model-based testing
Traceability matrix
White Box Testing
Static code testing
Mutation testing
Completeness testing
Fault injection testing
Lexical code analysis
Chapter 7 – Cont.
Testing in Combination – Best Practice
Considerations
Software quality: correctness, completeness, integrity.
Capability
Reliability
Efficiency
Portability
Maintainability
Compatibility
Usability
Chapter 7 – Cont.
UML – A tool for capturing processes and system design.
Can aid forensic analysis.
A UML diagram can simplify the forensic audit for complex ICS/SCADA networks.
Chapter 8 – Governance and Compliance
Has anyone taken the IT governance class yet?
ICS/SCADA systems fall under the purview of asset protection and security (AP&S) specialists.
Is a continuous process with dedicated resources and supports business objectives of the enterprise.
ICS/SCADA require especially effective governance and oversight due to:
Lack of proper integration with enterprise.
Distributed architecture.
Dated technology and lack of security.
Nexus to national objectives.
Chapter 8 – Cont.
Governance + Safeguards + Oversight + Continual Risk Assessment = Risk Management
A risk program protects the Availability, Integrity, and Confidentiality (AIC) of ICS/SCADA systems.
Governance provides the structural framework for the risk management program to operate effectively.
Oversight provides the processes for ensuring that the risk management program continues to work effectively, is compliant with external and internal direction, and provides useful information to senior management.
Chapter 8 – Cont.
At the technical level the SCADA security practitioner can implement appropriate technical and nontechnical safeguards within the governance framework to meet the agreed-upon residual risk.
Chapter 8 – Cont.
CISO, CSO, where did those positions come from?
Possibilities:
Cost benefit analysis showed that a c-level position is cost effective.
Gramm-Leach-Bliley Act, SOX, HIPAA identified executives individually and collectively as accountable for due diligence in AP&S.
Chapter 8 – Cont.
Drivers for governance:
Laws – Define criminal activity and set punishments.
Regulations – Obligations, constraints, restraints governments expect of industries.
Standards – Developed by regulators, professional assocs, special interest groups inline with industry best practices.
Measures – Temporary restrictions or requirements on enterprises.
Trade/industry assoc – Consensus driven of industry orgs.
Social norms – Public perception of org’s brand and expected behavior.
Chapter 8 – Cont.
Policy enforces governance and is the foundation upon which the security program is built.
Word of mouth vs. business rules.
Expresses the will of senior management.
Policy is mandatory.
Policies are only effective if they have supporting:
Standards – Senior mgmt (strategic).
Guidelines – Technical community (operational).
Procedures – Supervisors (tactical).
Chapter 8 – Cont.
Challenges to implementing a policy suite:
Policies need to be signed off on by the appropriate level of accountable management.
Chapter 8 – Cont.
Consider these scenarios:
1. A pipeline fails to detect a leak and releases a significant amount of hazardous material into an environmentally sensitive area and causes significant damage to property.
2. A nuclear reactor releases radiation in the environment, leading to people being exposed to cancerous levels of radiation.
3. A traffic system directs two vehicles in such a way that they collide.
*Are the regulatory compliance fines enough to deter this activity? (Formation of EPA.)
Chapter 8 – Cont.
The Federal or state government could require that all organizations that deliver a certain good or service be overseen by a professional association.
These associations operate in a balance between business and practitioners, academics, and analysts.
Chapter 8 – Cont.
Reducing ineffective Governance
Delegation mechanism:
Identify the specific source of authority to make the delegation.
Specific accountability of the individual being delegated.
The authority to assign resources from those assigned to him or her.
The resources necessary to accomplish the work and maintain accountability.
Any restraints or constraints that mgmt imposes on the individual.
Conditions to maintain the delegation and consequences for failing.
*SLAs, MOUs, MOAs
Chapter 8 – Cont.
Can’t have governance without oversight.
Internal/third party auditing. (MICT)
Identification and approval of audit.
Communication of requirement.
Familiarization and training.
Phased implementation.
Confirmation of accountability.
Staff assisted visits.
Reporting to functional and senior mgmt.
Adjustment of audit system for feedback.
Chapter 8 – Cont.
Oversight Activities:
Audits
Assessments
Monitoring
Modeling and simulation
Testing
Technical vulnerability assessments & penetration testing
Training and awareness
Chapter 8 – Cont.
Post Oversight
If the requirement has a negative effect on other programs then controls should be eased.
If the requirements are exceeded then awards or other positive reinforcement.
If requirements are met then compliance should be acknowledged.
If requirement is not met due to the impact on other critical systems then the requirement should change.
If requirement is not met for no legitimate reason then retrain/reeducate or graduated disciplinary action.
