August 2011
By Bill Lydon
His background is an important qualifier that lets you know what I already know - Eric Byres is a knowledgeable professional committed to the cause of industrial automation and SCADA cyber security. This is serious business.
Eric’s Comments: It is painful, but necessary. The bad news is that bad people who might not have heard of SCADA or process control systems before now have been made aware of them. They also have a step-by-step recipe for attacking these systems. However, the good news is that the Stuxnet media coverage has woken up many end users and suppliers to the need for SCADA/ICS security. That had to occur at some point and at least no lives were lost in this wakeup call.
Contrast this to the terrible incidents like Bhopal that drove the industry to take safety more seriously - so far we have avoided any incident that tragic and I hope we continue to do so.
Eric’s Comments: There are many misconceptions, but the one that is really serious is the belief that Stuxnet was all about USB keys and if you ban the use of USB keys on your plant floor, you have solved the security problem. Stuxnet’s designers gave the worm eight different spreading mechanisms and the USB key was only one. Even without this vector, a sophisticated worm like Stuxnet will just pick a different path.
Eric’s Comments: In many ways, and that is a key lesson the industry needs to take from Stuxnet. Stuxnet doesn’t just walk through the corporate firewall and suddenly it has infected its target PLC. Instead it spreads via secondary pathways that are never considered in most security designs – subtle pathways like infected PLC project files, USB keys, and maintenance laptops. And when it does find a firewall in its way, it rides on protocols that are typically allowed through a control system firewall, so that it doesn’t set off any alarms.
Eric’s Comments: Malware writers and hackers never create anything in isolation – each new worm or attack tool takes advantage of previous techniques and vulnerabilities. For example, within days of the world learning about Stuxnet’s USB Key tricks, (technically it used a .LNK file vulnerability), other worms like Sality started exploiting the same vulnerability.
Now the scary thing about Stuxnet is that it introduced so many advanced attack and malware techniques to the black hat world – basically it gave the technology of malware design a major leap forward. Perhaps more serious, it showed exactly how to build and then use weaponized software against critical control systems. So unless every bad guy in the world has some sort of miraculous memory lapse regarding Stuxnet, we are certain to see the Stuxnet techniques being reused in future worms. These worms will be directed at different targets, take advantage of different control products and be driven by different political or financial motivations. But regardless, they will borrow something from the Stuxnet legacy.
Eric’s Comments: Of course, most control systems are never DIRECTLY connected to the Internet, but they all connect to other systems that eventually do connect to the Internet. Typically these connections are to the enterprise business systems (such as MRP inventory management, etc.), but they can also be connections for maintenance support from vendors and consultants, or regulatory connections to agencies like the EPA. Mr. Sean McGurk, the Director of National Cybersecurity and Communications Integration Center (NCCIC) at the Department of Homeland Security put it best:
But let’s assume that a company really has somehow severed all network connections to and from the plant floor. They are still at risk because, as much as we want to pretend otherwise, modern control systems need a steady diet of electronic information from the outside world. For example, PDF-based user manuals from vendors, updated PLC logic from consultants, patches for the computer operating systems, anti-virus signatures, remote support connections – you can’t ignore them all. Severing the network connection simply spawns new pathways – pathways like the CD, the mobile laptop and the USB key, which are more difficult to manage and just as easy to infect.
Eric’s Comments: Absolutely. As I noted earlier, Stuxnet got past the firewalls by either using secondary “sneakernet” pathways like USB keys and CDs, or it rode on top of the protocols that the firewalls were configured to let through. Even though my company sells firewalls, I will be the first to say they are part of the solution, not the whole solution. You need to create an architecture that both defends the overall control system from external attacks, and hardens each individual system and device from harm, in case something malicious does get in (such as a worm like Stuxnet or a disgruntled employee).
Stuxnet has clearly been a wakeup call for the industry and companies need to have cyber security plans if they want to protect their operations.
Cyber security is a complex issue and in the next part of this interview with Eric Byres, we will discuss actions automation people can take to protect operations.
