Securing SCADA

Securing SCADA

Introduction to SCADA

Industrial Control Systems (ICS) and Supervisory Control And Data Acquisition (SCADA) networks control our most critical infrastructures. Power generation and distribution, industrial manufacturing, chemical refineries, oil rigs, large communication systems – any plant that relies on automation utilizes some sort of SCADA network.

SCADA networks are responsible for organizing and physically controlling the facility in which it is installed. SCADA networks can turn valves, distribute steam to turbines, and much more. From purifying waste water to nuclear power generation, SCADA networks are extremely high-profile assets – which makes them high-profile targets for any attackers.

If these networks were to be compromised, the damage could be catastrophic. Imagine the devestation that would occur if a power grid were to become unusable, or if a chemical refinery were to lose control of its facility.

Alternatively, SCADA networks contain data that is invaluable. Predictive maintenance – identifying parts in need of repair before they fail – is dependent on SCADA network data. These networks are rugged, and are built to last for 10 to 20 years or more. Protecting them is extremely important.

SCADA networks are special

Because SCADA networks are controlling physical objects, there is a large security gap.

These networks consist of some of the following pieces:

  • Remote Terminal Units (RTUs), which interpret sensor input as data and receive commands from the supervising system.
  • Programmable Logic Controller (PLC), which also interpret sensor input as data and can also receive commands from the supervising system; however, PLCs have more sophisticated systems than RTUs.
  • Telemetry systems connect PLCs and RTUs to the rest of the network through a satellite connection, a telephone line, wireless circuit, WAN circuit, or other means of
  • Human-Machine Interfaces (HMIs) control the SCADA networks as a whole. Operators control SCADA networks through an HMI.

SCADA networks are built for  longevity, which means many networks are forced  to interface with otherwise out-of-date operating systems acting as an HMI. These  obsolete operating systems may have their own sets of vulnerabilities, requiring special handling and protection. And because SCADA networks interface with real-world components, you have to consider not just cyber attacks but physical attacks as well. All of these issues mean that SCADA networks are hard to  secure.

Notable SCADA attacks

Networks are prone to attacks, and SCADA networks are no stranger to malicious activity. The most famous SCADA attack is Stuxnet, which damaged a uranium enrichment facility in Iran. The facility was considered extremely secure – the network was not even connected to the Internet – but an infected USB stick compromised the network. The Stuxnet worm targeted PLCs that controlled uranium enrichment centrifuges. It destroyed a large number of centrifuges before it was caught, and was extremely advanced.

Another notable attack happened in Australia, where a disgruntled man sabotaged a sewage treatment plant in Queensland, Australia. The man took control of the pumping system and caused thousands of gallons of untreated waste to spill into parks and waterways.

A German power utility was taken offline for five days by attackers before finally coming back online. The utility serviced more than 18 million people.

How to prevent attacks

SCADA networks have to be built around keeping unwanted network traffic out. A layered defense is the best solution to keeping these networks safe.

The first level is physical security. The Stuxnet attack would not have been able to attack had proper device security protocols been implemented. Restricting physical access to critical facilities is extremely important. Some extremely secure SCADA networks have reduced their threat surface to one physical cable between other networks and the SCADA infrastructure – if there is a suspected threat, the cable is cut and the network is isolated immediately.

The second level is perimeter security. Having strict firewall access rules and real-time reporting is essential. If there are open ports reporting suspicious activity, you have to know about it. Using Demilitarized Zones (DMZs) to provide network segmentation is important as well. Vigilant perimeter security can keep out many different threats.

Once the perimeter is secure, focus on analyzing internal network traffic. Utilizing application whitelists for legacy operating systems and implementing stringent user account management can further reduce a SCADA network’s threat surface.

Next-generation SCADA security solutions inspect all network traffic, block known threats, and are protected from zero-day threats by downloading threat prevention techniques from the cloud. These solutions extend to all endpoints and can provide real-time network threat information.

Future of SCADA networks

As Information Technology and Operational Technology converge, SCADA networks will continue to rise in importance. Manufacturing is already reaping the benefits of interconnected factories that drive costs down and yields up. Traffic grids can analyze and deploy new, more efficient congestion reduction solutions. Chemical plants can ensure operator health with new and exciting safety solutions.

The future depends on SCADA – and SCADA depends on security. Consider implementing a next-generation SCADA security solution today.

Kevin Kaufman | Principal Consultant