Post on 10-Aug-2020
transcript
ww
w.inl.gov
Evolution of cyber threat to Nuclear Systems
Robert Hoffman
NHS Consultant,
INL
Mission Support Center: Forward Looking Threat Analysis
2
Threat analysis for prevention, detection, resilience & proactive
response for “all-hazards” to cyber-physical control systems.
• Threat Analysis for Actionable Strategic Intelligence
– Not just the latest tactical incident
– Term, Trend, Threat Actor Analysis
– Characterize Risk for investment decisions & responses
– Identify future Gaps & solutions for defense of key assets
• Teams of Subject Matter Experts: Analyst, Cyber, Sector
– Technical Analysis of Intelligence
– Cyber on Control Systems
– Electric power, nuclear processes
– Wireless communication, network engineers
– Human factors, systems of systems approach
• Cooperative Government Program Relationships
– Multiple Vulnerability Assessment Programs
– DOE: Mitigation R&D, Industry threat outreach
– DHS: ICS-CERT ops center, incident response teams
– International partners & programs
• Extend INL’s Industry Experience & Infrastructure Leadership
– Asset Owners & Operators
– Equipment Vendors
– Integrators & Security Providers
• The state of cyber in a nuclear security world
• Introduce key factors influencing that world and driving fundamental change.
• Friction being created as the nuclear security and cyber security worlds collide.
• FACTORS: Attack escalation with increased capability, Inter-connectedness/efficiency, Asymmetry (nature of war), rate of technology change/adoption, etc..
• Impact of cyber on risk models, PRA and Global DBT.
Cyber Threat Evolution
Unique Nuclear Considerations
• Materials Protection & Accountability
– theft
• Fuel Processing Facilities
– sabotage
• Nuclear Power Plants
– release
• Supporting Infrastructure
– loss of critical services
4
Physical Cyber Interdependency:
• Access Control Systems
• Non Safety Systems
• Physical Security
• Transportation
• Waste Processing
• HVAC
• Fire Protection
• Materials monitoring
• Emergency Response
• Power subsystems
• Safeguards
• INL cyber / nuclear experts provide technical assistance focused on the development of implementation strategies for IAEA NSS 13, Nuclear Security Recommendations on Physical Protection of Nuclear Material and Nuclear Facilities, (INFCIRC/225/Revision 5)
– Japan, South Korea have been centered on test bed and training development and the incorporation of Industrial Control System (ICS) security considerations.
– IPPAS mission cyber module updates and performance in Finland, Romania and South Korea.
– Provided cyber nuclear component to US – Japan bi-lateral security assessment as part of Material Protection Control and Accounting (MPC&A)
“Computer based systems used for physical protection, nuclear safety, and nuclear accountancy and control should be protected against compromise (e.g. cyber attack,
manipulation or falsification) consistent with the threat assessment or design basis threat.”
INFCIRC rev.5 Cyber Integration
IAEA INFCIRC 225.rev 5 has global impacts on cyber nuclear
security - every country is striving to find a viable path forward.
Challenges: Myths in “Air Gapped” Systems
• Corporate Net connected to ICS (firewall)
• Remote access by engineering stations or support vendors
• Field devices comm ports with little or no authentication
• Required Calibration: laptops & handhelds
• Wireless communications instead of cable
• Removable media: upgrades & backups
– Flash drives
– CD’s
– External hard drives
– “a periodic net connection”
• Unified Buses: Common buses for Control & Safety Systems
6
Data Acquisition
ServerDatabase
Server
Configuration
Server
Engineering
Workstations
HMI
Primary
Historian
Remote Net Router
• Operations
• Engineering
• Business Partners
• Vendor Support
Control System
Modem Pool
Field Devices
Safety System
Field Controllers
Control System Network
HMI
Industrial
Wireless
Challenges: Information Technology vs.Industrial Control Systems (ICS)
Topic IT ICS
Design PhilosophyInformation Protection,
Rapid change in function
Functional Reliability,
Designed on
Electromech Fault Basis
Uptime Regular maintenance
down timesNearly 100%
Change & Patch
ManagementRegular and scheduled
Formal Testing and
Strategic scheduling
Incident Response &
Forensics
Well defined and
deployed
Uncommon, no forensics
beyond event re-creation
Technology Support
Lifetime2 to 3 years 10 to 20 years
7
Aggressor perspective
Topic ICS Opportunity
Design PhilosophyFunctional Reliability,
Electromech Fault BasisPreplanned manipulation
of 1 – n devices
UptimeNearly 100%
Supports interaction during
“off normal hours”
Change & Patch
Management
Testing and Strategic
schedulingMinimizes impact to
malware execution
Incident Response &
Forensics
Uncommon, no forensics
beyond event re-creation
Abnormal behavior creates
engineering investigation,
not cyber forensics
Technology Support
Lifetime10 to 20 years
High ROI and malware
sustainability for target
environment
8
ICS centric Vulnerability
Discovery has become not
only mainstream but “coin
of the realm” for a subset
of the global security
community… The
response requires a
coordinated effort,
prioritization and
dedicated resources.
The industry of today is
operating upon the
battlefield of tomorrow…
Critical Infrastructure Cyber Threats
Smallest LargestCONSEQUENCES
Less
Very
LIK
ELIH
OO
D Directed
Corruption
Sophisticated
Injection
Poison Data
Compromise Process
Disruption
Concentrated
DDOS
Probe
DOS
Worm
System Compromise
System Control
General Cyber Attacks - Less Structured
• Notoriety and Fame
“Just to Do It”• Hacking Economy
Directed Cyber Attacks – Structured Hackers
• Direct & Targeted Monetary Gain
• Extreme Activist / Groups
• Disgruntled Employee
Strategic Information Warfare
• Major Economic Gain
• Cyber Terrorism
• Asymmetric Warfare
GRP III
• Nation States
• Terrorist
• Autonomous
Collectives
GRP II
• Organized Crime
• Competitors
• Hackers for HireGRP I
• Mainstream
• GRP II & III
Low & slow
Persistent Presence
Cyber Activists
10
Evolving Nature of Cyber Threat
• Lack of institutional constraints: “As with other Anonymous posts, it is hard to verify if the attackers are part of the hacking collective and whether they are responsible for the attack on the Vatican site. Anonymous is a decentralized, loosely organized collection of hactivists with no real leadership. In the past, hackers have claimed actions on behalf of Anonymous only to have others within the collective deny those actions.”
Is the
guard at
your gate
working
for you?
Security Solutions?
Security firm finds SCADA software flaws; won't report them to vendorsReVuln will sell vulnerability information to private buyers as part of a commercial service, the company says
IDG News service – November 2012
• Malta-based security start-up firm ReVulnclaims to be sitting on a stockpile of vulnerabilities in industrial control software, but prefers to sell the information to governments and other paying customers instead of disclosing it to the affected software vendors.
• In a video released Monday, ReVulnshowcased nine "zero-day" vulnerabilities which, according to the company, affect SCADA (supervisory control and data acquisition) software from General Electric, Schneider Electric, Kaskad, Rockwell Automation, Eaton and Siemens. ReVulndeclined to disclose the name of the affected software products.
The attackers "can take control of the machine with the maximum
privileges (SYSTEM on Windows) granted by the
affected service," ReVuln co-founder and security
researcher Luigi Auriemma said Monday via email. "They
can install rootkits and other types of malware or obtain
sensitive data (like passwords used on other computers of
the same network) and obviously they can control the
whole infrastructure."
Cyber-Physical Challenges in Nuclear Facilities
14
Framework for Consequence/ Threat-Driven Design
Blended Local Attack (digital &
material sabotage)
Directed remote attack with witting
insider & supply chain (Nations/groups)
Directed remote attack with unwitting insider (Nations/groups)
Remote directed attack (APT)
Cybersecurity defenses versus unstructured/non-directed cyber threats (crime, Botnets, etc.)
Type of ThreatConsequence Scale Protection Scale
Plant Process
Safety
Radiologic
Safety
Radiologic
Worst Case
Data Theft
Disrupt
Operations
Disrupt
Cyber
Commercial
Risk
People
Risk
Prevention
Signature
Security
Solutions
Detect
Manage
Recover
Redundant
Systems
Engineering
Two person
Rule
Engineering
Full
Spectrum
Defense
Applies to very small
group (.01%) of
assets
Applies to small
group of assets
(CDAs)
Current Process to Manage Safety Risk
Design Basis:
Perform specific
control functions to
failsafe or maintain
the safe operations
16
Problem: For an adversary specifically “targeting” your facility, with modern
digital I&C you will be operating in “contested waters” in all layers (you
are/will be “owned”)
Questions / Comments