Date post: | 31-Dec-2015 |
Category: |
Documents |
Upload: | meredith-pugh |
View: | 26 times |
Download: | 0 times |
Contents:
• Background, attack trees • Background, metrology and calibration• The basic ideas of the thesis work• Performing the task – a case study• Some results• Conclusion
Author
• Background in metrology and calibration• Electronics Engineer• Worked at Justervesenet from 1994 • Part time student at GUC from 2002
Background, Attack Trees
Open door
Dismantle door
Burst door open
Open lock
Open locked door
Destroy lock
Open lock with a key
Get hold of a key
Pick lock
Open lock without key
Get someone with a key
to open
Find a key
Steal key
Know which door the key belongs to
and
Bribe Threaten Dupe
Find a person with a
key
Convince someone to open
and
Get a key to open
lock
• Introduced by Bruce Scheiner in 1999• Semi-formal method• Root – main goal, sub-goals and Boolean
calculation possible attacks• Could include attributes, indicating cost, skills
etc.• Used to find vulnerabilities, analyze security
threats• Not very well known, or much used as
methodology
Background, Metrology and CalibrationMetrology (BIPM) – “The science of measurement”
Calibration (International Vocabulary of Basic and
General Terms in Metrology) –
“set of operations that establish, under specified conditions, the relationship between values of quantities indicated by a measuring instrument or measuring system..”
Background, Traditional Calibration
JustervesenetCustomer
High-precision devices
UUT
UUT
Calibration location
T1, P1, H1
T2, P2, H2
• Long downtime for unit under test (UUT) (~weeks)
• Less control with the transport uncertainty introduced in the calibration result
• The UUT is calibrated in an environment different from it’s normal working conditions
• The customer is not part of the calibration process
JustervesenetCustomer
Transfer standardUUT
Transfer standard
Calibration location
T1, P1, H1
T2, P2, H2
wwwwww
• Justervesenet investigates effects of transport and environmental conditions for the transfer standard and has more control
• The UUT is calibrated in it’s normal working environment
• Short downtime for the UUT (~hours) • The customer is part of the calibration
process
Background, Internet-Enabled Calibration
iMet, a System for the Future
Justervesenet
Transport standard
Server
Firewall
wwwwww
Firewall
Firewall
Customer
Measurement softwareMeasurement data
Measurement softwareMeasurement data
DUT
• Firewall-friendly, bidirectional HTTPS channel
• Updated measurement procedures and instrument drivers in database server
• Measurement procedures automatically downloaded to customer, compiled and run
• Measurement data returned • Security?
The Basic Goals of the Project
• Investigation of the attack tree method, evaluate usability of this
• Security analysis of the iMet system, a case study
A Case Study
The case study was performed in a process of several steps:
• Identification of critical assets• Attack trees vulnerabilities• Threats• Risk level• Countermeasures
Identifying Critical Assets
• Metrology specific:– Correct measurement results– Instruments in setup
• System application– IT systems– Application components, SW and HW
Implementing Attack Tree Method
• High level analysis, attacks on critical asset:– Correct measurement results
Incorrect values from
data collections
Manipulated data-
collection at
customer
Faulty cal. result
in DB
Faulty data transfer from cal.
result DB to cal.cert.
Faulty data transfer between
customer / JV
Error in calculation
s
Incorrect calibration values in
calibration certificate
Incorrect
calibra-tion
results
Incorrect calculation
routine
Bug in calcu-lation
routine
Incorrect calibrator standard
data
Error in data input
to calculation
s
Wrong version of calculation routine
Wrong version
of program
Manipulated
calibration results
Error in data
collection
Pretend to be custom
er
Use Instr. with
incorrect ID
Simulate instrument setup
at customer
Manipulate cal
values before
they are returned
Perform as
customer
Steal cal.
standard in
transport
and
Wrong version
of program
Wrong version
of progra
m
Wrong version
of program
Change ID in
Instru-ment
Faulty data-
collection at
customer
Error in data-
collection at
customer
Selection based on critical asset
Incorrect values from
data collections
Manipulated data-
collection at
customer
Faulty cal. result
in DB
Faulty data transfer from cal.
result DB to cal.cert.
Faulty data transfer between
customer / JV
Error in calculation
s
Incorrect calibration values in
calibration certificate
Incorrect
calibra-tion
results
Incorrect calculation
routine
Bug in calcu-lation
routine
Incorrect calibrator standard
data
Error in data input
to calculation
s
Wrong version of calculation routine
Manipulated
calibration results
Error in data
collection
Pretend to be custom
er
Use Instr. with
incorrect ID
Simulate instrument setup
at customer
Manipulate cal
values before
they are returned
Perform as
customer
Steal cal.
standard in
transport
and
Wrong version
of program
Wrong version
of program
Wrong version
of progra
m
Wrong version
of program
Change ID in
Instru-ment
Faulty data-
collection at
customer
Error in data-
collection at
customer
Wrong version
of program
Wrong version
of program
Wrong version
of progra
m
Wrong version
of program
Selection of goal for refinement
Attack Trees
• Refinement and ‘digging’ into the critical or interesting parts of the trees:– Goal: Wrong version of program
Obsolete version used
Obsolete version used at
customer
Obsolete
version available in DB
Obsolete version loaded
from DB
Manipulated
during upload/ downloa
d
Manipulated version
used
Wrong version of program
Access to
source code
Manipulate
program in DB
Author-ized
access
Required skills
to perform change
Manipulated program
at customer
Unauthor-ized access
Acc-ess to
DB
Author-ized
access
Unauthor-ized access
Lack of or
insuff. routine
for deleting and/or removin
g obsolete version
Obsolete
version possible to load
at custome
r
Obsolete
version availabl
e at custome
r
No/faulty
version control
andand
Requir-ed
skills to
perform
change
and
and
No/faulty
version control
Obsolete
version in DB
Sign code with valid
key
Valid, manipulated version in
DB
and Man-in-the-
middle attack
Access to valid
key
Author-ized
access
Unauthor-ized access
Selected goal for refinement
Obsolete version
used
Obsolete version used at customer
Obsolete version
available in DB
Obsolete version loaded
from DB
Manipulated during upload/
download
Manipulate program in
DB
Author-ized
access
Unauthor-ized
access
Acc-ess to
DB
Lack of or insuff. routine
for deleting and/or
removing obsolete version
Obsolete version possible
to load at customer
Obsolete version
available at
customer
No/faulty version control
and an
d
Requir-ed skills
to perform change
and
No/faulty version control
Obsolete version in DB
Sign code with valid
key
Valid, manipulated version in DB
and
Man-in-the-
middle attack
Access to valid
key
Author-ized
access
Unauthor-ized
access
Manipulated version
used
Wrong version of program
Access to
source code
Required skills to perform change
Manipulated program
at customer
Author-ized
access
Unauthor-ized access
and
Selection of branch/goal for example
• Program could be manipulated and used at customer’s– A skilled customer could manipulate the
downloaded source code, and e.g. simulate measurements
– Source code is signed in database, and this signature is checked at download. But customer could run another version, and integrity of the returned measurement data is thereby not secured by this signature.
Identifying Vulnerabilities, an Example
• Customer could want to simulate or manipulate measurements or instrument ID– Save time (instrument should be used in
production most of the time)– Fabricate good results
Threats to the System, Example
• “Program could be manipulated and used at customer”– High criticality (integrity of measurement data)– Low/medium threat (we know our customers..)
• Risk level MEDIUM
Assessment of Risk Level, Example
• Technical: Implement code obfuscator– Make the code harder to understand, and thereby
manipulate
• Administrative: Signing of contract between customer and authority – Define responsibilities, judicial liability
• For the future: Build authentication and signing mechanisms into the instruments– Secure integrity of measurement data
Countermeasures, Example
Some Results: Usability of Method
• (Semi-)Formalized method: – A guide through analysis
• Flexibility– Depth of analysis, maturity of system,
interpretation of the trees
• Presentation of results from analysis– Should adapt to recipients
Some Results: The iMet System
• We have identified 14 vulnerabilities• We have suggested mitigation strategies
for these, based on risk assessment. Most of them easily achievable