The SCISSOR approach to establishing situational awareness in Industrial Control Systems

Stefano Salsano – University of Rome “Tor Vergata”/CNITChristof Brandauer – Salzburg Research

Symposium on Innovative Smart Grid Cybersecurity SolutionsVienna, 13th and 14th March, 2017

The SCISSOR Project

Security In trusted SCADA and smart-grids

Assystem Engineering and operation services (FR)

AGH University of Science and Technology of Krakow (PL)

UPMC university Pierre and Marie Curie (FR)

SixSq Sàrl (CH)

Consorzio Nazionale Interuniversitario per le Telecomunicazioni (IT)

RADIO6ENSE (IT)

Salzburg Research Forschungsgesellschaft mbH (AT)

Katholieke Universiteit Leuven (BE)

SEA Società Elettrica di Favignana S.p.a. (IT)

3

SCISSOR in a nutshell

A highly scalable ICS/SCADA security monitoring framework

• Integration of a wide range of heterogeneous sensors

• A dynamically adaptable, distributed data aggregation framework

• Advanced detection and correlation models as extensions to a conventional SIEM

• Exploitation of modern cloud-computing concepts

4

Architecture

55

The Favignana Test-bed

6

Installation in FavignanaInside the Cabin

7

Installation in FavignanaInside the Cabin

88

Smart Camera

4G Router

Public IP

VPNGateway

RFIDAntennas VPN

Client

RFIDReader

Network TAP

SEAHiperLAN

CabinSwitch

SCADAdevice

SCISSOR testbed

RFIDSensors

SEA SCADASupervisory

EnhancedSIEM

Threat detectionmodules

Cloud in a boxVPNClient

Decision & Analysis Layer

AssystemSCADA

Supervisory

AssystemSCADAPLCs

Datacenter Cloud

99

SCISSOR testbed

kafka

flume

SIEM

HMI

Bayesian networks

Robust statisticzookeeper

logstash

Paris SCADALab Environment

Favignana Smart Grid

CamerasEnvironment

sensorsNetworkmonitoring

SCADADevelopers’console

10

Situational awareness is established in a scalable manner in near real-timeby correlating events coming from very heterogeneous sensors

Situational awareness

1111

Authorized access

1. Door open: somebody inside

2. Badge detection: the system recognizes the technician

3. The technician turns on the light

4. The technician opens a cabinet

5. The technician get close the exit door and turns-off the light; the system records the exit

1212

Un-authorized access and tampering

1. Open door: somebody inside

2. No badge detection: the person is not authorized and may be classified as intruder

3. The intruder turns on the light for a short time: maybe uses a torch

4. The intruder opens a cabinet

5. The temperature inside the cabinet increases: possible manumission

6. The intruder opens the door and exits.

13

Events can be correlated in the SIEM correlation engine(Decision and analysis layer)

Situational awareness

Events can be “pre-processed” and aggregated to achieve scalability (local correlation in the Control and coordination layer)

14

Thank you. Questions?

ContactsStefano SalsanoUniversity of Rome Tor Vergata / CNITstefano.salsano@uniroma2.it

Christof Brandauer Salzburg Research, Austriachristof.brandauer@salzburgresearch.at

This presentation on slidesharehttps://www.slideshare.net/stefanosalsano/the-scissor-approach-to-establishing-situational-awareness-in-industrial-control-systems

15

The SCISSOR project has received funding from the European Union’s Horizon 2020 research and innovation programme under grant agreement No. 644425 (Research and

Innovation Action).

The information given is the author’s view and does not necessarily represent the view of the European Commission (EC). No liability is accepted for any use that may be

made of the information contained.

Additional information

17

SCISSOR partners details (1/3)PRESENTATION OF THE SCISSOR PARTNERS

Partner name & country Partner Type Key roles and technical skills in the project

Assystem AEOS, France Large company - Project coordination- Data protection- Id based cryptography- Identity management & AC - SCADA systems- Human-Machine Interface- Test platform.

AGH University of Science and Technology of Krakow, Poland

Academy - Video surveillance & pattern recognition - Security and cryptography - Agent-based SCADA & system monitoring

UPMC University Pierre and Marie Curie, France

Academy - SIEM design- Decision and probability theory(Dynamic Bayesian Networks)- Graphical models- Scalable big data analytics

18

Partner name & country Partner Type Key roles and technical skills in the project

SixSq Sàrl, Swiss SME - Software integration and testing expertise - Cloud expertise and technologies - Automated cloud deployment - Systems architecture and design

Consorzio Nazionale Interuniversitario per le Telecomunicazioni (CNIT), Italy

Research center - Technical Project coordination - Overall system architecture - Traffic Monitoring and stream analytics - Platform-independent API for monitoring - Attribute-based encryption - Smart grid engineering - HMI usability design and assessment

Radio6ense, Italy SME - Pervasive sensor tags - Sensor data gathering and filtering - Mobile data acquisition devices

PRESENTATION OF THE SCISSOR PARTNERS

SCISSOR partners details (2/3)

19

PRESENTATION OF THE SCISSOR PARTNERS

Partner name & country Partner Type Key roles and technical skills in the project

Salzburg Research Forschungsgesellschaft mbH, Austria

Research center - Control framework - Monitoring agents design - Semantic modelling of events - Security policies

Katholieke Universiteit Leuven, Belgium

Academy - Detection of abnormal values in multivariate, high-dimensional, data sets - Robust dimensionality reduction

Società Elettrica Favignana, Italy

Power plant and smart grid provider

- Requirements - Integration with the existing SCADA - Roll out of the real world trial

SCISSOR partners details (3/3)

20

Wireless passive Sensor Network (PSN) for Environment MonitoringMONITORING LAYER

Water/Humidity+ RSSI

temperature

light

NUVLA Box

RFIDreader

LAN Cable

ElectricalEquipment

stac

kAntenna 1 Antenna 2

Events• Authorized and un-

authorized access

• Equipment overload

• Flooding and Fire

• Human Interaction with devices

• Device Tampering

camera

21

radioBOARD: LayoutMONITORING LAYER: ENVIRONMENT SENSORS

The board may be configured for different applications and placements by connecting or disconnecting electrical traces

67m

m

28mm

Electromagnetic Coupler with tuning elements

Expander: external sensors + optionalBattery/solar cell

Energy Harvester with tuning elements

2222

Access

Flooding Humidity and light

Temperature (Harness overload)

ManumissionEvents & Sensors

TEST BED: ENVIRONMENT SENSORS

23

Device Placementsreader and antennas

TEST BED: ENVIRONMENT SENSORS

reader

antenna

24

Device Placementsaccess and light

Light sensor

Door-open sensor

TEST BED: ENVIRONMENT SENSORS

25

Device Placementtemperature

Transformer overload(PT-1000)

Cabinet temperature

TEST BED: ENVIRONMENT SENSORS

26

Device Placementmanual tampering

TEST BED: ENVIRONMENT SENSORS

27

SCADA logs

Demo steps

DEMO - INTEGRATION

• Logs were collected from a simulated electrical network SCADA system

• these logs are sent by beats to the Edge Agent • classical log parser• transformation and publishing to SMI

@datasource:[/opt/zmq-bash-push]: ./play_scada.sh &

28

Environmental sensors

Demo steps

DEMO - INTEGRATION

• sensor data was measured by the Radio6ense prototype installed in Favignana

• sent to the Edge Agent via ZeroMQ• parsing of native sensor output• transformation and publishing to SMI

• dynamic reconfiguration of the Edge Agent filtering• drop / forward RSSI data

@datasource:[/opt/zmq-bash-push]: ./play_envfile.sh &

29

Network monitoring

Demo steps

DEMO - INTEGRATION

• live integration of a distributed streamon instance• streamon probe is configured to detect Modbus device scans• replay of such a previously recorded device scan

• detection by streamon probe, emission of alerts towards to Edge Agent via ZeroMQ

• parsing of the native streamon output• transformation and publishing to SMI

@streamon:[/home/vagrant/Streamon]: ./start.sh config/modbus_device_scan.xml@streamon:[/home/vagrant/Streamon]: tcpreplay -i eth1 config/traces/device_scan.pcap

1456245861397357097 00000001 E1 LOW "Modbus Device Scanning Suspected" ip_src=127.0.0.30 ip_dst=127.0.0.5 rate=2.147463 dst_port=5021456245866421830452 00000001 E2 HIGH "Modbus Device Scanning Detected" ip_src=127.0.0.30 ip_dst=127.0.0.15 rate=3.121049 dst_port=5021456245866421874608 00000001 E2 HIGH "Modbus Device Scanning Detected" ip_src=127.0.0.30 ip_dst=127.0.0.12 rate=3.526514 dst_port=5021456245866432175844 00000001 E2 HIGH "Modbus Device Scanning Detected" ip_src=127.0.0.30 ip_dst=127.0.0.17 rate=3.931980 dst_port=502

30

Smart camera

Demo steps

DEMO - INTEGRATION

• Events were produced by a Smart Camera• analysis of a video presented in the morning session

• these events are sent to the Edge Agent via ZeroMQ• original timing is preserved

• parsing of the native sensor output • transformation and publishing to SMI

@datasource:[/opt/zmq-bash-push]: ./play_camfile.sh &

31

SCISSOR's SIEM : PreludeSIEM Design & Development

Routers

Switches

Mail Servers

OSServers

Snort IDS

Firewalls

Prelude-LML

Prelude-ManagerPrelude-Correlator

Databases

AdministrationConsole

Apache + Prewikka

IDMEFAlerts

IDMEFAlerts

IDMEFAlerts

Logs

Logs

Logs

Logs

Logs

HTTPS

Other IDS

IDMEFAlerts

TLS

TLS

TLSTLS

32

SCADA platform in the Assystem testbed

A Use Case for SCISSOR validation

ASSYSTEM ADVANCED SCADA PLATFORM

A virtualized processComplex scenarios handling

Direct occurrences of process eventsSystemic approach

A generic SCADA based systemPLC based control

Use of industrial protocolsTypical SCADA HMI

Logs generation: process monitoring, supervision/PLC software, operating systems

HistorianReporting

Report

33

Distributed Cloud PlatformCLOUD PLATFORM AND INTEGRATION

Seamless integration of a traditional Datacenter Cloud platform and a “Cloud-in-a-box” platform