6 ms·
Why not simply stop networking these systems together and/or connecting them to the internet?
by e2le 7y ago
Why not simply stop networking these systems together and/or connecting them to the internet?
- colechristensen 7y agoIt doesn't stop attacks. Stuxnet successfully attacked air gapped systems.
- the-pigeon 7y agoStill makes them exponentially harder since you need to get someone to connect an infected device to the internal network somehow.
- simonh 7y agoIt does stop attacks. It just doesn’t stop all attacks. Just because a security measure, by itself, isn’t perfect doesn’t mean it isn’t worth implementing.
- DEADBEEFC0FFEE 7y agoArguably that was a failure of physical or personnel controls. Someone was able to take media in. A physical device was allowed to be connected.
- beenBoutIT 7y agoIIRC, stuxnet successfully targeted and exploited weak humans. The air gap didn't fail, an idiot worker with a USB drive was the vector.
- antpls 7y agoMaybe there are still benefits to have a network, but not using internet. Couldn't we build a network with a subset of internet features but which are all formally proved, and let humans take care of the rest ?
- effie 7y agoInternet is fine as a network, it is resilient to damage. What is sufficient to make it secure is to restrict the network features of the facility server software to one command, SHOW_STATUS. Control of operation over network should be impossible.
- glloydell 7y agoMy spidey sense tingles every time someone uses the S word in regards to system design or security. A system which "should" only allow read access is a system that will most likely have flaws which allow for far more, especially given the governments tendency to underspend on salaries for the people responsible for implementation.
- andrewnicolalde 7y agoRandom damage? Yes, quite resilient. Targeted attack? Not so much.
- jshowa3 7y agoThere would be no way to do reporting on any of the devices in the field without some form of network connection. This delays response time if, for example, a recloser failed to operate, nobody would be aware unless someone physically checked the device. With networked SCADA systems, this becomes an immediate notification to the control room. I'm a fan of manual systems, but within reason though. The point is, you're never going to be 100% protected. People can still break into substations and compromise the grid rather easily.
- toomuchtodo 7y agoRead only monitoring is fine. “Write” ability must be heavily permissioned, audited, and governed. Failing that, no physical “write” access.
- mrob 7y agoWhy are you reading something if you're not going to take action based on that data? Reads are de-facto writes elsewhere, so they need to be authenticated.
- toomuchtodo 7y agoAction can be taken with analog, non networked controls.
- closeparen 7y agoIf reads or communications can be spoofed, operators can be convinced to take the wrong actions with their analogue controls.
- deleted 7y ago[deleted]
- toomuchtodo 7y agoIntegrity of the monitoring apparatus isn’t out of scope, but simply too long of a discussion to be captured in this thread (vs “button that makes it break set to public”).
- probablypower 7y agoThis is exactly what is done in practice. Critical systems (i.e. control room software and hardware) are air gapped and operate in a DMZ. The only real vector one has into such a system (assuming you can't physically access it) is by attacking the 'inputs' to the SCADA network. Attack vectors like stuxnet or petya require physical access to these systems (i.e. a usb key getting plugged into an operation terminal).
- bdamm 7y agoBut... airgapping doesn't stop damages from Aurora type of attacks. So even with top-level grid controls airgapped, if the attacker is at the switch for enough vulnerable lower-level consumers and can synchronize enough switches (car chargers, solar inverters, local substations, etc) the potential damages can still be very significant. As we saw in the Ukraine power grid attacks, you don't even need to go after critical systems. Quantity has its own quality, as the saying goes.
- AmericanChopper 7y ago> This is exactly what is done in practice. I think you’ve got this backwards. This is exactly what is done _in theory_. In practice many of these systems are not. When I was working as a consultant, I saw so many exposed SCADA systems.
- jacquesm 7y agoTypical SCADA system from the eighties will have an open port listening to UDP traffic, if you're really lucky without any kind of checksum where each bit in a packet will toggle a relay and reply with the state of all its input channels in an ACK packet. Given the state of these systems it is amazing that they are not compromised spectacularly every other day. Or maybe they are but it does not make the news. Plenty of this stuff is running on BASIC stamps and such (no kidding) used to network systems that are even older.
- Whatarethese 7y agoThere are also NERC compliance requirements that require USB ports be disabled at and OS or BIOS level.