In Part 1 in the series of cybersecurity articles for 2018 (http://www.instrumentation.co.za/58931n), we looked at risk assessments within industrial control systems (ICS), including creating an ICS cybersecurity policy. In Part 2, we look at asset discovery (and continuing to do so), and vulnerability management on an ICS.
Vulnerabilities in the ICS environment represent a significant risk to organisations that run control systems, be that a manufacturing, mining or critical infrastructure organisation. These vulnerabilities are becoming more widely exploited by cyber criminals as was evident with the recent Triton and Crashoverride malware variants.
Asset discovery
The best way of understanding your assets is by keeping a comprehensive asset (PLC, HMI, engineering workstations, etc.) register. Without a comprehensive asset register, it will be difficult to protect your systems effectively, as the asset register will assist you in understanding your network by defining the assets (i.e. vendor, model number) and defining how the assets communicate.
In Part 1, we discussed conducting a risk assessment (RA) and if the RA is conducted correctly, you should have a great base to work from. There are various tools that can assist you with identifying assets, such as Grass Marlin (discussed in Part 1), Wireshark and if you are really brave, there is arp-scan that will allow you to identify live hosts. As a cautionary note, please make sure that you are familiar with the tools mentioned above, or that you have tested the tools in an offline environment, as incorrect use could result in unwanted results and failures on the ICS systems. ICS asset scanning can fill a whole book on its own, but the use of these aforementioned tools is well documented and there are plenty of in-depth articles available to assist. There are also some great commercial-off-the-shelf (COTS) solutions available, and most of these solutions tend to offer more than just asset identification and tagging, some going so far as to map out the entire ICS network. The asset register will also help with effective network segmentation (which we will cover in Part 6), network security monitoring (which we will discuss in Part 4), and vulnerability management, which we will discuss next.
Vulnerability management
Vulnerability management, or should I say effective vulnerability management, which includes scanning for vulnerabilities and patching them, is a critical component in protecting both hardware and software systems. In OT/ICS systems however, this gets a little trickier, which I will elaborate on now. The first problem is that of finding the vulnerabilities, as most control assets are not designed to be ‘interrogated’, as is the case for IT assets. The second problem is that if you have managed to identify vulnerability, you are not able to patch it as most control networks operate 24/7/365.
So, if we are unable to scan our assets and cannot patch the vulnerabilities, what do we do? An effective cybersecurity strategy for applying patches combined with specifically developed ICS vulnerability scanning solutions can help. First, one needs to identify the different components of the ICS network(s), and as discussed above, an in-depth asset register will help in this regard. Each set of components will require a different strategy, and then these need to be documented and implemented in the overall cybersecurity program.
Putting things into perspective
Scenario 1
The engineering workstations are only utilised daily between the working hours from 07h00 to 17h00. This would potentially allow us to scan for vulnerabilities, identify which patches need to be applied and then patch the engineering workstations during off peak hours. (As a cautionary note, and in line with industry best practice, it is strongly recommended that patches are tested before applying them.)
Scenario 2
The control room workstations and the PLCs are used 24/7. We are therefore unable to scan these machines for vulnerabilities, and also unable to patch them. For this, we need to look towards non-intrusive passive scanners such as OpenVAS, or my personal recommendation of the Bandolier Project, which is a joint initiative between Digital Bond and Nessus from Tenable. In a nutshell, a passive scanner monitors network traffic at the packet layer to determine services and to identify and assess vulnerabilities, without affecting asset or network performance.
Patching is bit more difficult as the only real time slots we would have to apply these is during a shutdown. Generally, these occur between 1 and 5 times per year, and this period provides an ideal opportunity to patch the effected systems. The problem is that these times are normally reserved for engineers and vendors to make their changes, and to slot in new assets. This is where you need to fight for your piece of the pie and get board-level management buy in, so that you are allocated a time frame to apply your fixes.
Conclusion
To effectively manage vulnerabilities, you need to understand your assets and continuously monitor them for any changes, along with understanding your network(s). Vulnerabilities are not just classified as hardware or software flaws, they could also arise through incorrectly configured devices such as PLCs, industrial switches or control systems and other engineering workstations. This means that it is no longer just the ICS networks that are at risk, safety systems just became vulnerable as well.
Tommy Thompson is a passionate cybersecurity professional with some 15 years’ experience. Starting as a firewall engineer in 2001, Thompson has assisted a variety of companies in numerous roles with their cybersecurity problems. He holds a BComm degree in Information Management from Oxford Brookes University (UK) and he is certified by PECB (Canada), as a Scada Security Professional (CSSP).
For further information contact Tommy Thompson, +27 (0)11 463 0096, [email protected]
© Technews Publishing (Pty) Ltd | All Rights Reserved
printer friendly version