Search

Supervisory Control and Data Acquisition (SCADA) systems are responsible for automatic control of several critical infrastructures like power grids. An important requirement of SCADA systems is to provide cryptographic protection of its communications. Many key management schemes have been proposed to provide cryptographic protection. But cryptographic modules are seen as more appropriate solution as it provides cryptographic protection of keys. Recently IEEE has proposed a draft standard SCADA cryptographic module (SCM) which provides direct link security. The goal of this research is joint design of a comprehensive key distribution scheme for SCADA systems, and the architecture of simple SCM to support key distribution and mutual authentication of messages exchanged between any two SCADA entities. Furthermore, unlike the IEEE module, our SCM will be transparent to the type of SCADA communication protocol employed, and will not be restricted to the Bump in the Wire (BITW) mode of operation.

SCADA (Supervisory Control and Data Acquisition) control systems are widely used to control critical processes in various economically and safety critical commercial industries. SCADA control systems are often vulnerable to attacks due to previous industry reliance on security by obscurity to protect control systems. There is a need for an architecture which can log the communications traffic in the SCADA networks. In this work a forensic network traffic data logger retrofit solution for MODBUS and DNP3 network appliances is presented. The data logger uses a bump-in-wire configuration to capture the network transactions, timestamp, cryptographically sign, encrypt and store the network transactions. The data logger is developed to run on embedded and virtual machine platforms. Thus, a retrofit forensic network traffic data logger logs the network traffic in a SCADA control system efficiently without affecting the normal functionality of the control system and the logger data supports post incident forensics analysis.

Industrial Control Systems (ICS) have an inherent lack of security and situational awareness capabilities at the field device level. Yet these systems comprise a significant portion of the nation's critical infrastructure. Currently, there is little insight into the characterization of attacks on ICS. Stuxnet provided an initial look at the type of tactics that can be employed to create physical damage via cyber means. The question still remains, however, as to the extent of malware and attacks that are targeting the critical infrastructure, along with the various methods employed to target systems associated with the ICS environment. This research presents a device using Gumstix technology that emulates an ICS field device. The emulation device is low-cost, adaptable to myriad ICS environments and provides logging capabilities at the field device level. The device was evaluated to ensure conformity to RFC standards and that the operating characteristics are consistent with actual field devices.

Critical infrastructures such as oil and gas pipelines, the electric power grid, and railways, rely on the proper operation of supervisory control and data acquisition (SCADA) systems. Current SCADA systems, however, do not have sufficient tailored electronic security solutions. Solutions available are developed primarily for information technology (IT) systems. Indeed, the toolkit for SCADA incident prevention and response is unavailing as the operating parameters associated with SCADA systems are different from IT systems. The unique environment necessitates tailored solutions. Consider the programmable logic controllers (PLCs) that directly connect to end physical systems for control and monitoring of operating parameters -- the compromise of a PLC could result in devastating physical consequences. Yet PLCs remain particularly vulnerable due to a lack of firmware auditing capabilities. This research presents a tool we developed specifically for the SCADA environment to verify PLC firmware. The tool does not require any modifications to the SCADA system and can be implemented on a variety of systems and platforms. The tool captures serial data during firmware uploads and then verifies them against a known good firmware baseline. Attempts to inject modified and/or malicious firmware are identified by the tool. Additionally, the tool can replay and analyze captured data by emulating a PLC during firmware upload. The emulation capability enables verification of the firmware upload from an interface computer without requiring modifications to or interactions with the operational SCADA system. The ability to isolate the tool from production systems and verify the validity of firmware makes the tool a viable application for SCADA incident response teams and security engineers.

Supervisory Control and Data Acquisition (SCADA) systems control and monitor the electric power grid, water treatment facilities, oil and gas pipelines, railways, and other Critical Infrastructure (CI). In recent years, organizations that own and operate these systems have increasingly interconnected them with their enterprise network to take advantage of cost savings and operational benefits. This trend, however, has introduced myriad vulnerabilities associated with the networking environment. As a result, the once isolated systems are now susceptible to a wide range of threats that previously did not exist. To help address the associated risks, security professionals seek to incorporate mitigation solutions designed for traditional networking and Information Technology (IT) systems. Unfortunately, the operating parameters and security principles associated with traditional IT systems do not readily translate to the SCADA environment. Security solutions for IT systems focus primarily on protecting the confidentiality of system and user data. Alternatively, SCADA systems must adhere to strict safety and reliability requirements and rely extensively on system availability. Mitigation strategies designed for traditional IT systems must first be evaluated prior to deployment on a SCADA system or risk adverse operational impacts such as a catastrophic oil spill, poisoning a water supply, or the shutdown of an electrical grid. This research evaluates the suitability of deploying a Host-Based Intrusion Detection System (IDS) to the Department of Defense SCADA fuels system. The impacts of the Host Intrusion Prevention System (HIPS) installed on the SCADA network's Human Machine Interface (HMI) is evaluated. Testing revealed that the HIPS agent interferes with the HMI's system services during startup. Once corrected, the HMI and connected SCADA network inherit the protections of the HIPS security agent and defenses associated with the Host-Based Security System.