CYS401 · Chapter 9 · Annotated SlidesICS/SCADA System Security
Original
Overview

ICS/SCADA System Security

Cyber-physical systems and industrial control: IT vs. OT, the Purdue model, the ICS/SCADA architecture (control center, HMI, MTU, PLCs and RTUs, communication network, field instruments), SCADA protocols, vulnerabilities, threats, the security objectives (availability first), security requirements, policies, and governance. (The Slides page lists this PDF under “Systems Architecture Security”; its content is ICS/SCADA.)

How to read this page

Every original slide is shown unchanged. Yellow marks on a slide point to a numbered note: hover or tap a mark to jump to its note, and hover a note to see its marks. Questions tagged Past exam appeared on a real paper; Prediction questions are likely angles, not confirmed. Pick an answer to each question: a wrong pick tells you why it is wrong, so you can try again.

All 61 slides
  1. 1 ICS/SCADA System Security for CPS
  2. 2 CHAPTER OVERVIEW
  3. 3 INTRODUCTION TO ICS/SCADA SYSTEMS SECURITY
  4. 4 INTRODUCTION TO ICS/SCADA SYSTEMS SECURITY
  5. 5 INTRODUCTION TO ICS/SCADA SYSTEMS SECURITY
  6. 6 IT VS OT ENVIRONMENTS
  7. 7 ▪ Components of ICS/SCADA : it is composed of computers, networks, and
  8. 8 PURDUE ENTERPRISE REFERENCE ARCHITECTURE
  9. 9 INTRODUCTION TO ICS/SCADA SYSTEMS SECURITY
  10. 10 Slide 10
  11. 11 ARCHITECTURE OF ICS/SCADA
  12. 12 ARCHITECTURE OF ICS/SCADA
  13. 13 ARCHITECTURE OF ICS/SCADA
  14. 14 ARCHITECTURE OF ICS/SCADA
  15. 15 SAMPLE SCADA MASTERS
  16. 16 ARCHITECTURE OF ICS/SCADA
  17. 17 Slide 17
  18. 18 Remote Terminal Units (RTUs):
  19. 19 Slide 19
  20. 20 ▪ Many RTUs store the data in their database and waits for a request from the MTU
  21. 21 Slide 21
  22. 22 ▪ Communication Equipment/Network: It provides the link between RTUs (in
  23. 23 Slide 23
  24. 24 ARCHITECTURE OF ICS/SCADA
  25. 25 ARCHITECTURE OF ICS/SCADA
  26. 26 ▪ Actuators: are devices that are responsible for making action to the surrounding or to the
  27. 27 ▪ SCADA Software: It is an important aspect of every SCADA system which
  28. 28 Slide 28
  29. 29 ARCHITECTURE OF ICS/SCADA
  30. 30 ARCHITECTURE OF ICS/SCADA W.R.T SMART GRID
  31. 31 SCADA COMMUNICATION PROTOCOLS
  32. 32 ICS/SCADA VULNERABILITIES
  33. 33 ATTACKING METHODS TOWARDS ICS/SCADA
  34. 34 THREATS CATEGORIES FACING ICS/SCADA
  35. 35 LETS WATCH THIS ...
  36. 36 THE CHALLENGES TO PROTECT ICS/SCADA
  37. 37 ▪ In addition, there are several management, operational, and
  38. 38 ICS/SCADA SECURITY OBJECTIVES
  39. 39 ICS/SCADA SECURITY OBJECTIVES
  40. 40 ICS/SCADA SECURITY OBJECTIVES
  41. 41 ICS/SCADA SECURITY REQUIREMENTS
  42. 42 ICS/SCADA SECURITY REQUIREMENTS
  43. 43 ICS/SCADA SECURITY REQUIREMENTS
  44. 44 ▪ Security counter measures at ser vers:
  45. 45 ICS/SCADA SECURITY REQUIREMENTS
  46. 46 ICS/SCADA SECURITY REQUIREMENTS
  47. 47 Slide 47
  48. 48 ICS/SCADA SECURITY REQUIREMENTS
  49. 49 ICS/SCADA SECURITY REQUIREMENTS
  50. 50 ICS/SCADA SECURITY REQUIREMENTS
  51. 51 ICS/SCADA SECURITY REQUIREMENTS
  52. 52 ICS/SCADA SECURITY POLICIES
  53. 53 ICS/SCADA SECURITY POLICIES
  54. 54 AI-ENABLED SCADA
  55. 55 GOVERNANCE AND COMPLIANCE
  56. 56 GOVERNANCE AND COMPLIANCE
  57. 57 GOVERNANCE AND COMPLIANCE
  58. 58 GOVERNANCE AND COMPLIANCE
  59. 59 GOVERNANCE AND COMPLIANCE
  60. 60 GOVERNANCE AND COMPLIANCE
  61. 61 REFERENCES:
Slide 1 / 61

ICS/SCADA System Security for CPS

Slide 1: ICS/SCADA System Security for CPS
Slide 2 / 61

CHAPTER OVERVIEW

Slide 2: CHAPTER OVERVIEW
Slide 3 / 61

INTRODUCTION TO ICS/SCADA SYSTEMS SECURITY

Slide 3: INTRODUCTION TO ICS/SCADA SYSTEMS SECURITY

Notes

  1. Cyber-physical systems (CPS): ICT + embedded processors controlling physical processes (smart grid, water, transport, health).

Slide 4 / 61

INTRODUCTION TO ICS/SCADA SYSTEMS SECURITY

Slide 4: INTRODUCTION TO ICS/SCADA SYSTEMS SECURITY
Slide 5 / 61

INTRODUCTION TO ICS/SCADA SYSTEMS SECURITY

Slide 5: INTRODUCTION TO ICS/SCADA SYSTEMS SECURITY

Exam angle

PredictionQ1

Which term is the umbrella that includes SCADA and DCS?

Slide 6 / 61

IT VS OT ENVIRONMENTS

Slide 6: IT VS OT ENVIRONMENTS

Notes

  1. IT vs. OT: IT protects data (confidentiality first); OT controls physical processes (availability and safety first, legacy, long life).

  2. Trap In OT/ICS the priority is AVAILABILITY, then integrity, then confidentiality (A-I-C), the reverse of typical IT.

Exam angle

PredictionQ1

In ICS/SCADA, the top security objective is usually:

Slide 7 / 61

▪ Components of ICS/SCADA : it is composed of computers, networks, and

Slide 7: ▪ Components of ICS/SCADA : it is composed of computers, networks, and
Slide 8 / 61

PURDUE ENTERPRISE REFERENCE ARCHITECTURE

Slide 8: PURDUE ENTERPRISE REFERENCE ARCHITECTURE

Notes

  1. Purdue model: level 0 physical process, 1 sensors/actuators/controllers, 2 supervisory (HMI), 3 operations, 4–5 enterprise IT.

Exam angle

PredictionQ1

In the Purdue model, sensors and actuators sit at:

Slide 9 / 61

INTRODUCTION TO ICS/SCADA SYSTEMS SECURITY

Slide 9: INTRODUCTION TO ICS/SCADA SYSTEMS SECURITY
Slide 10 / 61

Slide 10

Slide 10: Slide 10

Notes

  1. SCADA overview figure.

Slide 11 / 61

ARCHITECTURE OF ICS/SCADA

Slide 11: ARCHITECTURE OF ICS/SCADA

Notes

  1. Four main components: control center, communication network, PLCs/RTUs, field instruments.

Slide 12 / 61

ARCHITECTURE OF ICS/SCADA

Slide 12: ARCHITECTURE OF ICS/SCADA
Slide 13 / 61

ARCHITECTURE OF ICS/SCADA

Slide 13: ARCHITECTURE OF ICS/SCADA
Slide 14 / 61

ARCHITECTURE OF ICS/SCADA

Slide 14: ARCHITECTURE OF ICS/SCADA

Exam angle

PredictionQ1

The “heart” of a SCADA system that polls RTUs is the:

Slide 15 / 61

SAMPLE SCADA MASTERS

Slide 15: SAMPLE SCADA MASTERS

Notes

  1. Sample SCADA masters.

Slide 16 / 61

ARCHITECTURE OF ICS/SCADA

Slide 16: ARCHITECTURE OF ICS/SCADA
Slide 17 / 61

Slide 17

Slide 17: Slide 17

Notes

  1. RTU detail.

Slide 18 / 61

Remote Terminal Units (RTUs):

Slide 18: Remote Terminal Units (RTUs):

Exam angle

PredictionQ1

Which device collects data from field sensors at remote sites and sends it to the MTU?

Slide 19 / 61

Slide 19

Slide 19: Slide 19

Notes

  1. RTU detail.

Slide 20 / 61

▪ Many RTUs store the data in their database and waits for a request from the MTU

Slide 20: ▪ Many RTUs store the data in their database and waits for a request from the MTU
Slide 21 / 61

Slide 21

Slide 21: Slide 21

Notes

  1. Communication figure.

Slide 22 / 61

▪ Communication Equipment/Network: It provides the link between RTUs (in

Slide 22: ▪ Communication Equipment/Network: It provides the link between RTUs (in
Slide 23 / 61

Slide 23

Slide 23: Slide 23

Notes

  1. Architecture detail.

Slide 24 / 61

ARCHITECTURE OF ICS/SCADA

Slide 24: ARCHITECTURE OF ICS/SCADA

Notes

  1. Architecture figure.

Slide 25 / 61

ARCHITECTURE OF ICS/SCADA

Slide 25: ARCHITECTURE OF ICS/SCADA
Slide 26 / 61

▪ Actuators: are devices that are responsible for making action to the surrounding or to the

Slide 26: ▪ Actuators: are devices that are responsible for making action to the surrounding or to the

Notes

  1. Actuators act on the environment (valves, motors) when commanded.

Slide 27 / 61

▪ SCADA Software: It is an important aspect of every SCADA system which

Slide 27: ▪ SCADA Software: It is an important aspect of every SCADA system which
Slide 28 / 61

Slide 28

Slide 28: Slide 28

Notes

  1. Detail.

Slide 29 / 61

ARCHITECTURE OF ICS/SCADA

Slide 29: ARCHITECTURE OF ICS/SCADA

Notes

  1. Architecture figure.

Slide 30 / 61

ARCHITECTURE OF ICS/SCADA W.R.T SMART GRID

Slide 30: ARCHITECTURE OF ICS/SCADA W.R.T SMART GRID
Slide 31 / 61

SCADA COMMUNICATION PROTOCOLS

Slide 31: SCADA COMMUNICATION PROTOCOLS

Exam angle

PredictionQ1

Classic SCADA protocols such as Modbus include strong authentication by default.

Slide 32 / 61

ICS/SCADA VULNERABILITIES

Slide 32: ICS/SCADA VULNERABILITIES

Notes

  1. Vulnerabilities: legacy systems, connection to IT networks/internet, weak protocols, poor patching.

Slide 33 / 61

ATTACKING METHODS TOWARDS ICS/SCADA

Slide 33: ATTACKING METHODS TOWARDS ICS/SCADA

Notes

  1. Attacks come through many steps: reconnaissance, initial access, lateral movement, manipulation.

Slide 34 / 61

THREATS CATEGORIES FACING ICS/SCADA

Slide 34: THREATS CATEGORIES FACING ICS/SCADA

Notes

  1. Threats: unintentional (negligent staff, accidents) and intentional (hackers, insiders, nation states).

Slide 35 / 61

LETS WATCH THIS ...

Slide 35: LETS WATCH THIS ...

Notes

  1. Videos (Stuxnet and other ICS attacks).

Slide 36 / 61

THE CHALLENGES TO PROTECT ICS/SCADA

Slide 36: THE CHALLENGES TO PROTECT ICS/SCADA

Notes

  1. Challenges: old designs without security, 24/7 availability needs, hard to patch.

Slide 37 / 61

▪ In addition, there are several management, operational, and

Slide 37: ▪ In addition, there are several management, operational, and
Slide 38 / 61

ICS/SCADA SECURITY OBJECTIVES

Slide 38: ICS/SCADA SECURITY OBJECTIVES

Notes

  1. Objectives: keep the system functioning even in the worst conditions.

Slide 39 / 61

ICS/SCADA SECURITY OBJECTIVES

Slide 39: ICS/SCADA SECURITY OBJECTIVES
Slide 40 / 61

ICS/SCADA SECURITY OBJECTIVES

Slide 40: ICS/SCADA SECURITY OBJECTIVES
Slide 41 / 61

ICS/SCADA SECURITY REQUIREMENTS

Slide 41: ICS/SCADA SECURITY REQUIREMENTS
Slide 42 / 61

ICS/SCADA SECURITY REQUIREMENTS

Slide 42: ICS/SCADA SECURITY REQUIREMENTS

Notes

  1. Protect field instruments (sensors, actuators, PLCs, RTUs): choose compliant devices.

Slide 43 / 61

ICS/SCADA SECURITY REQUIREMENTS

Slide 43: ICS/SCADA SECURITY REQUIREMENTS
Slide 44 / 61

▪ Security counter measures at ser vers:

Slide 44: ▪ Security counter measures at ser vers:

Notes

  1. Server countermeasures: MFA, application whitelisting, patching, hardening.

Slide 45 / 61

ICS/SCADA SECURITY REQUIREMENTS

Slide 45: ICS/SCADA SECURITY REQUIREMENTS
Slide 46 / 61

ICS/SCADA SECURITY REQUIREMENTS

Slide 46: ICS/SCADA SECURITY REQUIREMENTS
Slide 47 / 61

Slide 47

Slide 47: Slide 47

Notes

  1. Detail.

Slide 48 / 61

ICS/SCADA SECURITY REQUIREMENTS

Slide 48: ICS/SCADA SECURITY REQUIREMENTS

Notes

  1. Network communication security: segment, encrypt, authenticate all links.

Slide 49 / 61

ICS/SCADA SECURITY REQUIREMENTS

Slide 49: ICS/SCADA SECURITY REQUIREMENTS
Slide 50 / 61

ICS/SCADA SECURITY REQUIREMENTS

Slide 50: ICS/SCADA SECURITY REQUIREMENTS

Exam angle

PredictionQ1

A system that collects and correlates security events from many sources is a:

Slide 51 / 61

ICS/SCADA SECURITY REQUIREMENTS

Slide 51: ICS/SCADA SECURITY REQUIREMENTS
Slide 52 / 61

ICS/SCADA SECURITY POLICIES

Slide 52: ICS/SCADA SECURITY POLICIES
Slide 53 / 61

ICS/SCADA SECURITY POLICIES

Slide 53: ICS/SCADA SECURITY POLICIES

Notes

  1. ISO 27001 policies: clear desk/clear screen, access control, backup, mobile devices…

Slide 54 / 61

AI-ENABLED SCADA

Slide 54: AI-ENABLED SCADA
Slide 55 / 61

GOVERNANCE AND COMPLIANCE

Slide 55: GOVERNANCE AND COMPLIANCE
Slide 56 / 61

GOVERNANCE AND COMPLIANCE

Slide 56: GOVERNANCE AND COMPLIANCE
Slide 57 / 61

GOVERNANCE AND COMPLIANCE

Slide 57: GOVERNANCE AND COMPLIANCE

Notes

  1. Governance figure.

Slide 58 / 61

GOVERNANCE AND COMPLIANCE

Slide 58: GOVERNANCE AND COMPLIANCE

Notes

  1. Use standards and frameworks (NIST, IEC 62443, ISO 27001).

Slide 59 / 61

GOVERNANCE AND COMPLIANCE

Slide 59: GOVERNANCE AND COMPLIANCE
Slide 60 / 61

GOVERNANCE AND COMPLIANCE

Slide 60: GOVERNANCE AND COMPLIANCE
Slide 61 / 61

REFERENCES:

Slide 61: REFERENCES:

Notes

  1. References.