Teumim - Industrial Network Security, Second Edition

Copyright 2010

ISAThe International Society of Automation

All rights reserved.

Printed in the United States of America.

10 9 8 7 6 5 4 3 2

ISBN 978-1-936007-07-3

No part of this work may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, photocopying, recording or otherwise, without the prior written permission of the publisher.

ISA

67 Alexander Drive

P.O. Box 12277

Research Triangle Park, NC 27709

www.isa.org

Library of Congress Cataloging-in-Publication Data in process

Notice

professional judgment in using any of the information presented in a particular application.

Additionally, neither the author nor the publisher have investigated or considered the effect of any patents on the ability of the reader to use any of the information in a particular application. The reader is responsible for reviewing any possible patents that may affect any particular use of the information presented.

Any references to commercial products in the work are cited as examples only. Neither the author nor the publisher endorse any referenced commercial product. Any trademarks or tradenames referenced belong to the respective owner of the mark or name. Neither the author nor the publisher make any representation regarding the availability of any referenced commercial product at any time. The manufacturers instructions on use of any commercial product must be followed at all times, even if in conflict with the information in this publication.

Acknowledgments

My appreciation is expressed for the people who helped and inspired me to write the second edition of this book.

Once again, my special thanks go to my ISA editor, Susan Colwell.

John Clem, from Sandia National Laboratories, contributed content on Red Teaming for the new , New Topics in Industrial Network Security.

My good friend from college, Andy Hagel, provided content and review for , COTS and Connectivity.

As with the first edition, Tom Good from DuPont and Dave Mills of Procter & Gamble provided content for .

Table of Contents

Preface

So much has happened since the first edition of Industrial Network Security was published in 1995. This area has gone mainstream in terms of public awareness of the importance of Industrial Networks to our critical infrastructure and the threat to them from hackers, cyberspies, and cyberterrorists.

For instance, the story Americas Growing Risk: Cyber Attack is featured on the cover of the April 2009 Popular Mechanics. And one of the lead stories on the front page of the 8 April 2009 edition of The Wall Street Journal was Electricity Grid in U.S. Penetrated By Spies. The story talked about how foreign powers had mapped the U.S. electrical grid and left behind some rogue programs that could be activated remotely to disrupt the grid.

The Big R, Regulation, has reared its head in the electric power industry. The NERC-CIP control system cybersecurity standards for electric power generation and transmission entities are now mandated by the U.S. government.

Commercial-off-the-shelf (COTS) hardware and software, as described in , are coming up to speed on Industrial Network Security as COTS become commonplace in that sector control systems.

Consistent with the first edition, an effort has been made to keep this book introductory and easy-to-read. As with the first edition, this edition is intended for the technical layman, manager, or automation engineer without a cybersecurity background. New cyber incidents and updated information have been added to the chapters without changing the original format.

1.0

Industrial Network Security

1.1 What Are Industrial Networks?

To define industrial network security, one first has to define industrial networks. For the purposes of this book, industrial networks are the instrumentation, control, and automation networks that exist within three industrial domains:

Chemical Processing The industrial networks in this domain are control systems that operate equipment in chemical plants, refineries, and other industries that involve continuous and batch processing, such as food and beverage, pharmaceutical, pulp and paper, and so on. Using terms from ANSI/ISA-84.00.01-2004 Part 1(), industrial networks include the Basic Process Control System (BPCS) and the Safety Instrumented Systems (SIS) that provide safety backup.

Utilities These industrial networks serve distribution systems spread out over large geographic areas to provide essential services, such as water, wastewater, electric power, and natural gas, to the public and industry. Utility grids are usually monitored and controlled by Supervisory Control And Data Acquisition (SCADA) systems.

Discrete Manufacturing Industrial networks that serve plants that fabricate discrete objects ranging from autos to zippers.

The term Industrial Automation and Control Systems (IACS) is used by ISA in its committee name and in the recently issued standards and technical report series from the ISA99 Industrial Automation and Control Systems Security standards and technical committee (also, simply ISA99). This term is closely allied with the term Industrial Networks.

), defines the term Industrial Automation and Control Systems to include control systems used in manufacturing and processing plants and facilities, building environmental control systems, geographically dispersed operations such as utilities (i.e., electricity, gas, and water), pipelines and petroleum production and distribution facilities, and other industries and applications such as transportation networks, that use automated or remotely controlled or monitored assets. This standard will be referred to as ISA-99 Part 1 in the book.

The technical report ANSI/ISA-TR99.00.01-2007 Security Technologies for Industrial Automation and Control Systems ().

1.2 What Is Industrial Network Security?

When we speak of industrial network security, we are referring to the rapidly expanding field that is concerned with how to keep industrial networks secure, and, by implication, how to keep the people, processes, and equipment that depend on them secure. Secure means free from harm or potential harm, whether it be physical or cyber damage to the industrial network components themselves, or the resultant disruption or damage to things that depend on the correct functioning of industrial networks to meet production, quality, and safety criteria.

Harm to industrial networks and to the related people, processes, or equipment might be through the following:

Malicious Acts Deliberate acts to disrupt service or to cause incorrect functioning of industrial networks. These might range from a denial-of-service attack against a Human-Machine Interface (HMI) server to the deliberate downloading of a modified ladder logic program to a PLC (Programmable Logic Controller).

Accidental Events These may be anything from a fat-fingered employee hitting the wrong key and crashing a server to a power line surge.

When we think of industrial networks and computer-controlled equipment, we usually think of what ISA99 documents call electronic security, but we should also include some aspects of two other branches of security: physical security and personnel security. These other two branches of security will be addressed in .

To illustrate the distinction, lets say we have a disgruntled employee who vents his anger in a chemical plant and:

1. turns a virus loose on the computer workstation that runs the HMI software, allowing the virus to spread through the industrial network;