BLUEPRINT FOR SECURING

INDUSTRIAL CONTROL SYSTEMS

PREFACE

At about midnight on Monday March 18, 2019, one of the world’s largest aluminum producers, with smelting plants, factories and offices in 40 countries, noticed irregularities in its systems. Hours later, Norway-based Norsk Hydro confirmed it was suffering production stoppages in Europe and the US as it battled a major ransomware attack, forcing the company to switch to manual operations while it attempted to contain the issue.

Ransom was never paid, but the total cost of the attack was estimated to be around $52 million.

A few days later, 2 other US-based chemical companies, Hexion and Momentive, were also hit by cyber attacks and had to shut down IT systems to contain the incidents. The same encryption program called LockerGoga is thought to be behind all three attacks.

The attack had a tremendous impact on the production of aluminum worldwide. [1]

This whitepaper is written as a guide to securing networks with Critical Infrastructure in order to prevent similar catastrophes from happening again.

OVERVIEW

In order to secure Critical Infrastructure environments, it is vital to keep a holistic view and look at every part of the network, both the IT (Information Technology) and OT (Operational Technology) parts, investigate the systems and processes in each zone, analyze the attack vectors and risk, and provide recommended security controls.

In order to do so, we use the Purdue model, which was adopted from the Purdue Enterprise Reference Architecture (PERA) model by ISA-99 and used as a concept model for Computer Integrated Manufacturing (CIM). [3] It is an industry adopted reference model that shows the interconnections and interdependencies of all of the main components of a typical Industrial Control System, dividing the ICS architecture into 3 zones and subdividing these zones into 6 levels.

THE PURDUE MODEL

The two major zones are the Enterprise and Manufacturing Zones, also referred to as the IT and OT networks. In the Purdue model, these two major zones are separated by the third zone, the Industrial DMZ, where the intent is to prevent direct communication between IT and OT systems. This adds a layer of separation to the overall architecture so that if something were to compromise a system in the DMZ, then the compromise could be contained within the DMZ, ensuring production processes continue to operate normally.

IT Zone

Level 5: Enterprise Network

Technically not part of ICS, the enterprise zone relies on connectivity with the ICS networks to feed the data that drives the business decisions.

Level 4: Business Logistics Systems

Enterprise Resource Planning (ERP) systems manage the business-related activities of the manufacturing operation. It establishes the basic plant production schedule, material use, shipping and inventory levels.

Industrial DMZ:

The interconnect zone between IT and OT systems, this zone typically holds a jump host for secure remote access to ICS systems.

OT Manufacturing Zone

Level 3: Manufacturing Operations Systems

The purpose of level 3 systems is to manage production workflows to produce the desired products. This includes: batch management; manufacturing execution/operations management systems (MES/MOMS); laboratory, engineering stations, maintenance and plant performance management systems; data historians and related middleware.

Level 2: Control Systems

Level 2 systems supervise, monitor and control the physical processes. This includes real-time controls and software; Distributed Control System (DCS), human machine interface (HMI); supervisory and data acquisition (SCADA) software.

Level 1: Intelligent Devices

Level 1 systems sense and manipulate the physical processes. This includes process sensors, analyzers, actuators and related instrumentation such as PLCs, RTUs or IEDs.

Level 0: Physical Process

Level 0 systems define the actual physical processes.

APPLYING SECURITY TO ICS

In this document, we will dissect the 6 different layers explained above and how they map to different areas in the network. The purpose is to explain the communication flows between the different levels in the Purdue model and how Check Point recommends they should be secured. In order to do so, the following diagram will be used as an example.

Check Point components offered in this whitepaper:

• Check Point Security Gateways (including threat prevention technologies)
• Check Point Endpoint Security
• Check Point Management
• A third party discovery engine

Check Point has strategic partnerships with several 3rd party Discovery Engine vendors. Some focus on specific verticals like Critical Infrastructure, Healthcare, Building Management Systems or IoT, some focus on several verticals at the same time.

In the example in this whitepaper, the 3rd party Discovery Engine used is Claroty. It constantly monitors industrial control system (ICS/SCADA) network traffic and generates alerts for anomalous network behavior that indicates a malicious presence or changes that have the potential to disrupt the industrial processes.

Level 5 and 4: The Enterprise IT Network and Business Logistics Systems

Systems and Processes:

This is the IT part of the network where the users, Data Center and cloud access are located. This is also the part of the organization where the Internet break-out is found.

Attack Vectors:

Typical IT attack vectors, such as spear phishing via Email and Ransomware against users and endpoints.

Industry Example:

In June 2019, an aircraft parts manufacturer called ASCO Industries fell victim to a ransomware attack. Most of the company’s systems, based in Zaventem, Belgium, were affected by the infection, leading to an entire month of inactivity in the IT infrastructure of all ASCO plants.

Risks:

Infrastructure attacks are a relevant and imminent threat to any organization. Many of the recent attacks on OT and ICS networks were found to be based on IT attack vectors.

Recommended Security Controls:

As this is the IT network where the users reside and this is where the internet egress point is located, it is recommended to enable the full Next Generation Threat Prevention plus SandBlast Zero-day Protection (sandboxing) feature set on the network level:

• Firewall
• IPS
• Antivirus
• Anti-bot
• SandBlast (sandboxing)
• Application Control
• URL Filtering
• SSL inspection

It is also recommended to install the full Check Point Endpoint Security suite on the users’ machines. Last but not least, it is very important to secure public cloud services, as these are usually connected to corporate resources and therefore also a potential attack vector.

Enabling network and endpoint security can prevent and eliminate the attacks prior to breaching the ICS equipment. The Security Management server manages all of the security gateways mentioned in this blueprint.

Level 3.5: The Industrial DMZ

Systems and Processes:

Typically, this part of the network is used for technicians’ remote access connections. They can work for the company or the inbound connections that originate from the supplier of the equipment used in the OT network.

Attack Vectors:

• Systems that are exposed directly without VPN technology can easily be exploited
• Malware entering the organization’s OT network over a remote access connection
• Denial of Service attacks on the remote access gateway

Industry Example:

Thousands of critical energy and water systems exposed online for anyone to exploit.

Risks:

In some cases, OT equipment suppliers demand direct IP connectivity to OT equipment in Layer 2 and 1 for support, monitoring and maintenance. This can be a hazardous operation if there are no adequate security controls in place to properly inspect this traffic.

Recommended Security Controls:

To ensure maximum availability of the remote access gateway, it is vital to protect the gateway with an anti-DDoS solution. The VPN remote access server (RAS) sessions are terminated on the perimeter gateway in level 5. The gateway terminates VPN traffic, scans it for malware and only allows RDP traffic to the jump host. This approach is much safer than allowing inbound L3 VPN connections from the internet straight into level 2 and dramatically reduces the risk of the OT network becoming infected due to unsafe RAS connections originating from third parties.

Level 3: Manufacturing Operations Systems

The security gateway in level 3 segments the IT from the OT part of the network and micro-segments level 3 itself. The plant management system, the operators, and the historian should all go in separate VLANs, while the gateway controls who is allowed to talk to who.

Systems and Processes:

In level 3, the manufacturing and operations systems are found, such as SCADA servers, Historian, Engineering stations, as well as the 3rd party discovery engine server (on a dedicated VLAN). This is the place where operators are monitoring the industrial process 24/7 and adjusting it when required.

Attack Vectors:

• Ransomware on Endpoints, machines being abused for cryptocurrency mining, bot infections, phishing via Email.
• Bot infections of the operator workstation could lead to sabotage of the industrial process.
• Unsecured USB ports.

Industry Examples:

An unnamed petrochemical plant in Saudi Arabia was hit by triton malware in the summer of 2017, allowing hackers to take over the plant’s safety instrumented systems.

Risks:

• Unwanted modifications to the industrial process
• Sabotage
• Industrial espionage
• Unpatched monitoring systems
• Lack of visibility into what kind of equipment is in place and if it is running vulnerable firmware

Recommended Security Controls:

• Anomaly and Asset detection and visibility
• Anti-bot
• IPS (typically used as a virtual patch to protect the monitoring stations of the operators)
• Sandboxing technologies to prevent Zero-day attacks
• An application control security policy that only allows specific authorized commands to be sent from the operator workstation to PLCs.
• The use of Identity Awareness can add an extra layer of security.
• Encryption of the control traffic between operators in L3 and PLCs in L2 using IPsec to prevent eavesdropping and traffic replay attacks.
• Endpoint protection including Port Protection.

Level 2 and 1: Securing Communications Between Levels

In example A, there is an inline gateway securing the communication between the local operator workstation and the different PLCs in different production lines.

In this example B, the security gateway is connected to a switch via a mirror port (SPAN).

Systems and Processes:

The communication between level 1 and 2 is at the heart of the ICS network. This is where HMIs and PLCs are communicating using SCADA protocols.

Attack Vectors:

• Denial of Service exploitation on HMIs, RTUs, IEDs or PLCs
• Exploitation of known vulnerabilities of HMIs, RTUs, IEDs or PLCs
• Unencrypted protocols leaving this segment vulnerable to sniffing
• Patching systems in this layer often not done as the main focus is uptime
• Vulnerable machines in level 1 are often targets for hackers to use as crypto miners or for ransomware

Industry Example:

On July 2, 2019, Schneider Electric released a CVE describing vulnerabilities in their Modicon controllers.

Risks:

• Unwanted modifications to the industrial process
• Sabotage
• Industrial espionage

Recommended Security Controls:

• Use gateways running IPS to protect vulnerable systems as a virtual patch instead of patching the actual systems.
• The communication between level 2 and 3 can be encrypted using IPsec.
• A security gateway can be connected to a mirror (SPAN) port on a switch, operating as a sensor, feeding information about asset discovery and anomaly detection.
• Endpoint security can be considered on machines with supported operating systems.

Level 0: Physical Processes

Systems and Processes:

This is where the physical process takes place. Here we find field devices that communicate with intelligent devices in level 1.

Attack Vectors:

As long as the field devices in level 0 are directly connected to the PLCs or RTUs in level 1 using analog links, the likelihood of a cyber-breach occurring here is fairly low.

Risk:

Disruption or modification of the physical process.

Recommended Security Controls:

It is recommended to use point to point connections between the intelligent devices in level 1 and the field devices in level 0. In case the communication between level 1 and level 0 is done over IP, prefer point to point connections.

ARCHITECTURE AND COMPONENTS SUMMARY

1. Discovery Engine: Asset and Anomaly Detection

The Discovery Engine that ensures asset management and anomaly detection for ICS networks provides rapid and concrete situational awareness through real-time alerting.

2. Security Gateways

The Check Point security gateway operates as a tcpdump-like sensor for SCADA device discovery and anomaly detection.

3. The Management Station

The Security Management server is used to push policies to all gateways in the network.

5 KEY TAKE AWAYS

1. Ensure proper segmentation is in place.
2. Threat Prevention is vital.
3. Enable IPS in prevent mode wherever possible.
4. Application control can authorize only specific commands.
5. Visibility is key to security.