Utilities Racing To Secure Electric Grid

FreeMichael61 writes "In the latest episode of Spy vs. Spy, China rejects accusations it's hacking U.S. companies to steal IP or bring down the grid. But there's no doubt the grid can be hacked, CIO Journal's Steve Rosenbush and Rachael King report. Industrial control networks are supposed to be protected from the Internet by an air gap that, it turns out, is largely theoretical. Internal security is often lax, laptops and other devices are frequently moved between corporate networks and control networks, and some SCADA systems are still directly connected to the internet. What security standards actually exist are out of date and don't cover enough, and corporations often use questionable supply chains because they are cheaper."

Comments

Best Nerdcore Band Name Ever

[Jah-Wren Ryel]

Theoretical Air Gap!

Re:Best Nerdcore Band Name Ever

[ColdWetDog]

Well, I, uh, don't think it's quite fair to condemn a whole program because of a single slip-up, sir.

it always baffles me

[gTsiros]

... why are mission critical devices connected to the internet

sure we know that the weakest link is the meatware, not the hardware, but still...

Re:it always baffles me

[Beardo the Bearded]

They aren't supposed to be online, no. What you have though is the desire to do remote monitoring. One of the SCADA systems I used had an email module so you could get an email when things got all fucked up. That's a super awesome feature to have on a mission critical device.

"Hey, Beardo, it's Loader 1. Probably nothing to worry about, but sensors picked up a fluctuation in the output. Last time this happened the system crashed hard. Yeah, I know you're in a movie. Come check on meeee."

Now if this was up to me, and I know it's not, I'd build that module with an optoelectronic relay so it can send messages but be physically incapable of receiving them. Of course that does limit the usefulness, I can't send back messages, but I could call the place and let the night crew know there's a problem (if they aren't already aware) and how to mediate it.

Re:it always baffles me

[Puff_Of_Hot_Air]

... why are mission critical devices connected to the internet

sure we know that the weakest link is the meatware, not the hardware, but still...

They aren't, at least, not directly. They are however generally connected at various points to the "business" network which is connected to the Internet (people gotta email). The literal air gap is largely fiction. The business network is hacked, then some vulnerability exploited in the bridge points or routers (it's a network of networks!). Why connect the SCADA to the business network at all? To get the data out to do reports, send email alarms etc. in theory this data exporting should be secure. Problem is that who is hacking your SCADA system? It's not the usual suspects; there is no money in it and the barrier of entry is too high for the script kiddies. It's other countries wanting to perform espionage. How the hell do you protect against that? Look at stuxnet, I mean really look at how that took down the centrifuges. Governments have resources that the average hacking group simply doesn't (or SCADA group). They also have no reason to reveal a compromised system. There could be sleeper, targeted, custom malware sitting on every SCADA server in the US, just waiting for the a time where it will be useful to activate. It's a brave new world!

Re:it always baffles me

[dave562]

If the SCADA system is architected properly, remote monitoring is done via a Historian server that does not have the ability to affect the control systems.

I helped setup a Honeywell system to run a power plant in central California. My job was to architect the network piece of it. The hardware itself was completely mirrored in a typical master / slave relationship so that if the master failed, the slave was completely synchronized and could pick up the load.

There was a hardware firewall in between the production network and the Historian. The connection between the two was one way so that the it could report historical data for reporting purposes.

The corporate network connected to the historian via an IPSEC/AES-256 VPN connection. The switch fabric was redundant and the firewall used dual-homed, active/passive connections to mitigate against the potential of a switch failure.

Re:it always baffles me

[drinkypoo]

There was a hardware firewall in between the production network and the Historian. The connection between the two was one way so that the it could report historical data for reporting purposes.

What I'm seeing you say is what I'd like to hear, but unfortunately what I'm reading is you were depending on a piece of software on a firewall to be vulnerability-free in order to provide your one-way communications.

Re:it always baffles me

[firewrought]

Why the hell are mission-critical systems connected to business networks that are themselves connected to the Internet?

Because the functioning of the business relies integrally on both.

Look... I sympathize with the "air gap" argument, but it's not the mid-90's anymore. Business has been transformed by the ability to connect industrial systems with centralized command centers with payment systems with other companies. It's not for execs to have bullshit ipad dashboards... it's for the business to make operational decisions that will take effect in the upcoming hours/minutes/seconds, to meet contractual and legal obligations, to feed customer- and billing-related systems (no point in running a business if you can't cut a bill, eh?).

The world's not going back... VPN's, firewalls, segregated networks, etc., etc., but "air gap" won't do it anymore. Data is the lifeblood of business.

China tries to crack everything, news at 11

[xiando]

Anyone with a web-server will tell you that they are seeing dozens of penetration attempts daily, even right now. I also see this on my home ADSL line. I'm not saying the government there is doing it, but I do know that there is no other country which is attacking everything everywhere this aggressively. I don't have any web pages in Chinese and I wonder if I would be better off just using one of those iptables -j DROP lists who list all IPs in China.

Happens all the time

[Anonymous Coward]

Do you think that the energy industry is any easier on IT folks than anybody else?

Big dollar consultants instead of trained employees, given full unescorted access because the manager doesn't want to have to sit in the datacenter and escort them to the restrooms and such.

My SCADA datacenter still allows a cleaning crew in unescorted.

And electricians, and HVAC contractors and so on.

I found out they were PAINTING my datacenter the day that my storage started freaking out with heat alarms. Went running downstairs to find the facilities team had left a painting crew in the datacenter to cover all of my cabinets (and vented tiles) with tarps.

So these devices might not start connected to the internet, but a USB key here, a rogue cellular wi-fi bridge there, and some wild stuff can happen.

I've heard of other shops that had their SCADA people upset that they couldn't work from home, so they set up "secret" networks that only they knew about so they could still get in. Secret to their co-workers/management, but easy to find for the people who do that for a living.

Going anon for good reason.

Not all companies are equally bad

[dreamchaser]

One of my clients is a large electric utility. Their security, both physical and for IT systems, is top notch. None of their SCADA systems are online, they do routine and regular audits of all security, and even 'trusted' people like myself have to jump through hoops to get into the Data Center, and are always escorted.

They have really cool doors to get in too. They are like decontamination booths. You step into a vertical tube and wait to be cleared then the tube rotates and opens the other side.

On the other hand, I've done work for other utilities where yes, the cleaning crew goes in through what amounts to an open door, without an escort.

Simple solution...

[msauve]

Change those systems from IP to ARCNET (or AppleTalk, or IPX, or ???).

Re:The best defence is interdependence

[camperdave]

Mapping out electrical utilities is not a big deal, it is trivial. It is perfectly legal to drive around the country following power lines and they can find agents who blend in and can claim to be on vacation, looking for property or whatever. If there were a serious danger of attack on us via our infrastructure someone would have done it already because it is so very unprotected.

Drive around the country? Google Maps, my friend. You can follow power lines all over the place from the comfort of your living-room.