SCADA Security

SCADA Security NLANR/Internet2 Joint Techs Meeting Columbus OH, July 21, 2004 Joe St Sauver, Ph.D. University of Oregon Computing Center [email_address] http://darkwing.uoregon.edu/~joe/scada/

My Interest In SCADA; This Talk ,[object Object],[object Object],[object Object],[object Object],[object Object]

So What the Heck IS “SCADA?” ,[object Object],[object Object],[object Object],[object Object]

Think of SCADA As… ,[object Object],[object Object]

II. Wow. That Sounds About As Exciting As Watching Paint Dry….

Actually, SCADA Can Be Frighteningly “Exciting”… ,[object Object],[object Object],[object Object],[object Object],[object Object]

“ The Most Monumental Non-Nuclear Explosion and Fire Ever Seen From Space." ,[object Object]

Nation-States Aren’t the Only Ones Interested in SCADA Security ,[object Object]

Sabotage By Insiders May Also Pose A Risk to SCADA Systems ,[object Object]

The Boden Incident Wasn’t Unusual… Wireless Network Porosity Is Common ,[object Object]

The ($50B) 9/14/2003 U.S. Blackout ,[object Object]

Mundane Attacks Could Target SCADA Network Fiber As Easily as Powerlines ,[object Object]

And In The Interest of Balance, A Dissenting Opinion ,[object Object]

Still Not Clear What the Official Position Is On The Urgency of SCADA Security ,[object Object],[object Object]

III. Say What You Will, The Security of SCADA Systems *IS* Often Poor

SCADA Security Today : Where Enterprise Security Was 5-10 Years Ago ,[object Object]

The “Hidden Half” of the Network ,[object Object],[object Object]

Unfortunately, “Hidden” Does Not Always Equal Physically Separated ,[object Object],[object Object]

But Don’t Take My Word For It… ,[object Object]

Serious Consequences of SCADA-Related Compromises ,[object Object],[object Object],[object Object]

Simple Protocols ,[object Object],[object Object]

Long Life Cycle Devices ,[object Object],[object Object]

Windows-Based Control Stations ,[object Object],[object Object]

Hard-to-Upgrade Remote Devices ,[object Object]

Certifying Patches ,[object Object]

Need For Positive Control ==> Simple Known/Shared Passwords ,[object Object],[object Object]

Common Passwords Across Multiple Devices ,[object Object],[object Object]

Access Control Granularity and Accountability ,[object Object],[object Object]

Plain Text (Unencrypted) Traffic ,[object Object],[object Object],[object Object]

All Traffic Is On Just One Port ,[object Object],[object Object]

Few Firewall Options ,[object Object],[object Object]

Critical Control Traffic on a Best Effort Network ,[object Object]

Hard-won Lessons From Enterprise IT Need to Be Tech Transferred to SCADA Networks and Systems ,[object Object]

Secure Your Own SCADA Infrastructure ,[object Object],[object Object],[object Object]

Run a SCADA Honeypot? ,[object Object],[object Object]

Update Intrusion Detection Systems ,[object Object],[object Object]

Add SCADA Security to Your Network Security Syllabus ,[object Object],[object Object]

Embedded Real Time Operating Systems (RTOS) ,[object Object],[object Object]

How About Hardware Topics, Such as Programmable Logic Controllers? ,[object Object]

SCADA Security Research Opportunities ,[object Object],[object Object]

Vendors Are Ramping Up, Too ,[object Object],[object Object],[object Object]

Thanks for the Chance to Talk Today! ,[object Object]

Some References ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

SCADA Security

Recomendados

Recomendados

Más contenido relacionado

La actualidad más candente

La actualidad más candente (20)

Similar a SCADA Security

Similar a SCADA Security (20)

Más de amiable_indian

Más de amiable_indian (20)

Último

Último (20)

SCADA Security