DOCSLIB.ORG

Security Challenges and Building Blocks for Robust Industrial Internet of Things Systems

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Security Challenges and Building Blocks for Robust Industrial Internet of Things Systems Fakultät für Elektrotechnik und Informationstechnik Technische Universität München Security Challenges and Building Blocks for Robust Industrial Internet of Things Systems Matthias Niedermaier Vollständiger Abdruck der von der Fakultät für Elektrotechnik und Informationstechnik der Technischen Universität München zur Erlangung des akademischen Grades eines Doktor-Ingenieurs (Dr.-Ing.) genehmigten Dissertation. Vorsitzender: Prof. Dr.-Ing. Wolfgang Kellerer Prüfende der Dissertation: 1. Prof. Dr.-Ing. Georg Sigl 2. Prof. Dr.-Ing. Dominik Merli, Hochschule Augsburg Die Dissertation wurde am 15.01.2020 bei der Technischen Universität München eingereicht und durch die Fakultät für Elektrotechnik und Informationstechnik am 23.04.2020 angenommen. Abstract Digitalization is an ongoing process in home automation, automotive, and industrial processes. In the home environment, it is not surprising anymore that almost everything can now be controlled remotely. However, this trend can also be observed in the industrial environment, where systems are no longer controlled and monitored on-site, but can be done almost from anywhere in the world by using tablets and smartphones. Furthermore, in the course of predictive maintenance, where servicing is performed before damage causes outages, sensors are analyzed in industrial plants and the data is transmitted over the Internet to the vendor. Consequently, industrial components are getting increasingly connected and remotely accessible. This higher connectivity also enlarges the attack surface, because now attackers have new possibilities which did not exist in the times of air-gaped industrial plants. Overall, in the first part of this work, problems of current Industrial Control System (ICS) in terms of robustness will be shown and potential solutions are demonstrated. In the second part, further concepts and future building blocks for increasing IT security in ICS will be introduced. What makes today’s industrial plants and devices attractive to attackers is the interac- tion between the network side and the real world, which does not exist in this form in the standard IT landscape. This is exactly what is addressed in this work, by highlighting the problems of current control architectures in terms of robustness and thus the related dependency of the control side on the network side. To this end, a testbed is built and used, making the effects of network traffic on the electrical side and therefore the real world measurable. Fuzzing and Denial of Service attacks are possible ways of attacking control systems. The problems shown here can be solved, for example, by secure archi- tectures. One possibility is the feedback free separation of the communication processor from the control processor analyzed in this work. Moreover, a safe way to scan an indus- trial network is presented. This basic security monitoring tool allows initial assessments about the network, whether they contain vulnerable devices or not. In addition, new concepts for increasing security in industrial plants are presented in this work. New and open components are introduced that can be used for research, evaluation, and teaching. Furthermore, an Intrusion Detection System is shown, which runs on low-performance industrial edge node devices. The advantage of this is that each device can decide for itself and no additional hardware is needed. Also, a concept of an active network scanner on edge node devices is presented. This allows a simple network scan in each subnetwork having such an edge node device. Additionally, an open and low-cost testbed is being introduced to research and train industrial security, without disrupting or damaging a productive ICS. This testbed also includes a small physical process to monitor the impact of cyber-attacks in the real world. iii Kurzfassung Die Digitalisierung ist ein fortlaufender Prozess, der bereits Heimautomatisierung, Fahr- zeuge und industriellen Anlagen erreicht hat. Im heimischen Bereich ist es nicht mehr verwunderlich, dass inzwischen fast alles von unterwegs gesteuert werden kann. Dieser Trend ist jedoch auch im industriellen Umfeld zu beobachten, wo Systeme nicht mehr vor Ort gesteuert und überwacht werden, sondern dies auch aus der Ferne auf Tablets und Smartphones geschieht. In Zeiten von Predictive Maintenance, bei der die Wartung vor einem Ausfall durchgeführt wird, werden Sensoren in Industrieanlagen analysiert und die Daten an den Hersteller übertragen. Dies ist nur ein Grund dafür, dass industriellen Komponenten immer mehr miteinander vernetzt werden. Diese höhere Konnektivität er- höht jedoch auch die Angriffsfläche, da Angreifer jetzt neue Möglichkeiten haben, die es zu Zeiten der klaren logischen Abtrennung von Industrieanlagen nicht gab. Zusammenfassend werden im ersten Teil Probleme aktueller industrieller Systeme, wie die Robustheit demonstriert und mögliche Lösungen aufgezeigt. Im zweiten Teil werden weitere Konzepte zur Erhöhung der IT-Sicherheit in industriellen Systemen vorgestellt. Was Industrieanlagen und -geräte für Angriffe so attraktiv macht, ist das Zusammen- spiel von der Netzwerkseite mit der realen Welt, was es in dieser Form in der Standard- IT-Landschaft nicht gibt. Genau hier setzt diese Arbeit an, indem Probleme aktueller Steuerungsarchitekturen in Bezug auf Robustheit und Abhängigkeiten zwischen digtaler und realer Welt aufgezeigt und Lösungsvorschläge unterbreitet werden. Zu diesem Zweck wird eine Testumgebung aufgebaut und verwendet, die die Auswirkungen des Netzwerk- verkehrs auf der elektrischen Seite und damit auf die reale Welt messbar macht. Fuzzing- und Denial of Service-Angriffe sind eine Möglichkeit, eine industrielle Steuerung anzu- greifen. Die hier gezeigten Probleme können beispielsweise von sicheren Architekturen gelöst werden. Eine Möglichkeit ist die rückwirkungsfreie Trennung des Kommunikati- onsprozessors vom Steuerprozessor, die in dieser Arbeit aufgezeigt und analysiert wird. Darüber hinaus wird eine sichere Möglichkeit zum Scannen eines industriellen Netzwerks vorgestellt, durch die eine Einschätzung über das Netzwerk getroffen werden kann. Ebenfalls werden in dieser Arbeit weitere Konzepte zur Erhöhung der Sicherheit in Industrieanlagen vorgestellt. Es werden neue und offene Komponenten gezeigt, die für Forschung, Evaluierung und Lehre genutzt werden können. Darüber hinaus wird ein Intrusion Detection System entwickelt und analysiert, welches auf Edge-Node-Geräten mit geringer Leistung genutzt werden kann. Außerdem wird ein Konzept eines aktiven Netzwerkscanners auf industriellen Edge-Node-Geräten vorgestellt, was einen einfachen Netzwerk-Scan in jedem Teilnetzwerk ermöglicht. Des Weiteren wird ein offener und kostengünstiger Demonstrator für Forschung und Lehre in Bezug auf IT-Sicherheit in industriellen Anlagen präsentiert. Dazu gehört auch ein physikalischer Prozess, um die Auswirkungen von Cyberangriffen in der realen Welt darstellen zu können. v Contents Abstract iii Kurzfassungv Contents vii List of Figures xi List of Tables xv Acknowledgements xvii 1 Introduction1 1.1 Contribution . .5 1.1.1 Addressed Research Questions . .5 1.1.2 Scientific Publications . .5 1.1.3 Revealed Vulnerabilities, Assigned Common Vulnerabilities and Exposures, and Published Advisories . .7 1.2 Structure of the Thesis . .9 2 Industrial Control System Background Knowledge 11 2.1 Timeline on Industrial Control System Attacks . 12 2.2 Programmable Logic Controller Application . 15 2.3 Programmable Logic Controller Overview . 16 2.4 Programmable Logic Controller (Scan) Cycle Time . 17 2.5 Structured Text User Program . 18 2.6 Attack on the Programmable Logic Controller Cycle Time . 19 2.7 Noteworthy Industrial Control System Characteristics . 20 2.7.1 Industrial Control System and the Confidentiality, Integrity and Availability Triad . 20 2.7.2 Lifecycle . 22 2.7.3 Functional Safety . 22 2.7.4 User Program . 22 2.7.5 Update Management . 22 vii Contents 3 Communication Robustness of Programmable Logic Controllers in Terms of Security 23 3.1 Communication Robustness Testbed for Industrial Internet of Things Components . 25 3.1.1 Introduction . 25 3.1.2 Communication Robustness Testbed . 26 3.1.3 Devices under Test in the Testbed . 30 3.1.4 Experiments with Communication Robustness Testbed . 33 3.1.5 Conclusion . 34 3.2 Fuzzing Proprietary Industrial Devices . 35 3.2.1 Introduction . 35 3.2.2 Related Work and Motivation . 35 3.2.3 Concept . 36 3.2.4 Framework Architecture . 37 3.2.5 Framework Evaluation . 39 3.2.6 Conclusion . 42 3.3 Impact of Network Traffic on Industrial Control System Devices . 43 3.3.1 Introduction . 43 3.3.2 Related Work . 43 3.3.3 Certification Programs . 44 3.3.4 Attacker Model . 45 3.3.5 Materials and Methods . 45 3.3.6 Experiments, Results, and Discussion . 49 3.3.7 Conclusion . 60 3.4 Dual-MCU Setup for Robust Industrial Internet of Things Devices . 61 3.4.1 Introduction . 61 3.4.2 Concept and Background . 61 3.4.3 Proof of Concept Implementation . 63 3.4.4 Benchmarking . 67 3.4.5 Conclusion . 70 3.5 Efficient Passive Network Scanning for Industrial Control Systems . 73 3.5.1 Introduction . 73 3.5.2 Passive Network Scanning . 74 3.5.3 Media Access Control Addressing . 75 3.5.4 Device Identification Challenges . 77 3.5.5 Using Media Access Control Addresses for Device Discovery and Identification . 78 3.5.6 Framework and Evaluation . 79 3.5.7 Conclusion . 87 4 Modular Building Blocks to Enhance Industrial Control System Security 89 4.1 Open Industrial Control System Components for Secure Operation . 91 4.1.1 Introduction . 91 4.1.2
Load more

Recommended publications
  • Protocol Design in an Uncooperative Internet
    Protocol Design in an Uncooperative Internet Stefan R. Savage A dissertation submitted in partial fulfillment of the requirements for the degree of Doctor of Philosophy University of Washington 2002 Program Authorized to Offer Degree: Computer Science and Engineering University of Washington Graduate School This is to certify that I have examined this copy of a doctoral dissertation by Stefan R. Savage and have found that it is complete and satisfactory in all respects, and that any and all revisions required by the final examining committee have been made. Co-Chairs of Supervisory Committee: Thomas E. Anderson Brian N. Bershad Reading Committee: Thomas E. Anderson Brian N. Bershad David J. Wetherall Date: c Copyright 2002 Stefan R. Savage In presenting this dissertation in partial fulfillment of the requirements for the Doctorial degree at the University of Washington, I agree that the Library shall make its copies freely available for inspection. I further agree that extensive copying of this thesis is allowable only for scholary purposes, consistent with “fair use” as prescribed in the U.S. Copyright Law. Requests for copying or reproduction of this dissertation may be referred to ProQuest Information and Learning, 300 North Zeeb Road, Ann Arbor, MI 48106-1346, to whom the author has granted “the right to reproduce and sell (a) copies of the manuscript in microform and/or (b) printed copies of the manuscript made from microform.” Signature Date University of Washington Abstract Protocol Design in an Uncooperative Internet by Stefan R. Savage Co-Chairs of Supervisory Committee Associate Professor Thomas E. Anderson Computer Science and Engineering Associate Professor Brian N.
    [Show full text]
  • Message from the Ceo of Cybersecurity Malaysia
    ii e-Security | Vol: 50 - (1/2021) © CyberSecurity Malaysia 2021 - All Rights Reserved WELCOME MESSAGE FROM THE CEO OF CYBERSECURITY MALAYSIA Dear Readers, In 2020, there was a global shift in the way businesses operate due to the COVID-19 pandemic. Conversations became digital, social distancing became the norm, and paper was phased out in favor of technology. Yes, this year, we are still fighting the pandemic. Most industries had to adjust in some way in order to survive this pandemic. Years of digital advancement transpired in months, putting cybersecurity at the forefront. Many businesses still had no plans or were reluctant to return to an entirely 100% on-site workforce, since many states in Malaysia remain in lockdown or partial lockdown. This situation has forced organisations to immediately implement work-from-home policies and mechanisms for their staff. However, the rush to set up remote work programs had left security gaps that cybercriminals are aggressively exploiting. Companies will continue to face threats in 2021, facilitated by widespread teleworking. As the world shifted to a remote work model in reaction to the COVID-19 pandemic, a stream of new threats, technologies, and business models emerged in the cybersecurity arena. In Malaysia, during the period from January to June 2021, Cyber999 received a total of 5,737 cyber incident reports. People need to be vigilant in the ways they perform daily tasks. With more people working, schooling and shopping from home than before, it is no surprise the types of incidents experienced have changed. For example, ransomware and cyber harassment have become quite common as compared to previous years.
    [Show full text]
  • Security Best Practices for Manufacturing OT
    Security Best Practices for Manufacturing OT May 20, 2021 Notices Customers are responsible for making their own independent assessment of the information in this document. This document: (a) is for informational purposes only, (b) represents current AWS product offerings and practices, which are subject to change without notice, and (c) does not create any commitments or assurances from AWS and its affiliates, suppliers or licensors. AWS products or services are provided “as is” without warranties, representations, or conditions of any kind, whether express or implied. The responsibilities and liabilities of AWS to its customers are controlled by AWS agreements, and this document is not part of, nor does it modify, any agreement between AWS and its customers. © 2021 Amazon Web Services, Inc. or its affiliates. All rights reserved. Contents Introduction .......................................................................................................................... 6 Scenarios ............................................................................................................................. 8 Gaining insights from manufacturing data ....................................................................... 8 Device control / machine learning inference at edge .................................................... 10 Edge computing infrastructure management ................................................................ 11 Integrated manufacturing ..............................................................................................
    [Show full text]
  • Inductive Intrusion Detection in Flow-Based Network Data Using One-Class Support Vector Machines
    Inductive Intrusion Detection in Flow-Based Network Data using One-Class Support Vector Machines Philipp Winter DIPLOMARBEIT eingereicht am Fachhochschul-Masterstudiengang Sichere Informationssysteme in Hagenberg im Juli 2010 © Copyright 2010 Philipp Winter All Rights Reserved ii Erklärung Hiermit erkläre ich an Eides statt, dass ich die vorliegende Arbeit selbst- ständig und ohne fremde Hilfe verfasst, andere als die angegebenen Quellen und Hilfsmittel nicht benutzt und die aus anderen Quellen entnommenen Stellen als solche gekennzeichnet habe. Hagenberg, am 14. Juli 2010 Philipp Winter iii Contents Erklärung iii Preface xii Kurzfassung xiii Abstract xiv 1 Introduction1 1.1 Motivation.............................1 1.2 Hypothesis............................2 1.3 Related Work...........................2 1.4 Thesis Outline..........................5 2 Analysed Network Data6 2.1 Overview.............................6 2.2 Network Data Sources......................7 2.2.1 Requirements.......................7 2.2.2 Protocol-Based......................8 2.2.3 Packet-Based.......................9 2.2.4 Flow-Based........................ 11 2.2.5 Comparison........................ 12 2.3 Flow-Based Network Data.................... 14 2.3.1 Protocols......................... 14 2.3.2 Definition......................... 15 2.3.3 Technical Details..................... 16 3 Machine Learning 19 3.1 Overview............................. 19 3.2 Introduction............................ 20 3.2.1 Definition......................... 20 3.2.2 Supervised Learning................... 22 3.2.3 Unsupervised Learning.................. 26 3.2.4 Training Data....................... 29 iv Contents v 3.3 Dimensionality.......................... 34 3.3.1 Feature Selection..................... 35 3.3.2 Feature Extraction.................... 39 3.4 Support Vector Machines.................... 40 3.4.1 Operating Mode..................... 40 3.4.2 One-Class Support Vector Machines.......... 42 3.5 Performance Evaluation..................... 42 3.5.1 Performance Measures.................
    [Show full text]
  • Efficient Passive ICS Device Discovery and Identification By
    EFFICIENT PASSIVE ICS DEVICE DISCOVERY AND IDENTIFICATION BY MAC ADDRESS CORRELATION A PREPRINT Matthias Niedermaier Thomas Hanka Sven Plaga [email protected] [email protected] [email protected] Hochschule Augsburg Hochschule Augsburg Fraunhofer AISEC Alexander von Bodisco Dominik Merli [email protected] [email protected] Hochschule Augsburg Hochschule Augsburg August 14, 2019 ABSTRACT Owing to a growing number of attacks, the assessment of Industrial Control Systems (ICSs) has gained in importance. An integral part of an assessment is the creation of a detailed inventory of all connected devices, enabling vulnerability evaluations. For this purpose, scans of networks are crucial. Active scanning, which generates irregular traffic, is a method to get an overview of connected and active devices. Since such additional traffic may lead to an unexpected behavior of devices, active scanning methods should be avoided in critical infrastructure networks. In such cases, passive network monitoring offers an alternative, which is often used in conjunction with complex deep-packet inspection techniques. There are very few publications on lightweight passive scanning methodologies for industrial networks. In this paper, we propose a lightweight passive network monitoring technique using an efficient Media Access Control (MAC) address-based identification of industrial devices. Based on an incomplete set of known MAC address to device associations, the presented method can guess correct device and vendor information. Proving the feasibility of the method, an implementation is also introduced and evaluated regarding its efficiency. The feasibility of predicting a specific device/vendor combination is demonstrated by having similar devices in the database.
    [Show full text]
  • The Case of Data Diodes for Cybersecurity
    Understanding the Strategic and Technical Significance of Technology for Security Together we Understanding the Strategic Secure the Future and Technical Significance www.thehaguesecuritydelta.com of Technology for Security The Case of Data Diodes for Cybersecurity Understanding the Strategic and Technical Significance of Technology for Security The Case of Data Diodes for Cybersecurity Table of Contents 1 – Introduction: Technology and Cybersecurity 5 2 – Context 9 3 – What is Data Diode Technology and How Does it Work? 11 3.1 What does a data diode look like? 12 3.1.1 Configuration 12 3.1.2 Integration of hardware and software 13 3.1.3 Use of protocols 14 4 – Strengths and Weaknesses of Data Diode Technology 17 4.1 Strengths 17 4.2 Weaknesses 18 4.3 Data Diode, Firewall and Air Gap: How Do They Compare? 20 5 – Data Diode Stakeholder Landscape 23 5.1 Use Case Environment 23 5.2 Vendors 23 5.3 Opportunities for Dutch Stakeholders 25 6 – New Developments in Data Diodes 27 6.1 The Market Condition of Data Diodes 27 6.2 Compliance 27 6.3 Export and Innovation Possibilities 28 6.4 New Fields and the Internet of Things 29 6.5 Open Source vs. Closed Source 30 7 – Conclusions 33 8 – Recommendations 35 Annexes 37 Annex 1 – Interview Questionnaire 38 Annex 2 – List of Interviewees 39 Bibliography 41 3 4 1 – Introduction: Technology and Cybersecurity Our society is undergoing a digital transformation. The The policy is based on setting up collaboration, already characteristics of this transformation are determined by initiated within the Top Sectors2, in four central themes: the convergence of technologies and social activities that blur the boundaries between physical, digital, • energy transition and sustainability; and biological systems.
    [Show full text]
  • Guide to Industrial Control Systems (ICS) Security
    NIST Special Publication 800-82 Revision 2 Guide to Industrial Control Systems (ICS) Security Supervisory Control and Data Acquisition (SCADA) Systems, Distributed Control Systems (DCS), and Other Control System Configurations such as Programmable Logic Controllers (PLC) Keith Stouffer Victoria Pillitteri Suzanne Lightman Marshall Abrams Adam Hahn This publication is available free of charge from: http://dx.doi.org/10.6028/NIST.SP.800-82r2 NIST Special Publication 800-82 Revision 2 Guide to Industrial Control Systems (ICS) Security Supervisory Control and Data Acquisition (SCADA) systems, Distributed Control Systems (DCS), and other control system configurations such as Programmable Logic Controllers (PLC) Keith Stouffer Intelligent Systems Division Engineering Laboratory Victoria Pillitteri Suzanne Lightman Computer Security Division Information Technology Laboratory Marshall Abrams The MITRE Corporation Adam Hahn Washington State University This publication is available free of charge from: http://dx.doi.org/10.6028/NIST.SP.800-82r2 May 2015 U.S. Department of Commerce Penny Pritzker, Secretary National Institute of Standards and Technology Willie May, Under Secretary of Commerce for Standards and Technology and Director SPECIAL PUBLICATION 800-82 REVISION 2 GUIDE TO INDUSTRIAL CONTROL SYSTEMS (ICS) SECURITY Authority This publication has been developed by NIST to further its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3541 et seq., Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems.
    [Show full text]
  • Überwachung Sicherheitskritischer Bahnnetzwerke Mittels Eines Einweg-Gateways Monitoring Safety-Critical Railway Networks Using Unidirectional Gateways
    www.eurailpress.de/archiv/cyber+sicherheit IT-SICHERHEIT | IT SECURITY Homepageveröffentlichung unbefristet genehmigt für Siemens AG / Rechte für einzelne Downloads und Ausdrucke für Besucher der Seiten genehmigt von DVV Media Group, 2018. Überwachung sicherheitskritischer Bahnnetzwerke mittels eines Einweg-Gateways Monitoring safety-critical railway networks using unidirectional gateways Ricarda Weber | Martin Wimmer ie war es so einfach wie in diesen Zeiten von Digitalisierung hanks to modern digitisation and connectivity, it has Nund Vernetzung, Daten über den Zustand von Automatisie- T never been easier to collect and analyse data relating to rungs- oder Produktionsanlagen zu sammeln, zu analysieren the state of production or automation equipment, for exam- und dadurch etwa Ausfallzeiten solcher kritischer Infrastruk- ple in order to reduce the downtime of critical infrastructure. turen zu verringern. Um Digitalisierung und Konnektivität re- Digitisation and connectivity mean that infrastructures are alisieren zu können, müssen kritische Infrastrukturen mit dem connected to the internet and / or cloud computing platforms. Internet oder Cloud-Plattformen verbunden sein. Durch diese However, opening up and interlinking networks comes with a Öffnung und Anbindung der Netze nimmt die Bedrohung durch dramatic increase in the risk of attacks on infrastructure sys- Angriffe auf Infrastrukturen jedoch dramatisch zu. Wie also kön- tems. How can operational data be made available for diag- nen Betriebsdaten zu Diagnosezwecken genutzt werden, ohne nostic purposes without compromising the safety of rail op- die Sicherheit des Bahnbetriebs zu kompromittieren? erations in the process? 1 Data Capture Unit (DCU) von Siemens 1 Data Capture Unit (DCU) from Siemens Eine Antwort darauf bietet die Data Capture Unit (DCU, Bild 1).
    [Show full text]