FIREWALL DEPLOYMENT FOR SCADA/PCN How closed need your network needs to be? How open can you afford your network to be? Where from the vulnerability is coming? How to mitigate the vulnerability? How to detect that anyone un-authorized is trying to jeopardize the network services? How the Business Continuity can be maintained in the long run with the steps taken? How to envisage future requirements?
Network Security 1. Denial of Service 2. Unauthorized Access: Types of Attempt to access command shell Attacks 3. Illicit command execution: Hacking Administrator’s password Changing IP Address Putting a Start-up Script 4. Confidentiality Breach 5. Destructive Attacks Data Diddling Data destruction Balancing act between: Keeping equipment and processes protected. Allowing them to touch larger computing realms via Ethernet protocols and the internet to gain new connections and capabilities. Solution: Multiple Zone Network with Subzone.
Network Security
Generic IT security goals versus ICS security goals Assessment process flow chart OSI Model – 7 Layers Network Security Tools Intelligent Network Switches and Routers Firewalls Hardware and Software Devices for managing network connections User Authentication Encrypting Data DMZ
Network Security Firewall Firewall is a mechanism used to control and monitor traffic to and from a network for the purpose of protecting devices on a network. Compares traffic passing through it to a pre- defined security criteria Can be a hardware device (CISCO PIX or Semantic Security Gateway) Can be a hardware/Software unit with OS based firewall capabilities (“iptables” running on a Linux Server) Host based software solution installed on the workstation directly (Norton Personal Firewall or Sygate Personal Firewall) FIREWALL Internet facing firewall protecting PC & PLC Network Traffic Network traffic is sent in discrete group of bits, called a packet which includes Sender’s Identity (Source Address) Recipient’s Identity (Destination Address) Service to which the packet pertains (Port Number) Network Operation and Status Flags Actual payload of data to be delivered to service A firewall analyzes these characteristics and decides what to do with the packet based on a series of rules, known as Access Control Lists (ACL). Content of Network Traffic Host Based Firewalls Available on Windows or Unix based platforms Primary function is Workstation or Server Tasks like Database Access or Web Services Can do little to regulate traffic destined for Embedded Control Devices
Classes of Firewall Packet Filter Firewall Simplest class of Firewall following a set of static rules Only the IP Addresses and the port number of the packet is examined No intelligence to identify spoofed (Forged source IP Address) packages
Classes of Firewall Packet Filter Firewall Application Proxy Firewalls Open Packets at Application Layer Process them based on specific application rules Reassemble and forward to target devices No direct connection to external server Possible to configure internal clients to redirect traffic without the knowledge of the sender Possible to apply access control lists against the application protocol
Classes of Firewall
Acting as Intrusion Detection System; Logging denied packets, Recognizing network packages specifically designed to cause problems, Reporting unusual traffic patterns Blocking infected traffic by deploying Front-line Anti-Virus Software on firewall Authentication services through passwords or Public Key Encryption Virtual Private Network (VPN) gateway services by setting up an encrypted tunnel between firewall and remote Host devices Network Address Translation (NAT) where a set of IP addresses used on one side of a firewall are mapped to a different set on the other side.
Other Firewall Services No direct connection from the Internet to the PCN/SCADA Network and vice versa Restricted access from the enterprise network to the control network Unrestricted (but only authorized) access from the enterprise network to shared PCN/Enterprise servers Secured methods for authorized remote support of control system Secure connectivity for wireless devices Well defined rules outlining the type of traffic permitted Monitoring the traffic attempting to enter PCN Secure connectivity for management of firewall
Overall Security Goals of PCN/SCADA Firewalls Security: The likely effectiveness of the architecture to prevent possible attacks. Manageability: Ability of the architecture to be easily managed (both locally as well as from remote). Scalability: Ability of the architecture to be effectively deployed in both large and small systems or in large numbers.
Firewall Selection Criteria Dual-Homed Computers
Common SCADA/PCN Segregation Architecture Dual Homed Server with Personal Firewall Software
Common SCADA/PCN Segregation Architecture Packet Filtering Router/Layer-3 Switch between PCN & EN
Common SCADA/PCN Segregation Architecture Two Port Firewall between PCN & EN
Common SCADA/PCN Segregation Architecture Router/Firewall combination between PCN & EN
Common SCADA/PCN Segregation Architecture DMZ is a critical part of a firewall. Neither part of un-trusted Network, nor part of trusted network Puts additional layer of security to DDCMIS LAN Physical or Logical sub-network that provides services to users outside LAN
DMZ Firewall with DMZ between PCN & EN
Common SCADA/PCN Segregation Architecture Paired Firewalls with DMZ between PCN & EN
Common SCADA/PCN Segregation Architecture Firewall with DMZ and SCADA/PCN VLAN
Common SCADA/PCN Segregation Architecture Comparison Chart for PCN/SCADA segregation Architecture DDCMIS NETWORK SECURITY MEASURES TAKEN AT NTPC/TALCHER-KANIHA
PI Server
Port 5450 10.0.120.202
Office Network
Firewall Firewall Firewall
Gateway PC Gateway PC ABT OPC + Honeywell + Server + PI PI OPC OPC Server PI OPC OPC Interface Interface Interface
Stage II Plant Network Stage I Plant Network ABT Network
Unit 3 Unit 6 Unit 1 Unit 2
Honeywell Honeywell Keltron Keltron Experion Experion OPC OPC Server System System Network TopologyServer Network Topology
PI Server
Port 545 PI Client 0 10.0.120.202
Office Network (NTPC LAN)
Firewall- Firewall-2 Firewall 1 -3
Gateway ABT OPC Server PC Honeywel OPC OPC (Redundant) l WAN + PI OPC Server Server Server Interface Main Standby
ABT Network L-3 Switch L-3 Switch
Unit 3 Unit 6 Unit 1 Unit 2 Honeywell Honeywell DDCMS Experion Experion DDCMS System System
Stage II Plant Network HEADS OF PLC COOLING CHP-1 CHP-2 DM PLANT PT PLANT COOLING PC - O&M TOWER-1 PLC PLC PLC PLC TOWER2 HEAD - OPER -C&I SHIFT M/C PLC OF - BOILER/TURBINE M/C ENGR PROJ etc -C&I M/C ENGR
PT PLANT SWITCH SERVICE BLDG SWITCH
Ash handling fire proof AC CPU PLC PLC PLC PLC
SERVER PC1 … .. P C n PR SWITCH
SWAS C&I shift IT PC Incharge PC LA FIREWALL BPOS system U#3,4,5 &6 N ESP GATEWAY PCs PC # MOR 3,4,5,6 STATION LAN SWITCH STN LAN PC SERVER
OWS OWS / OWS UNIT-3 UNIT UNIT UNIT Unit 1 Unit 2 in PR LVS in PR & CER in CCR & CER -4 -5 -6 UNIT HMI LAN U#3 SWITCH UNIT HMI SERVERS Station LAN of Talcher-II Typical before PI connectivity CONTROL SYSTEM HEADS OF PLC COOLING CHP-1 CHP-2 DM PLANT PT PLANT COOLING PC - O&M TOWER-1 PLC PLC PLC PLC TOWER2 HEAD - OPER -C&I SHIFT M/C PLC OF - BOILER/TURBINE M/C ENGR PROJ etc -C&I M/C ENGR
PT PLANT SWITCH SERVICE BLDG SWITCH
Ash handling fire proof AC CPU PI- PLC PLC PLC PLC SERVER PC1 … .. P C n PR SWITCH IT SWAS C&I shift LA FIREWALL PC Incharge PC PI- GATEWAY N Interface PC BPOS system ESP PCs U#3,4,5 &6 # DMZ 3,4,5,6 MOR STATION LAN SWITCH STN LAN PC SERVER
OWS OWS OWS in PR / LVS in PR UNIT-3 UNIT UNIT UNIT Unit 1 Unit 2 & in & CER -4 -5 -6 CCR CER UNIT HMI LAN U#3 SWITCH
UNIT HMI SERVERS Station LAN of Talcher-II Typical after PI connectivity CONTROL SYSTEM PI- Server NTPC Office LAN PI- Interface - - -
PI system connectivity at Talcher-II Steps: 1. Review the existing LAN of NTPC/Talcher Kaniha 2. Perform a Bandwidth Assessment Test 3. Perform a Vulnerability Test 4. Conduct a Penetration Test 5. Conduct a Security Audit 6. Conduct a CCTV Demo between Talcher Kaniha & EOC-NOIDA 7. Recommendation and Suggested Up- Gradation
Network Testing Methodology Finding Vulnerability on the Operating System Vulnerability of Servers Tools: NMAP: To Map Open Ports NESSUS: To find the application running on Target Servers. MBSA: To find the missing patches on the operating system and applications Port Scanning and Network Mapping Used Traceroute, Hping2, Xprobe2 and Nmap tools. Fingerprinting and Vulnerability Mapping Server Operating system (Gateway PC) Fingerprinting Security Patch Review using Microsoft Baseline Security Analyzer (MBSA) Vulnerability Test on Servers Bandwidth Testing: To find out used Bandwidth of the Network Identifying potential bottlenecks Tool Used: PRTG Methodology: Port Mirroring: All Tx/Rx Traffics of WAN Server, MOR Server and Gateway PC are mirrored into the Grapher
LAN Capacity Testing Testing of Network and Components for security weaknesses. Flowchart:
NMA Ness Ether Hping2/ P us eal Firewalk
Password Cracking Tool/Web Server Scanner/OS Fingerprinting/SNMP Tests
Penetration Test Ethereal: Sniffs Network Traffic to find clear- text username and passwords Hping2: Command line oriented TCP/IP Packet assembler/analyzer. Used for Firewall Testing/Advanced Port Scanning, Remote OS Fingerprinting Firewalk: Used to enumerate the rules of the firewall and ACLs Cain & Abel,John the ripper, L0phtcrack: Password auditing tool Brutus: Password Cracker
Penetration Tools Network Security To Do List: Turn ON Virus Protection software and be vigilant about installing patches Use Complex Passwords that includes numbers and mixed characters Install Firewall. Monitor them to check who is accessing them and what software they are using. Turn off unnecessary ports and devices Turn down and lock down PCs as much as possible Train staff to follow security policies.
Network Security Chairman(HOD-C&I)
Information Security Manager
Information Security Coordinator
System Network Database Administrator Administrator Administrator
Information Security Team Structure