Common Industrial Protocol) Over Ethernet
Total Page:16
File Type:pdf, Size:1020Kb
© 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public BRKIOT-2112 Securing the Internet of Things Philippe Roggeband, Manager GSSO EMEAR Business Development Cisco Spark Questions? Use Cisco Spark to communicate with the speaker after the session How 1. Find this session in the Cisco Live Mobile App 2. Click “Join the Discussion” 3. Install Spark or go directly to the space 4. Enter messages/questions in the space cs.co/ciscolivebot#BRKIOT-2112 © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public The IoT pillars While these pillars represent disparate technology, purposes, and challenges, what they all share are the vulnerabilities that IoT devices introduce. Information Technology Operations Technology Consumer Technology It’s not just about the “things” BRKIOT-2112 © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 6 BRKIOT-2112 © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 7 Agenda • Challenges and Constraints • Specific threats and Protection mechanisms • Cisco best practices and solutions • Q&A • Conclusion Agenda • Challenges and Constraints • Specific threats and Protection mechanisms • Cisco best practices and solutions • Q&A • Conclusion Consumer IoT Characteristics Consumer objects Challenges and constraints • These devices are highly constrained in terms of • Physical size, Inexpensive • CPU power, Memory, Bandwidth • Autonomous operation in the field • Power consumption is critical • If it is battery powered then energy efficiency is paramount, batteries might have to last for years • Some level of remote management is required • Value often linked to a Cloud platform or Service BRKIOT-2112 © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 11 Connected objects complexity • Single Bus is used to exchange information • Example CAN messages: • A/C temperature • Radio Volume • Lights • Cruise Control • Complex consumer objects may be part of a bigger picture • Smart City • Machine to Machine BRKIOT-2112 © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 12 Who is responsible ? User Internet Cloud Service solution Provider provider Owner Manufacturer BRKIOT-2112 © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 13 Enterprise IoT Enterprise IoT • (Partially) controlled environment • Security policies for objects (should) exist • Cloud access security policies (should) exist • but... • Consumer objects may be connected by users • Unsecure objects get hacked in devious ways BRKIOT-2112 © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 15 Commercial Buildings Digitization Enterprise IoT (EIoT) Lighting HVAC Energy/Metering Major Trend of Low-voltage transition, IP Convergence, IoT-enabled Applications Physical Security Inventory Sensors Appliances Cisco Smart & Connected Real Estate BRKIOT-2112 © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 16 IoT protocols, many options… EnergyWise CoAP MQTT XMPP End device OS Any, OpenRTOS Contiki, RIOT, Posix, windows Linux, iOS, • IoT still evolving support TinyOS, mbed, Android, windows, iOS, Android OSX, OpwnWRT • Multiple protocols Transport Protocol TCP/UDP UDP TCP TCP emerging for IoT Standard Proprietary & Open Open Open Open • Open Source and Development Cisco & Cisco Cisco, ARM, Eclipse Allseen alliance community Partners Eclipse, libcoap, Mosquitto/Paho open standards for widespread Implementation C, Java C, Java, Python, C, Java, Python, C, Java,Perl, Ruby, adoption languages Go, C#, Ruby, Lua, C++ PHP, Lisp, Python, Haskell, TCL, JS • CoAP gaining Standards body Cisco / IETF IETF OASIS IETF traction in the industry Security PSK, TLS DTLS TLS TLS Industry adoption Cisco, Cisco ARM, Cisco, IBM, Elecsys, Qualcomm, trend partners Ericsson, Philips, Eurotech Alseen, Cisco Huawei, Alcatel- lucent BRKIOT-2112 © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 17 Security Threats Service Disruption Unauthorized Network Traditional Threats Access • Vulnerabilities on • IP/MAC spoofing Endpoints • Potential network entry point • MAC flooding • Vulnerabilities on Management • Unauthorized POE • DHCP related attacks Applications.( i.e Devices • DDoS Control/Monitoring) • End Points support only • DNS poisoning MAB – MAC spoofing risk • MITM • Snooping of Control traffic BRKIOT-2112 © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 18 Industrial Control Systems Assets We need to Protect Asset Description Examples and Notes Intelligent Electronic Device – Commonly used within Sensor, actuator, motor, transformer, IEDs a control system, and is equipped with a small circuit breaker, pump microprocessor to communicate digitally. Remote Terminal Unit – Typically used in a substation Overlap with PLC in terms of capability RTUs or remote location. It monitors field parameters and and functionality transmit data back to central station. Programmable Logic Controller – A specialized Most PLCs do not use commercial OS, PLCs computer used to automate control functions within and use “ladder logic” for control functions industrial network. Human Machine Interfaces – Operator’s dashboard or HMIs are typically modern control HMIs control panel to monitor and control PLCs, RTUs, and software running on modern operating IEDs. systems (e.g. Windows). Supervisory Collect information from industrial assets and present Unlike HMI, a supervisory workstation is Workstations the information for supervisory purposes. primarily read-only. Software system that collects point values and other Typically with built-in high availability and Data Historians information from industrial devices and store them in replicated across the industrial network. specialized database. Many other devices may be connected to an industrial For example, printers can be connected Other Assets network. directly to a control loop. BRKIOT-2112 © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 20 Convergence of IT and OT The Rigid Silos between IT and OT Cyber-Security IT/OT Convergence IT • Security Risk Assessment OT • Asset Visibility across IT/OT • Protect IT Assets • Segmented Access Control • Operations • Confidentiality, • Evolving Security Regulations uptime/Safety Integrity, Availability • Remote Access • High Availability, • Data, Voice, Video • Integrity, Confidentially • Network • Control Authentication Protocols/Motion • Threat Detection • Physical Access • Process Anomalies BRKIOT-2112 © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 21 Industrial Networks: Manufacturing + BRKIOT-2112 © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 23 Where are these Protocols Found ? TCP/IP FieldBus © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public CIP (Common Industrial Protocol) over Ethernet • Developed in the late 90’s by Rockwell • Now under the control of ODVA, known as EtherNet/IP Port 0xAF12 • Object-oriented approach Ethernet TCP/UDP CIP IP Header CRC • Designed to be media-independent Header Header Payload • May now run over IP CIP Data Model CIP 1. Required Objects Studio/Manager 2. Application Objects 3. Vendor-specific Objects CIP Devices BRKIOT-2112 © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 25 Profibus and Profinet (Profibus over Ethernet) • Originally developed in late 1980s in Germany by the Central Association for the Electrical Industry. • Profibus is a Master/Slave protocol that supports multiple master nodes through the use of token sharing: when a master has control of the token, it can communicate with its slaves (each slave is configured to respond to a single master). • In Profibus DP-V2, slaves can initiate communications to master or to other slaves under certain conditions. • Typically, a master Profibus node is a PLC or RTU, and a slave is sensor, motor, or some other control system devices. BRKIOT-2112 © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 26 Profibus and Profinet (Profibus over Ethernet) • Originally developed in late 1980s in Germany by the Central Association for the Electrical Industry. • Profibus is a Master/Slave protocol that supports multiple master nodes through the use of token sharing: when a master has control of the token, it can communicate with its slaves (each slave is configured to respond to a single master). • In Profibus DP-V2, slaves can initiate communications to master or to other slaves under certain conditions. • Typically, a master Profibus node is a PLC or RTU, and a slave is sensor, motor, or some other control system devices. BRKIOT-2112 © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 26 Modbus • Modbus is the oldest and perhaps the most HMI widely deployed industrial control protocol. • Modbus is a request/response protocol using only three distinct PDUs: Request, Modbus TCP over Ethernet Response, and Exception Response. • Modbus TCP uses TCP/IP to transport PLC (Master) Modbus commands and messages over Ethernet-based routable networks. • Modbus is typically deployed between PLCs and HMIs, or between a Master PLC and Modbus slave devices such as PLCs, Drives, Sensors, and other I/O devices. Ethernet TCP/UDP IP Header Payload Header Header Start Address Function Data CRC End T1 – T4 8 bits 8 bits n x 8 bits 16 bits T1 – T4 IEDs (Slave) BRKIOT-2112 © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 28 OPC (OLE for Process Control) Windows • OPC is a suite of protocols that collectively