DEGREE PROJECT IN INFORMATION AND COMMUNICATION TECHNOLOGY, SECOND CYCLE, 30 CREDITS STOCKHOLM, SWEDEN 2017 Implementation of a reference model of a typical IT infrastructure of the office network of a power utility company DIMITRIOS VASILEIADIS KTH ROYAL INSTITUTE OF TECHNOLOGY SCHOOL OF ELECTRICAL ENGINEERING 1 2 Abstract Power utility companies are really important in our daily routine since they provide us with power delivery, which is essential in today's society. With the advance of technology, a lot of the procedures that were being manually done by these companies to deliver electrical power, have been automated and centrally controlled by Supervisory Control And Data Acquisition (SCADA) systems. Therefore, this automation must be protected from external attackers that want to hurt control systems (e.g. SCADA), either by stealing sensitive data or even by getting control of the control system and changing parameters and functions that are essential for the good and healthy function of these systems. Exploiting vulnerabilities in the office network can bring an adversary a step closer in getting access to the control system. It is not sufficient on its own, but the adversary can launch further attacks from there targeting the control system. The aim of this thesis is to construct a reference model of a typical IT in- frastructure of the office network of a power utility company, with a simplified implementation in CRATE. CRATE (Cyber Range And Training Environment) is the environment that was used for the implementation of the thesis, provided by the Swedish Defense Research Agency [FOI]. After the implementation is finished, a SCADA system of an enterprise will be installed in CRATE and will be connected with this office network. Once this is done, the Swedish Defense Research Agency will simulate cyber-attacks in a more complete infrastructure. The point of this thesis is to make the office infrastructure as close to a real en- terprise network, although there with some differentiation, part of it on purpose and part of it due to some limitations. 3 Sammanfattning Elbolags existens ¨aressentiell i dagens samh¨allemed tanke p˚aatt elbolagen levererar el vilket viktiga samh¨allsfunktioner beror p˚a. Idag har avancerad teknologi gjort det m¨ojligtatt konvertera diverse procedurer som tidigare genom- f¨ortsmanuellt f¨oratt leverera elektricitet att genomf¨orasautomatiserat och centralstyrt via systemet Supervisory Control And Data Acquisition (SCADA- system). Det ¨ard¨arf¨orytterst viktigt att skydda det automatiserade systemet fr˚anexterna angripare d.v.s. IT-intr˚angsom vill skada det anv¨andastyrsys- temet t.ex. SCADA-styrsystem. Skada kan ske antingen genom att stj¨ala k¨ansligauppgifter eller f˚akontroll ¨over styrsystemet och ¨andrap˚aparametrar och funktioner som ¨arv¨asentliga f¨orett v¨alfungerande system. Att exploatera s˚arbarheteri kontorsn¨atverk kan m¨ojligg¨oraatt motst˚andarehamnar ett steg n¨armareatt f˚atillg˚angtill styrsystemet. Syftet med denna studie ¨aratt konstruera en referensmodell av en typisk IT- infrastruktur av kontorsn¨atetp˚aett elbolag med en f¨orenkladtill¨ampninginom Cyber Range And Training Environment (CRATE). CRATE ¨aren milj¨of¨or cyber¨ovningarsom tillhandah˚allsav Totalf¨orsvarets Forskningsinstitut (FOI) och som har anv¨ants i denna studie f¨oratt implementera referensmodellen. N¨arreferensmodellen av kontorsn¨atethar implementerats, installeras det ¨aven ett SCADA-system i CRATE, och dessa kopplas tillsammans. D¨armedska FOI kunna simulera cyberattacker i en mer komplett infrastruktur. Syftet med denna studie var att skapa ett s˚apass verkligt kontorsn¨atsom m¨ojligttrots viss differentiering j¨amf¨ortmed verkligheten p˚agrund av bl.a. vissa begr¨asningar. 4 Acknowledgements This thesis has been one of the most rewarding projects I have encountered at KTH and in general in my entire academic career. The knowledge I gained from this thesis in amazing. I would like to thank prof. Mathias Ekstedt for giving me the opportunity to work on this thesis, to get to know the department that he works for, his constant feedback and his support. A man with a great will to assist to the point he can his students and drive them to the best possible outcome. I would also like to thank the PhD candidate, Matus Korman, as he was my supervisor at this thesis. I express nothing but gratitude for the patience he showed to all the questions that I kept asking him, which most of the time felt totally irrelevant with the subject. Of course I would like to thank Mr. Asif Iqbal, a new PhD candidate at the department, that brought a lot of his knowledge at the industry ^a\and not only - upon his arrival, a knowledge that we lack as students. Special gratitude goes to my friends for their support not only these 2 years at KTH, but throughout my entire academic career. The best part comes always at the end and here is the point where I would like to express my family, not only for their financial support all these years, but also for their psychological support that has been a tremendous help, for believing in me in my ups and my downs! Thank you all! 5 Contents Abstract 3 Abstrakt 4 Acknowledgements 5 Contents 7 List of Figures 8 1 Introduction 9 1.1 Introduction to the subject area . .9 1.2 SCADA systems . .9 1.3 Cyber-attacks on SCADA networks . 10 1.4 Corporate environment . 10 1.5 CRATE . 11 1.6 Scope and goal of the thesis . 12 1.7 Thesis overview . 12 2 Background 14 2.1 Literature review . 14 2.2 Relevant concepts . 15 2.3 Protocols . 17 2.3.1 Transport Layer Protocols . 18 2.3.2 Application Layer Protocols . 19 3 Method and Implementation 21 3.1 Method . 21 3.1.1 Validation . 22 3.2 Implementation . 22 3.2.1 Demilitarized zone . 24 3.2.2 Office network . 26 3.2.3 Intranet . 27 3.2.4 Engineering network . 30 4 Data flows 31 4.1 DMZ . 31 4.2 Office network . 32 4.3 Intranet . 32 4.4 Engineering network . 33 5 Discussion and conclusion 34 References 36 A APPENDIX - Virtual machines configuration 40 B APPENDIX - Thesis validation 43 6 C APPENDIX - Data flows source code 45 D APPENDIX - Screenshots from CRATE 46 7 List of Figures 1 Source: 2015 Dell Annual Security Report . 10 2 CRATE Architecture [4] . 11 3 Metamodel of CySeMoL's Probabilistic Relational Model (RPM). - [35] . 17 4 OSI model - Created with [54] . 18 5 RICS-el enterprise - Figure created with [54] . 23 6 The DMZ network of the RICS-el enterprise - Figure created with [54] . 24 7 The Office network of the RICS-el enterprise - Figure created with [54] . 26 8 The Intranet network of the RICS-el enterprise - Figure created with [54] . 27 9 The SCADA network of the RICS-el enterprise - Figure created with [54] . 30 10 Screen-shot of the RICS-el enterprise . 46 11 Screen-shot of the DMZ network of the RICS-el enterprise . 47 12 Screen-shot of the Office network of the RICS-el enterprise . 48 13 Screen-shot of the Intranet network of the RICS-el enterprise . 49 14 Screen-shot of the SCADA network of the RICS-el enterprise . 50 8 1 Introduction 1.1 Introduction to the subject area When we refer to the IT (Information Technology) infrastructure of an en- terprise, we refer to the composite hardware, software, network resources and services that the enterprise uses. IT has become necessary for enterprises to stay competitive. IT provides support to enterprises, it supports communica- tion between people (e.g. mail, VoIP, web servers and browsers etc.), it supports storage of data of different kind (e.g. file systems, file servers, databases etc.), it supports operations of technical administration (e.g. of IT itself) and even supports and actually controls industrial processes (e.g. production facilities, chemical facilities, power companies etc.). Of course IT does more than that. Every modern car relies on tons of IT without which it would not even start the engine. As can be easily understood from the above, IT plays a big part in today's enterprises. This is why many companies have their own IT departments, and many of them have them located in different places, either they have one or many departments. Besides securing the systems and the network of a company from external cyber-intruders, physical security of the servers and the systems could also be required, in order for a company to stay up and running. There have been many attacks in IT systems of companies that led them to a financial and operation loss for either short or a large amount of time. This could either be achieved by attacking directly a system or trying to nest a file or trojan into another system for a while and then attack the targeted system. This can be encountered if the entire infrastructure of an enterprise is modelled and well- defined concerning the connections of its systems between them. It provides the possibility to test the infrastructure for various attacks and prevent them. 1.2 SCADA systems Supervisory Control And Data Acquisition (SCADA) systems have greatly evolved over the last years. From the point where these systems where standalone with custom hardware and with custom software as well, now there are many pieces of software and hardware according to the need of the enterprise. This has led to reducing costs in many sections at companies, including operational and maintenance costs. As a result, SCADA systems are controlling a big percent- age of critical infrastructures worldwide, including nuclear power plants, power transmission, electricity generating plants etc. [1] However, all these benefits of present day's SCADA systems also come with downsides.