Sonntag, 3. Februar 2013
Introduction to Nuclear Cyber Security
The development of nuclear energy accompanied the invention of the computers, which brought about a development that we would call the Third Industrial Revolutio. This development generated a complex of economic, political, social effects that is in some cases like in the case of power plant safety, considered national security. In this content, power plants belong to the ICS category. Industrial control system (ICS) is a vague term to describe several types of control systems used in industrial production such as in electric, gas or water plants, as well as supervisory control and data acquisition (SCADA) systems, distributed control systems [use fully qualified domain names (FQDN) ](DCS), and other control systems (Wikipedia, 2011). All of these are defined as critical infrastructures and are considered national security objects. These infrastructures need to be protected for cyber incidents, which is defined by the NIST as: “an occurrence that actually or potentially jeopardizes the confidentiality, integrity, or availability (CIA) of an information system or the information the system processes, stores, or transmits (FIBS PUB, 2006). These threads might be intentional melisouse ? attacks or unintentional by caused by untrained or careless employees. In addition modern networking and communication technologies used to improve also create new cyber vulnerabilities. Care must be exercised in the selection, implementation, and operation of cyber-vulnerable ICS technologies.
What is Nuclear Plant Security and how is it defined
Nuclear plant security involves the securing of critical business and operational functions performed by cyber assets affecting the bulk electric system necessitate having security management controls. To protect critical cyber assets, (these assets should be defined by each company individually), companies should design and implement an information protection, employee roles and responsibilities as well as security training. In this contentd we need to look at some of the possible threads and attacks. One such attack is the SCADA attack. SCADA HacksSCADA attacks or system vulnerabilities pose significant threats to power plants. The combine traditional exploits with industrial control systems which allows attackers to weaponries malicious code, as demonstrated with Stuxnet worm in 2010 to attack the Iranian power plant which using Simetic 7 from Siemens. SCADA systems control everything from valves on oil and gas pipeline to energy grids, heat sensors in power plants, but they are usually not connected to the internet. “SCADA systems run in small private networks hidden away from the rest of the world, usually perfectly secure against reasonably determined hackers. Ergo, SCADA software and hardware by its very nature is not as secure, because it's nowhere near as well known or scrutinized and is heavily dependent on physical security to keep it safe. However, the environments that SCADA systems monitor are usually mission critical; their failure would have serious or even catastrophic consequences” (Wiley & Sons, 2008).
So what does an attacker need for a successful attack? This is a legidemid ? question to ask, if considering ways of preventing an attack. There are two ways to attack a SCADA system. One, if the system is connected to the internet for vendor updates and maintenance, finding leaks and security holes in the connection and network structure and second, the intruder attacks by collecting information about what SCADA systems are being used (software and hardware), which vendor they use and preferably the locations of the terminals and them implanting the attack.
A SCADA hack can be remote access hacks. Gathering information about the system over social networking and asking untrained employees on security, intruders can collect valuable information bit by bit to bring down the system. Sometimes WebPages of vendors give out a great deal of information about the clients they take on, and the system software used. With a little research and reading through press releases, hackers can find out the hardware used. Next step is social engineering over the phone or in person. With this information, remote control stations can be broken in, networks from the remote access point used and a SCADA hack made possible.
I came to the conclusion that it is not important how these attacks happen, lets assume for a minute that they do happen. With this in mind, I would rather I like to emphasize on what to do and how to prevent these attacks.
One way to protect power plants from intruders is to harden the system. Here I don’t just talk about hardening the operating system, but the system as a whole. Writing and applying security policies is one of the major steps of IT-security. The second and perhaps even more important step is to implement these policies. Employee training is crucial, since the human element will always be the weakest element. It is much easier to obtain information from a friendly employee that had no conscious understanding of IT-security than trying to find a weak point in a computer system and penetrating it for the wanted information. The following are suggestions for prevention measures where mentioned in Allsopp’s book of unauthorized access.
Prevention measuresInformation Protection
· Document and implement a process for the protection of information pertaining to or used by critical cyber assets. The roles of whom should write these policies and who should implement them on site should be clearly defined.
· Identification. In a security plan, all assets, mechanical equipments that are identified computer operated need to be identified.
· Classification. These equipments and systems then need to be assigned a security level and a security zone.
· Protection. A plan that drafts the constant maintenance and ongoing protection should be drafted.
Roles and Responsibilities
Roles and responsibilities of employees should be well defined and briefed. Responsible managers should document and direct SCADA security. This can be done with the help of the company’s employee and mechanical system architecture. The most important part is to define these roles and responsibilities on the vendor’s side as well as on the nuclear plant side.
Physical SecurityOne might argue that physical security has nothing to do with IT-security. I believe it has everything to do with it. If I can’t penetrate a local remote access station, how can I penetrate the system in the first place? First, I have to beat the physical security before I can get to the systems. The biggest challenge is to convince IT-security managers, that have little training or no knowledge of real life threads. The implementation of processes, tools and procedures to monitor physical access to the power plant and its critical cyber assets as well as all access points to the computer systems should be clear. Security measures could include identification:
· Bio-metric, keypad, token, or other devices that are used to control access to the cyber asset through personnel authentication. · Surveillance cameras
· Alarm systems inside the building and outside.
· Maintenance and testing of the implemented security measures as well as software and hardware used.
· Electronic media control. No unnecessary technology allowed in to the plants, like cell phones, cameras ect.(nuclear plant security, 2009)
Cyber asset security
The main concern should be the implementation of the security measures and a regular check of the implemented methods. It is important to:
· Keeping the system updated and patched
· Account and password management
· Software integrity checks
· Employee training
· Acting according to international standers
· Being always inspection ready and up to par
· Identifying and handling vulnerabilities
It is very critical that all power plant operations as well as to other ICSs are protected from cyber attacks to maintain the mission of the systems. SCADA systems are often believed to be safe, but several lab tests have shown vulnerabilities that could cause tremendous financial and physical damage to a nuclear plant. Threads come from the inside as well as outside, intentional and unintentional, but the key is to have clear defined rules, regulations and policies in place. Identifying system vulnerabilities, training employees and having an incident prevention as well as incident response plan is of great importance. Of course any advice looks good on paper, but a good security manager knows that there is no system that is complete secure or no system that can’t be penetrated. The job is to keep testing the system, finding weak points and exploit them and preferably catalog them and not to hide them or ignore them.
Bibliography [Label as “References”]Allsopp, W. (2009). Unauthorised Access: Physical Penetration Testing For IT Security Teams. New York: John Wiley & Sons.[only in Annotated Bibliography, not in References - In this book Wil Allsopp has created a thorough reference for those looking to advance into the area of physical penetration testing. The book thus serves as a guidebook for in-house security managers seeking to institute better policy safeguards. "- From the Foreword, by Kevin Mitnick.Most IT security teams concentrate on keeping networks and systems safe from the outside - usually with the entire focus on firewalls, server configuration, application security, intrusion detection systems, and the like. ] Basta, A., & Halton, W. (2008). Computer Security and Penetrasion Testing. Boston: Cours Technology.Covered many subjects concerning penetration testing and gave a general overview of network monitoring and penetration testing. Graves, K. (2010). CEH® Certified Ethical Hacker Study Guide. Indianapolis: Wiley Publishing, Inc.This book is a study guide for a certificate as a ethical hacker. Network security, penetration testing and incident handling are some of the subjects discussed. Hold, M., & Anthony, A. (2008). Nuclear Power Plant and Security Vulnerabilities. Washington: Congress EH® Certified Ethical Hacker Study Guide..This paper discussed the overall plant security, thread models and scenarios, as well as incident emergency response. Nuclear Power Plant Security. (2009, August). Retrieved july 28, 2011, from Nuclear Energ Institud: http://www.nei.org/keyissues/safetyandsecurity/factsheets/powerplantsecurity/General information about nuclear plant security emphasizes physical plant security measures’ and breaches. Oriyano, S.-P., & Gregg, M. Hacker Techniques, Tools, and Incident Handling. (date)It discussed general information in the first two chapters. Then, It goes on to review the technical overview of hacking: how attacks target networks and the methodology they follow. The final section studies those methods that are most effective when dealing with hacking attacks, especially in an age of increased reliance on the Web. Weiss, J. (2010). Protecting Industrial Control Systems from Electronic Threats. New York: Momentum Press, LLC.This book discussed the measures that can be taken to protect industrial control systems by listing and demonstrating the threads and suggesting how to handle them.Safari books online :http://search.safaribooksonline.com/book/technology-management/9780470145012 http://www.msnbc.msn.com/id/42237805/ns/technology_and_science-security/t/nuclear-plant-software-called-vulnerable-attack/
 NIST Federal Information Processing Standards Publication (FIPS PUB) 200, Minimum SecurityRequirements for Federal Information and Information Systems, March 2006.http://csrc.nist.gov/publications/fips/fips200/FIPS-200-final-march.pdfThis is a great sample for writing security policies. It is similar to the ISO 2700 series.