OT: Cyber Security Seminars

Hi All,

Does anybody know of Annual Process Control Cyber Security Conferences that are worth attending?

Our company is looking at setting up a Department for this and we need to get the people informed and trained.

Any good online resources will be appreciated as well.

Rheinhardt

Nothing?

Hi,

This guy does some training.

http://www.sans.org/instructors/matthew-luallen

Thanks Mark.

I heard a while back of a Annual seminar where all the big vendors are ABB, Allen Bradley, Invensys, ect.

Does anybody know of this seminar?

Rheinhardt

http://en.wikipedia.org/wiki/Black_Hat_Briefings

Not sure who goes to this though.

http://www.inl.gov/scada/

This is a .gov entity in Idaho USA



If someone has more, I'd like to see them - my job description is changing to include this as well.

-John

Thank you for the info.

And to keep current with security issues in general, Steve Gibson's 'Security Now' is a great podcast...

http://twit.tv/show/security-now

Steve is also good at explaining how it all works. Every week, this podcast goes into my queue of shows to listen to during my commute. I've been listening for years.



-Eric

The whole topic of cyber security, relative to the interests of people who read this website, is apparently of little interest.
I really don't know why, either.
If you are a 'plant' person, I'd think you would be worried.
If you are a 'contractor' person, I'd think you would be worried.
I suppose we, as a community, can put our head in the sand, and just kick the can down the road to the IT community, and wash our hands of it.
Yeah, let's do that. THAT will make it all better.
Sheeeh.

I think everyone is waiting for everyone else to come up with a canned solution we can all emulate.

The world of IT type security adds so many layers of knowledge to the job requirement, it has been met largely with a blank stare.

There are appliance level devices that are out there are can be a great part of the solution, but it begins with low level security and logging at the HMI/PLC level, and physical isolation. I have read a lot of best practices, but every network is different and business requirements vary widely.


I think we need to consult with folks who totally understand "both sides of the house" when it comes to controls with ethernet and even indirect internet access. Rather than take a class and figure out all the security details for our plant, bring someone in who is extremely IT savvy to design a solution and learn from that.

This special IT/PLC administration expert would also understand that routers do indeed now affect controls sytems that can kill people and also lots of experience with industrial control system design.

I just came from an A/B class for EthernetIP network design and troubleshooting. Just the basics crammed into 24 hours of class time was too much to cover and we barely got below the surface of some of the security implications.

I think the industry of controls security consulting will grow very fast if it isn't already...It should be a very profitable specialty for some of the www/IT/PC experts we see around here...

OkiePC said:

I think everyone is waiting for everyone else to come up with a canned solution we can all emulate.

The world of IT type security adds so many layers of knowledge to the job requirement, it has been met largely with a blank stare.

There are appliance level devices that are out there are can be a great part of the solution, but it begins with low level security and logging at the HMI/PLC level, and physical isolation. I have read a lot of best practices, but every network is different and business requirements vary widely.


I think we need to consult with folks who totally understand "both sides of the house" when it comes to controls with ethernet and even indirect internet access. Rather than take a class and figure out all the security details for our plant, bring someone in who is extremely IT savvy to design a solution and learn from that.

This special IT/PLC administration expert would also understand that routers do indeed now affect controls sytems that can kill people and also lots of experience with industrial control system design.

I just came from an A/B class for EthernetIP network design and troubleshooting. Just the basics crammed into 24 hours of class time was too much to cover and we barely got below the surface of some of the security implications.

I think the industry of controls security consulting will grow very fast if it isn't already...It should be a very profitable specialty for some of the www/IT/PC experts we see around here...

Click to expand...

Much better stated...and true.

OkiePC said:

I think everyone is waiting for everyone else to come up with a canned solution we can all emulate.

The world of IT type security adds so many layers of knowledge to the job requirement, it has been met largely with a blank stare.

There are appliance level devices that are out there are can be a great part of the solution, but it begins with low level security and logging at the HMI/PLC level, and physical isolation. I have read a lot of best practices, but every network is different and business requirements vary widely.


I think we need to consult with folks who totally understand "both sides of the house" when it comes to controls with ethernet and even indirect internet access. Rather than take a class and figure out all the security details for our plant, bring someone in who is extremely IT savvy to design a solution and learn from that.

This special IT/PLC administration expert would also understand that routers do indeed now affect controls sytems that can kill people and also lots of experience with industrial control system design.

I just came from an A/B class for EthernetIP network design and troubleshooting. Just the basics crammed into 24 hours of class time was too much to cover and we barely got below the surface of some of the security implications.

I think the industry of controls security consulting will grow very fast if it isn't already...It should be a very profitable specialty for some of the www/IT/PC experts we see around here...

Click to expand...

Okie, thanks for your reply. I have been trying to gather information and was very surprised that there is so little information available, I found that most of the blogs, online seminars do focus on the PC and Networking layers.

Alot of these would be useless for the guys on the plant floor that mostly look after the process control machines.

I think better collaboration is required between the the Process Control Infrastructure designers/engineers and the IT professionals that look after the top layers in the network infrastructure.

At the moment there is still a massive disconnect between these two worlds. It is going to be a hell of a task to get these guys to share a boardroom...


Rheinhardt

RheinhardtP said:

Okie, thanks for your reply. I have been trying to gather information and was very surprised that there is so little information available, I found that most of the blogs, online seminars do focus on the PC and Networking layers.

Alot of these would be useless for the guys on the plant floor that mostly look after the process control machines.

I think better collaboration is required between the the Process Control Infrastructure designers/engineers and the IT professionals that look after the top layers in the network infrastructure.

At the moment there is still a massive disconnect between these two worlds. It is going to be a hell of a task to get these guys to share a boardroom...


Rheinhardt

Click to expand...

Well, I saw a demo recently that chilled me to the bone. A guy selling an in-line network do-dad got online with a small micro PLC, over an ethernet wire. Nothing special, just outputting to a 3-light stack light on a timer. Cycling back and forth.
OK, fine.
He launches WireShark, and captures a packet going to the PLC.
Harmless.
Then he starts another program, which can send a packet to a given IP address at the frequency you select. He sends it 1,000,000 times, without delay between.
Bang.
The PLC stops making the outputs.
Its program is gone.
(Of course, then he puts his do-dad inline, and he can't repeat the process).
The point of the demo was to show how his do-dad could intercept a Denial Of Service attack.
Sold.
.
A canned demo: yes.
Scary: yes^2

Keep your eyes out for the words "NERC-CIP"
In the US, there are a bunch of cyber security regulates for power plants (and other infrastructure) that is labelled as "critical" (either becuase it is so large, or part of a blackout restoration chain or a few other reasons)

This is part of my new job description at the Utility that I work for - Its an intresting new world.

a) Up until recently, it was the same as the EPA/CAA/CSAPR rules - the corporate office people read the law and pushed a bunch of requirements onto the plant people and told them to adhere to these and deal with it (you know how that goes...). They are coming around to getting more plant people involved and making things (montly/weekly patching) more workable.

b) NERC does audits on -CIP sites and has the ability to fine them for violations. We got fined last year... I'm not sure how large the fines are.

c) from what I've seen so far, even if there is some variance from one auditor to another, the NERC-CIP standards and people are doing their best to do it right (access log reviews, physical controls, monitoring/logging, firewall control, rules review, backups, change management... Its onerous for a power plant (and only as good as the people running the system) but well on the right track.

(...and please trust that I am not a big fan of much that the us.gov does in the way of regulation...the larger a thing is, the slower it changes.)

Please dont think that I'm trying to paint this NERC-CIP thing as the answer to our worries- its not, but know that some .gov and some large utility people/vendors/IT have this on their minds.

I did read a pdf (a year or 2 ago) describing how easy it was to dDOS a SLC500 (so easy I wanted to try it myself). and for a factory, this could be an expensive proposition- I also think that if you had good backups (we all have good backups incl. offsite....right?!?) and a few techs that know when to press "download" and when to press "upload" - then at least a factory has the ability to recover itself- that would be first on my mind if I had a factory to run (NERC-CIP requires a documented and tested recovery plan...)

My impression in that most of the 'entrenched' controls guys have fought against corporate interference from day one (becuase they are territorial like that) and that has limited the 'visibility' (connectivity?) of many controls networks. This isnt a good answer, but it helps.

I dont know how to convince a small manufacturer that he/she needs to put a $xk firewall on their network. $xk is a lot of production time...

-John

RheinhardtP said:

...
I think better collaboration is required between the the Process Control Infrastructure designers/engineers and the IT professionals that look after the top layers in the network infrastructure.

At the moment there is still a massive disconnect between these two worlds. It is going to be a hell of a task to get these guys to share a boardroom...

Rheinhardt

Click to expand...

Yes, becuase first, you have the get the PLC guys off the floor (figureatively and literally).

The PLC manufacturers need to drive this. in the IT security world (what little I know) security was driven by the companies - Cisco/Asa/Checkpoint/whoever put R&D in top gear and rolled out products saying "look what new security features we have" or "look how easy this is to manage" - and the customers bought into it. I've seen nothing from AB/Grouuupppe Schneider/Siemens saying "go with me, we are more secure" - I see some business oppurtunity here.

The reason they havent locked down thier PLC's is becuase of the slow development cycle (and controls guys like that) and keeping things compatable - IT guys dont have to rewire 24 I/O points when the change a switch.
This pushes security on the IT infrastructure that connects the PLC's to the boardroom. Its an option, but not a good one, not 'defense in depth' like the current IT model.

I recently saw an article saying that "firewalls are obsolete" - it was in an IT journal - the author argued that individual PCs and servers are so secure out of the box (or with applications) that firewalls (which get forgotten or out of date in large IT organizations) are more hassle than they are worth.
I'm not sure I'd argue that far - but its an insight into where IT is this year (and where controls need to be?)

-John

@Johnster - I think that IT security features tend to be more demand/customer driven than supply/producer driven. This could be driven by regulation, like your NERC-CIP example or 21CFR11 in food/drug industries, or driven by other factors. I think it's important (but difficult) to be able to quantify the dollar value of the risk of insecurity. This will drive spending as an investment rather than a cost.

Also - I believe that most industrial facilities can get significant bang for their buck by hardening their infastructure/architecture. Segment the network portion where your PLCs live and put your network security device (IDS/IPS/firewall/whatever) in front of that. Your overall defense posture is determined by many factors, but it makes the most sense to go after your "low hanging fruit". That said, industrial hardware and software vendors should be thinking about security as time goes on.

Also interesting, the Department of Homeland Security appears to posturing to develop a cyber army. Critical infrastructure has to be big piece of this.

https://www.dhs.gov/sites/default/files/publications/HSAC%20CyberSkills%20Report%20-%20Final.pdf