Securing SCADA Systems E-Book

Ronald L. Krutz

• Herausgeber: John Wiley & Sons
• Kategorie: Wissenschaft und neue Technologien
• Sprache: Englisch

Seitenzahl: 278

Veröffentlichungsjahr: 2015

Beschreibung

* Bestselling author Ron Krutz once again demonstrates his ability to make difficult security topics approachable with this first in-depth look at SCADA (Supervisory Control And Data Acquisition) systems * Krutz discusses the harsh reality that natural gas pipelines, nuclear plants, water systems, oil refineries, and other industrial facilities are vulnerable to a terrorist or disgruntled employee causing lethal accidents and millions of dollars of damage-and what can be done to prevent this from happening * Examines SCADA system threats and vulnerabilities, the emergence of protocol standards, and how security controls can be applied to ensure the safety and security of our national infrastructure assets

Leseprobe

Securing SCADA Systems

Ronald L. Krutz

Securing SCADA Systems

Published by

Wiley Publishing, Inc.

10475 Crosspoint Boulevard

Indianapolis, IN 46256

www.wiley.com

Copyright © 2006 by Wiley Publishing, Inc., Indianapolis, Indiana

Published simultaneously in Canada

ISBN-13: 978-0-7645-9787-9

ISBN-10: 0-7645-9787-6

Manufactured in the United States of America

10 9 8 7 6 5 4 3 2 1

1MA/RQ/RR/QV/IN

No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning or otherwise, except as permitted under Sections 107 or 108 of the 1976 United States Copyright Act, without either the prior written permission of the Publisher, or authorization through payment of the appropriate per-copy fee to the Copyright Clearance Center, 222 Rosewood Drive, Danvers, MA 01923, [phone], fax [phone]. Requests to the Publisher for permission should be addressed to the Legal Department, Wiley Publishing, Inc., 10475 Crosspoint Blvd., Indianapolis, IN 46256, [phone], fax [phone], or online at http://www.wiley.com/go/permissions.

Limit of Liability/Disclaimer of Warranty: The publisher and the author make no representations or warranties with respect to the accuracy or completeness of the contents of this work and specifically disclaim all warranties, including without limitation warranties of fitness for a particular purpose. No warranty may be created or extended by sales or promotional materials. The advice and strategies contained herein may not be suitable for every situation. This work is sold with the understanding that the publisher is not engaged in rendering legal, accounting, or other professional services. If professional assistance is required, the services of a competent professional person should be sought. Neither the publisher nor the author shall be liable for damages arising herefrom. The fact that an organization or Website is referred to in this work as a citation and/or a potential source of further information does not mean that the author or the publisher endorses the information the organization or Website may provide or recommendations it may make. Further, readers should be aware that Internet Websites listed in this work may have changed or disappeared between when this work was written and when it is read.

For general information on our other products and services or to obtain technical support, please contact our Customer Care Department within the U.S. at [phone], outside the U.S. at [phone] or fax [phone].

Library of Congress Cataloging-in-Publication Data

Krutz, Ronald L., 1938–

Securing SCADA systems / Ronald L. Krutz.

p. cm.

Includes bibliographical references and index.

ISBN-13: 978-0-7645-9787-9 (cloth : alk. paper)

ISBN-10: 0-7645-9787-6 (cloth : alk. paper)

1. Process control. 2. Data protection. 3. Computer security. I. Title.

TS156.8.K78 2005

670.42’7558—dc22

2005026371

Trademarks: Wiley, the Wiley logo, and related trade dress are trademarks or registered trademarks of John Wiley & Sons, Inc. and/or its affiliates, in the United States and other countries, and may not be used without written permission. All other trademarks are the property of their respective owners. Wiley Publishing, Inc., is not associated with any product or vendor mentioned in this book.

Wiley also publishes its books in a variety of electronic formats. Some content that appears in print may not be available in electronic books.

To Emma Antoinette:

The latest Lady Love in my life—a precious beauty—and only 18 months old.

LoveGrandpapa

About the Author

Ronald L. Krutz, Ph.D., P.E., CISSP, ISSEP, is a senior information security researcher for Lockheed Martin Information Technology. In this capacity, he works with a team responsible for advancing the state of the art in information systems security. He has more than 40 years of experience in distributed computing systems, computer architectures, real-time systems, information assurance methodologies, and information security training.

He has been an information security consultant at REALTECH Systems Corporation and BAE Systems, an associate director of the Carnegie Mellon Research Institute (CMRI), and a professor in the Carnegie Mellon University Department of Electrical and Computer Engineering. Dr. Krutz founded the CMRI Cybersecurity Center and was founder and director of the CMRI Computer, Automation, and Robotics Group. He is also a distinguished special lecturer in the Center for Forensic Computer Investigation at the University of New Haven, a part-time instructor in the University of Pittsburgh Department of Electrical and Computer Engineering, and a registered professional engineer.

Dr. Krutz is the author of seven best-selling publications in the area of information systems security, and is a consulting editor for John Wiley & Sons for its information security book series. He holds B.S., M.S., and Ph.D. degrees in electrical and computer engineering.

Credits

Executive EditorCarol Long

Development EditorTom Dinse

Production EditorKathryn Duggan

Copy EditorMaarten Reilingh

Editorial ManagerMary Beth Wakefield

Production ManagerTim Tate

Vice President and Executive Group PublisherRichard Swadley

Vice President and Executive PublisherJoseph B. Wikert

Project CoordinatorRyan Steffen

Graphics and Production SpecialistsKarl BrandtCarrie A. FosterStephanie D. JumperBarbara Moore

Quality Control TechniciansJessica KramerRobert Springer

Proofreading and IndexingTECHBOOKS Production Services

Table of Contents

Cover

Title

Copyright

Dedication

About the Author

Credits

Acknowledgments

Introduction

CHAPTER 1: What Is a SCADA System?

History of Critical Infrastructure Directives

SCADA System Evolution, Definitions, and Basic Architecture

SCADA System Architecture

SCADA Applications

SCADA System Security Issues Overview

SCADA System Desirable Properties

Summary

CHAPTER 2: SCADA Systems in the Critical Infrastructure

Employment of SCADA Systems

Why We Should Worry about These Operations

Summary

CHAPTER 3: The Evolution of SCADA Protocols

Evolution of SCADA Protocols

Background Technologies of the SCADA Protocols

SCADA Protocols

The Security Implications of the SCADA Protocols

Summary

CHAPTER 4: SCADA Vulnerabilities and Attacks

The Myth of SCADA Invulnerability

SCADA Risk Components

Managing Risk

SCADA Threats and Attack Routes

SCADA Honeynet Project

Summary

CHAPTER 5: SCADA Security Methods and Techniques

SCADA Security Mechanisms

SCADA Intrusion Detection Systems

SCADA Audit Logs

Security Awareness

Summary

CHAPTER 6: SCADA Security Standards and Reference Documents

ISO/IEC 17799:2005 and BS 7799-2:2002

ISA-TR99.00.01-2004,

Security Technologies for Manufacturing and Control Systems

ISA-TR99.00.02-2004,

Integrating Electronic Security into the Manufacturing and Control Systems Environment

GAO-04-140T,

Critical Infrastructure Protection, Challenges in Securing Control Systems

NIST,

System Protection Profile for Industrial Control Systems

(SPP ICS)

Federal Information Processing Standards Publication (FIPS Pub) 199,

Standards for Security Categorization of Federal Information and Information Systems,

February 2004

Additional Useful NIST Special Publications

Summary

CHAPTER 7: SCADA Security Management Implementation Issues and Guidelines

Management Impressions of SCADA Security

SCADA Culture

Unique Characteristics and Requirements of SCADA Systems

Limitations of Current Technologies

Guidance for Management in SCADA Security Investment

NIST Special Publication 800-26,

Security Self-Assessment Guide for Information Technology Systems

Summary

CHAPTER 8: Where We Stand Today

The Status Today

The Oil and Gas Industry

Rail System Security

Port Security

Summary

APPENDIX A: Acronyms and Abbreviations

APPENDIX B: System Protection Profile — Industrial Control Systems

APPENDIX C: Bibliography

Index

End User License Agreement

Guide

Cover

Table of Contents

Begin Reading

List of Tables

CHAPTER 1: What Is a SCADA System?

Table 1-1 SCADA-Related Definitions

CHAPTER 3: The Evolution of SCADA Protocols

Table 3-1 SCADA Protocols

Table 3-2 Functions of OSI Model Layers

Table 3-3 OSI Protocols

Table 3-4 Functions of TCP/IP Model Layers

Table 3-5 TCP/IP Protocols

Table 3-6 Firewall Protocol Rules for Different Services to SCADA Systems

CHAPTER 4: SCADA Vulnerabilities and Attacks

Table 4-1 IT versus SCADA System Performance Requirements

Table 4-2 Risk Assessment Steps

Table 4-3 Risk Mitigation Alternatives