Instructor: ICS and SCADA Vulnerabilities. 2 2
So, at this point, we've talked 3 3
about a couple of pieces inside embedded systems, 4 4
and a lot of these things are going to be put together 5 5
into an ICS or SCADA network. 6 6
Now, before we dive into that, 7 7
let me first take a step back 8 8
and talk about the type of technology 9 9
we're talking about here. 10 10
Now, in general, we work in IT, 11 11
which is information technology. 12 12
That's our standard Windows, computers, 13 13
and networks, and things like that. 14 14
But when we start talking about ICS and SCADA, 15 15
we are talking about OT, which is operational technology. 16 16
This is a communications network 17 17
that's designed to implement an industrial control system, 18 18
rather than data networking. 19 19
So, here, we're really not talking about end user machines. 20 20
We're not talking about having a Windows 10 host 21 21
sitting on this network. 22 22
Instead, with OT, we're talking 23 23
about things that, using technology and computers, 24 24
to be able to do things in the physical world 25 25
like open or shut a valve, like do manufacturing, 26 26
like create power generation in a power plant; 27 27
things like that. 28 28
So, if I look here, for instance, 29 29
this is what OT looks like. 30 30
Usually, they look like big cabinets 31 31
with dials and gauges and buttons. 32 32
So, if I wanted to open or shut different valves 33 33
or turn on or off different pumps, 34 34
I would push the different buttons 35 35
on that diagram on the front of that cabinet, 36 36
instead of using something like a Windows machine 37 37
and using the command, like start open valve, enter, right? 38 38
This is a different way of thinking. 39 39
Now, you can still have computers 40 40
like Windows computers that can talk to these networks 41 41
if you integrate the two, but you don't have to. 42 42
A lot of OT can just be done in a manufacturing plant, 43 43
using systems like this. 44 44
Now, when we deal with industrial control systems, 45 45
these are going to prioritize availability 46 46
and integrity over confidentiality. 47 47
So, if we talk about the CIA triad, normally, in IT, 48 48
here we're really talking about the AIC triad. 49 49
Availability is paramount, and this makes sense 50 50
if you think about it, 51 51
because OT was originally designed to do manufacturing, 52 52
and anytime the plant was down, we weren't making money. 53 53
So, for them, availability was everything. 54 54
Also, the plant didn't talk to the internet originally; 55 55
it was all within the borders of the plant, 56 56
and so we had that physical boundary. 57 57
So, confidentiality wasn't as big of a deal 58 58
because we trusted the people working for us, 59 59
so availability was much more important. 60 60
So, now that we've got an introduction 61 61
to operational technology, let's talk specifically 62 62
about three key areas. 63 63
I've already talked about the terms ICS and SCADA, 64 64
and we're also going to talk about Modbus. 65 65
Now, let's start with ICS. 66 66
ICS is an industrial control system. 67 67
When you hear ICS, this is essentially just a network 68 68
that manages embedded devices. 69 69
So, if I work in someplace like an electrical power station 70 70
or a water supplier, or I work in a hospital 71 71
doing health services, 72 72
I might work in telecommunications in the backbones, 73 73
I might work in manufacturing or in defense needs, 74 74
all of these things use ICS; 75 75
they all use this operational technology 76 76
using these industrial control systems. 77 77
For instance, if you're driving a US Navy warship, 78 78
there are a ton of ICS and SCADA systems on those things, 79 79
because you essentially have a power plant on board, 80 80
you have the engines on board, 81 81
and all of that stuff is essentially 82 82
a big manufacturing plant, 83 83
and it has similar components to that. 84 84
And so, those things all run on ICS and SCADA as well. 85 85
Now, one of the things that ICS uses 86 86
is what's known as fieldbus. 87 87
fieldbus is a digital serial data communications 88 88
that are used in operational technology networks 89 89
to link different PLCs together. 90 90
So, we talked about those PLCs in a previous lesson, right? 91 91
I might have a PLC that opens and shuts this valve 92 92
to let more gas into the engine 93 93
so that we can go faster on a ship, for instance. 94 94
Well, that is just one PLC, 95 95
but I might have another PLC that opens and shuts a breaker 96 96
that allows electricity to go 97 97
to a different part of the ship. 98 98
And if I want to connect all those things together, 99 99
I need a way to do it. 100 100
And that's what we use fieldbus for 101 101
is this digital serial data communications 102 102
that we use to link all these things together. 103 103
Now, another thing we have to be able to do 104 104
is we need to be able to talk to these machines 105 105
and tell them what to do, 106 106
and that's where we use an HMI, a human machine interface. 107 107
This is the input and output controls on a PLC 108 108
that allows a user to configure and monitor the system. 109 109
So, when I'm trying to tell the system to do something 110 110
like open a valve, I need a way to give it that input. 111 111
I can do that by pushing a button; 112 112
that could be a human machine interface. 113 113
Or I can open that valve on a touchscreen 114 114
by tapping it and saying, "Open." 115 115
These are all different ways I can interface with it. 116 116
Now, ICS is all about managing process automation 117 117
by linking together these PLCs 118 118
using the fieldbus to make changes in the physical world; 119 119
I want to open a valve, I want to start a motor, 120 120
those kind of things. 121 121
Now, I as a human need to be able to see 122 122
what the machine is doing by reading gauges 123 123
or other screens, and be able to give input 124 124
into the machine of what I want to do 125 125
by pushing buttons, turning knobs, entering keystrokes, 126 126
or even using a touchscreen. 127 127
So, for example, here, if I worked in a hospital, 128 128
I might have a human machine interface 129 129
that's a flat panel screen, 130 130
and I can touch it and tell it what I want to be done. 131 131
This way, this panel can then send the information 132 132
to that machine to do what it needs to do. 133 133
In this case, it's a radiography machine 134 134
that's going to take an X-ray. 135 135
This also has PLCs connected to it within a control loop, 136 136
and that whole process automation system is governed 137 137
by some kind of a control server. 138 138
This is how all this stuff ties together. 139 139
Now, one of the other things we have to think about 140 140
is having some way to know 141 141
what all these systems have done in the past, 142 142
because if we're doing an incident response, 143 143
we want to be able to figure all that out. 144 144
And so, as a cybersecurity analyst, 145 145
one of the things you want to look for is the data historian. 146 146
Now, the data historian is a software that aggregates 147 147
and catalogs data from multiple sources 148 148
within an industrial control system. 149 149
Now, again, as an analyst, this is important for you to know 150 150
because if you're working in a place 151 151
that has an industrial control system, 152 152
you want to find out where the data historian is 153 153
and how you can use it 154 154
because that's going to have valuable information for you. 155 155
All right, so now that we're done talking about ICS, 156 156
let's focus on the second part of this lesson, 157 157
which is all about SCADA. 158 158
SCADA is the supervisory control and data acquisition. 159 159
This is a type of industrial control system, 160 160
so it's a type of ICS, that manages large scale 161 161
multi-site devices and equipment 162 162
spread over a geographic region. 163 163
So, when I'm talking about ICS, I'm looking at one plant. 164 164
When I talk about SCADA, I'm talking about multiple plants. 165 165
That's really the way I like to distinguish these two. 166 166
So, when you deal with SCADA, this typically runs 167 167
as software on ordinary computers, and it gathers data 168 168
and manages it across the different plant devices 169 169
and the different equipment that has embedded PLCs. 170 170
So, when you're dealing with SCADA, 171 171
it typically is going to use some kind 172 172
of a wide area network connection. 173 173
That could be cellular, that could be microwave, 174 174
that could be satellite; whatever you want to use. 175 175
And then, they're all going to link back to those field devices 176 176
back to the central SCADA server. 177 177
So, I mentioned earlier: I have a smart meter on my house. 178 178
They don't have to come out once a month 179 179
and read my electrical meter to know how much to bill me. 180 180
Why don't they have to do that? 181 181
Because it's part of a SCADA network, 182 182
and all the houses in my area are part 183 183
of that SCADA network. 184 184
They have a cellular chip in there, 185 185
and it takes that reading once a month, 186 186
sends it back over a cellular 187 187
as a text message or data format, 188 188
whatever they use, to their SCADA server, 189 189
collates that information, passes it to the billing system, 190 190
and then I get a bill. 191 191
That's how SCADA can be used in the real world. 192 192
Now, the third part of this we need to talk about 193 193
was Modbus. 194 194
Now, because ICS and SCADA are really focused 195 195
on operational technology, 196 196
they don't have to use things that we only use 197 197
in the IT world, but they have to have a way 198 198
to communicate with each other, and Modbus is that way. 199 199
Modbus is a communications protocol 200 200
that's used in operational technology networks. 201 201
So, in our IT networks, what do we usually use? 202 202
TCPIP, right? 203 203
Well, we don't have to use that 204 204
inside these OT networks, and often, we don't. 205 205
Modbus is instead what we use. 206 206
So, Modbus is going to give the control servers 207 207
and the SCADA host the ability to query 208 208
and change configurations of each PLC. 209 209
Now, this is important to know: 210 210
because this is more of a proprietary protocol, 211 211
it looks different than TCPIP. 212 212
So, if you're trying to do an instant response 213 213
and you think somebody's in your ICS SCADA network 214 214
and you've been studying how to do TCPIP your entire life, 215 215
are you going to know what you're looking at? 216 216
Most likely not. 217 217
And that's why there are experts in ICS and SCADA systems, 218 218
because it is a different way of thinking. 219 219
It is a different way of communicating, 220 220
and they use a different protocol. 221 221
So, keep that in mind. 222 222
If you're dealing with an ICS or SCADA network, 223 223
it is different, and you have to follow different ways 224 224
of doing things, because a lot of your normal tools 225 225
that you would use for ethernet and TCPIP either won't work 226 226
or they could cause damage.