Direction of Security Monitoring for Substation Automation Systems

Abstract

All security measures which have been proposed ultimately come under three security strategies: network separation, communication message security, and security monitoring. However, considering the recent sophisticated attacks against SCADA/ICS systems, these security strategies cannot provide sufficient security measures. These attacks try to hijack or take control of host systems, control servers and eventually control devices, once they penetrate the networks in one way or another. Their attack vectors are the vulnerabilities of the software underlying the host systems. The attack was realized by injecting malicious codes into legitimate process memory and executing the malicious codes in the context of a legitimate process, and eventually cause malfunction of field devices. In this respect, we need a security measure running on host systems which can provide the process and file protection related to legitimate usage of memory ranges and file paths. The measure can provide a holistic security strategy for SCADA systems including substation automation systems.

Keeping Host Sanity for Security of the SCADA Systems

“…Even though these three strategies give us a holistic approach to SCADA security, recent attacks on SCADA/ICS systems such as Stuxnet, Black Energy 3, Triton, and Industroyer make us realize that these strategies are necessary but not sufficient. The nature of these attacks is that once attackers penetrate the SCADA network, they take control of host systems by process manipulation, whether they are control servers or local device controllers [7]. Moreover, attackers use specially designed malware for SCADA to invade the core system of SCADA and achieve their attack goals [8], [9].…”