Improving network security monitoring for industrial control systems

Abstract

Programmable Logic Controller (PLC) technology plays an important role in the automation architectures of several critical infrastructures such as Industrial Control Systems (ICS), controlling equipment in contexts such as chemical processes, factory lines, power production plants or power distribution grids, just to mention a few examples. Despite their importance, PLCs constitute one of the weakest links in ICS security, frequently due to reasons such as the absence of secure communication mechanisms, authenticated access or system integrity checks. While events such as the Stuxnet worm have raised awareness for this problem, industry has slowly reacted, either due to reliability or cost concerns. This paper introduces the Shadow Security Unit, a low-cost device deployed in parallel with a PLC or Remote Terminal Unit (RTU), being capable of transparently intercepting its communications control channels and physical process I/O lines to continuously assess its security and operational status. The proposed device does not require significant changes to the existing control network, being able to work in standalone or integrated within an ICS protection framework

From Detecting Cyber-Attacks to Mitigating Risk Within a Hybrid Environment

“…The PIDS encompasses several kinds of detection agents, including existing components (such as the Snort NIDS [35] or the OSSEC HIDS [36], which are customized and integrated using coupling adaptors) as well as components specifically developed for this architecture, like the SCADA Honeypot [30] [37], the Shadow Security Unit (SSU) [38], Host Output Traffic Control, or the Exec, Vulnerability and Behaviour checker agents [28]. Among these agents, the first two constitute innovative concepts for domain-specific components that will be next discussed in more detail, from a research point of view.…”

Integrated protection of industrial control systems from cyber-attacks: the ATENA approach

“…The ATENA architecture is based on the outcomes of both the MICIE [9] and the CockpitCI [10] projects. The goal of the aforementioned projects is the development of a security platform for inter-dependent CIs.…”

“…The PIDS agents are able to incapsulate customized third party modules (e.g., the Snort NIDS [12] or the OSSEC HIDS [13]), which are integrated using coupling modules), as well as components specifically developed for CockpitCI (e.g., the Shadow Security Unit (SSU) [10], the SCADA Honeypot [14] [15], Host Output Traffic Control, or the Vulnerability, Behaviour 6 and Exec checker agents [11]). The RP in CockpitCI represents an improvement with respect to the one developed in MICIE.…”

A Forensic Taxonomy of SCADA Systems and Approach to Incident Response

“…When an incident has occurred the additional hardware device could then be detached or SD card simply removed for data extraction and forensic analysis without the need to interact in any way with the PLC. To reduce the risk of interference with the wrapper or a network tap being placed between the field device and wrapper the additional hardware A similar concept, the SSU (Shadow Security Unit), has recently been put forth by T. Cruz (Cruz et al 2015), which implements a hardware device in parallel with SCADA field devices allowing for continuous assessment of their security and operational status. The SSU is a solution for improving the security within SCADA systems at the PLC level, whereas the forensic hardware wrapper proposed in this paper is more focused on the forensic recovery and increased data retention of field device artefacts post-incident.…”