Where and Why to Start Your ICS Security Journey

Security: Where and
Why do I start

PUBLIC | TechEd | #ROKLive | Copyright ©2019 Rockwell Automation, Inc. 3
Agenda
Why should we
be concerned?
Where do we
start?
What should we
do?

-Voltaire
“Everything’s fine today, that is our
illusion”

Why should we be concerned with ICS Security?

ICS-Focused Campaigns, Attacks, Frequency
20172010 2011 2012 2013 2014
STUXNET
Worm Targeting
SCADA and Modifying
PLCs
OPERATION
AURORA
APT Cyber Attack on
20+ High Tech,
Security & Defense
Companies
NIGHT
DRAGON
Advanced Persistent
Threat Targeting
Global Energy
SHAMOON
Virus Targeting
Energy Sector
Largest
Wipe Attack
RED
OCTOBER
Cyber-Espionage
Malware Targeting
Gov’t & Research
Organizations
FLAME
Virus use for
Targeted Cyber
Espionage in the
Middle East
DUQU
Worm Targeting ICS
Information
Gathering
and Stealing
GAUSS
Information Stealer
Malware
HAVEX
Industrial Control
System Remote
Access Trojan &
Information Stealer
HEARTBLEED
Security Bug and
Vulnerability
Exploited
by Attackers
2015 2016
BLACKENERGY
Malware Injected into
Ukrainian Power
Company Network,
Cut Power to the
Affected Region.
OP GHOUL
Spear-phishing
Campaign
Targeting Middle
East Industrial
Organizations
140
197
257 245
295
BLACKENERGY
Malware Injected into
Power Company
Network, Attackers Cut
Power to the Affected
Region.
ICS CERT INCIDENT COUNT
**Only Reported Incidents in U.S.
NOTPETYA
Ransomware Malware
Based
On Stolen NSA
Exploits that Impacted
ICS Systems
290
INDUSTROYER
Malware Targeting
Electric Utility – Used
in 2016 Ukraine Grid
Attack
WANNACRY
General ransomware
which impacted ICS
Systems

ICS THREAT ACTORS
Insiders
Cyber
CriminalsHacktivists
Nation
States Terrorists
> 40%
Cyber Events

ICS THREAT VECTORS
DMZ
Email, Intranet, Business Planning & Logistics Network
IT Network
OT Network
ICS Supply Chain
www
SIEM/SOC Servers
Remote
Maintenance
SCADA
Server Historian
HMI
PLC
Pump
Engineering
Station
Operator
Work Station
PLC
Actuator
PLC
Valve
PLC
Sensor
On-Site Maintenance
Direct Attack
on Plant
Network
Direct Attack
via
IT Network
USB
Indirect Attack
Sneaker-Net
(Compromised VPN)
(Compromised
Device)
VPN Device
External
Adversaries
Insider
Threat

What is Risk?

Safety and Security

Where do we start?

Strategic
 Develop an OT cybersecurity program
 Adopt an industry framework
 Understand business drivers and risk
tolerances to drive target profiles
 Conduct assessments to develop an
understanding of gaps
 Create an improvement plan to drive the
tactical approach
Tactical
 Execute on filling gaps as defined and
prioritized in the strategic approach
 Utilize validated designs and architectures
 Implement pre-engineered infrastructure and
software solutions to achieve targets
The Approach

Holistic View
A secure application depends on multiple layers of protection and industrial
security must be implemented as a system.
 Openness
 Flexibility
 Consistency

Methodology
Securing your operations environments with a risk based approach

OT vs. IT
Priority is on reliability
and integrity of the
system.
Priority is
pervasiveness of data
and confidentiality of
such data.
End-points are of
heterogeneous make and
task specific with long
lifespans
End-points are of
homogenous make and
multi-purpose with short
lifespans
Architectures are
ubiquitous in nature and
consist of mutli-tiered
systems to encourage
wide accessibility
Architectures are of
proprietary nature and
consist of isolated, task
specific systems.
Outcomes are physical
Outcomes are digital

Compliance & Standards
Certified Products, Architectures and Solution Delivery
Applies to those responsible for designing, manufacturing, implementing, or managing
industrial control systems:
 End-users (i.e. asset owner)
 System integrators
 Security practitioners
 ICS product/systems vendors
ISA/IEC 62443: Series of standards that define procedures for
implementing electronically secure Industrial Automation and Control
Systems (IACS).
*Equivalence to ISO 27001 and NIST Cybersecurity Framework

Rockwell Automation’s Approach
Addressing Cybersecurity Concerns
With an ever evolving threat landscape, companies must look at security holistically, one that
involves a multi-layer, risk-based approach and addresses people, process and technologies.
Strategic
Advisor
IT/OT Security
Practitioner
Trusted
Supplier
We can help you develop a
strategic risk management program
focused on balancing objectives
and tolerance in alignment with
industry standards and
frameworks.
Industry-leading
Partners
Leverage our deep expertise to
realize the Connected
Enterprise through an
expansive set of consultative
and managed services.
Solutions and product
providers must consider
security throughout the
product lifecycle in alignment
with industry standards.
Our partner ecosystem
consists of security expertise
and technologies to help
address security concerns
holistically across the
enterprise.

BEFORE
Identify & Protect Detect Respond & Recover
Asset Inventory
Services
Qualified Patch
Management
Vulnerability and
Risk Assessments
ICS Security Zone and
Countermeasure
Deployment
Real-Time Threat
Detection Services
Remote Monitoring and
Administration Services
Backup and Recovery
Solutions
Incident Handling
and Response
Incident Response and Disaster
Recovery Planning Services
BUILD A SECURE, ROBUST, FUTURE-READY NETWORK FOR YOUR CONNECTED ENTERPRISE
DURING AFTER
ASSESS DESIGN IMPLEMENT MONITOR
Strategic Advisor and Security Practioner

Risk Assessment
Cloud Governance
Council
Mandatory USB Training
Secure Development
Environment
Insider Risk Program
Cyber Tabletop
Exercises
Product
Security Office
Third Party Risk
Management Program
Trusted Supplier
Focus on Customer Security

Trusted Supplier
Security Built-in
Vendors must build security into
products with a focus on security
throughout the products lifecycle…
 Product Security Office
 Secure Development Lifecycle

Trusted Supplier
New Security Capabilities
Secure communications with EtherNet/IP
 Authentication – helps prevent unauthorized devices from
establishing connections
 Integrity – helps prevent tampering or modification of communications
 Confidentiality – helps prevent snooping or disclosure of data
Notable features:
 System management
 Easily create and deploy security policies to many devices, all at once
 Micro-segmentation
 Segment your automation application into smaller cell/zones.
 Device-based firewall
 Enable/disable available ports/protocols of devices (ie./ HTTP/HTTPS)
 Legacy Systems Support
 Whitelisting – authorize specific communications based on IP address
 Retrofit 1756 based systems with the new 1756-EN4TR
 Leverage a “proxy device” in front of legacy products (Future)
FactoryTalk®
Policy Manager
Software
FactoryTalk®
Directory
PC Connections
Via FactoryTalk® Linx
Device Communications
With EtherNet/IP
System Components
Security Admin

Industry-Leading Partners
Complimentary Solutions
Rockwell
Automation
Integrated Control
& Information
Cisco
Wireless, Security,
Switching & Routing
Panduit
Physical
Layer Network
Infrastructure, Zone
Enclosures
VMware
Data Center
Virtualization
ROCKWELL AUTOMATION & PARTNER PORTFOLIO
Microsoft
Operating Systems,
Database / Cloud
Infrastructure, &
Application Security
PartnerNetwork™
program
Alliances,
Encompass™ partner,
Distributors, System
Integrators, OEMs
Claroty
Industrial Control
System Threat
Detection

Converged Plantwide
Ethernet
Reference
Architectures
Industry-leading Partners
24
Tested and
Validated
Architectures
As plants invest in the modernization of their
network architectures, internal and external
security drivers are pushing companies to
invest in pervasive security solutions beyond
the traditional firewall.
• Extend visibility of proven IT security
technologies and tactics to the OT
network.
• Leverage IT competencies of existing
team with tools they know and trust.
• Enable alignment between not only IT
and OT, but also with solution and
machine providers.

What should I do?

Network Infrastructure Networks
 Converged Plantwide
Architecture
 Co-developed with Cisco
leveraging Industry
Standards and best
practices (NIST, IEC, etc.)
 DMZ Servers as
demarcation point
 Full portfolio of Stratix®
Managed and Lightly
Managed switches
Security Appliances
 Cisco Firewalls
 Stratix® 5950 Cell/Zone
Firewalls
Level 3.5-4
DMZ /
IT Network
Level 3
Site Ops
Network
Level 2
Area
Supervisory
Network
Level 0-1
Controller /
Sensor
Network
Site Network
IDMZ
Firewalls
Maint. Laptop
EWS
Infrastructure &
Automation Servers
Proxy Services
Enterprise Services Security Operations
OT Core Switch
IT Core Switch

Cisco Security Integration
Enterprise Integration
 FactoryTalk® Network
Manager™ Software
 IPS/IDS with FirePower
 Network Access Control:
Identity Services Engine
 Netflow Analysis:
Stealthwatch
Level 3.5-4
DMZ /
IT Network
Level 3
Site Ops
Network
Level 2
Area
Supervisory
Network
Level 0-1
Controller /
Sensor
Network
Site Network
IDMZ
Firewalls
Maint. Laptop ISE Policy Node
Infrastructure &
Automation Servers
Proxy Services
OT Core Switch
IT Core Switch
FTNM

Asset Management Asset Inventory
 FactoryTalk® AssetCentre
Software
 Claroty
Vulnerability Management
Disaster Recovery
 Automated back-up
 Application change
detection
Reporting
Level 3.5-4
DMZ /
IT Network
Level 3
Site Ops
Network
Level 2
Area
Supervisory
Network
Level 0-1
Controller /
Sensor
Network
Site Network
IDMZ
Firewalls
Maint. Laptop
FactoryTalk®
Asset Centre
FactoryTalk®
Directory
Proxy Services
OT Core Switch
IT Core Switch
Claroty Platform
Passive
Active

Patch Management Operating System Patching
 Patch Qualification Testing
Lab
 Delivery of a curated set of
Windows patches catered
to your specific Rockwell
Automation software and
operating system
combination
 Remote Patch
Administration Services
Level 3.5-4
DMZ /
IT Network
Level 3
Site Ops
Network
Level 2
Area
Supervisory
Network
Level 0-1
Controller /
Sensor
Network
Site Network
Supply Chain
(Third Party Vendors)
IDMZ
Firewalls
Maint. Laptop EWS
Infrastructure &
Automation Servers
Proxy Services
Enterprise Services
RA Azure WSUS
OT Core Switch
IT Core Switch
OEM Laptop
OTSecurity
Services
Remote Support Cloud
(Microsoft Azure)
Plant
WSUS/SCCM
Microsoft

Authentication and Authorization Windows Domain Architecture
 Active Directory
 Authentication Best
Practices
FactoryTalk® Security
 Integration into Windows
Domain Architecture
 Authentication and
Authorization services for
FactoryTalk® and Studio
5000® Software
 Local and Centralized audit
trail
Remote Access
 Secure Vendor Access
Level 3.5-4
DMZ /
IT Network
Level 3
Site Ops
Network
Level 2
Area
Supervisory
Network
Level 0-1
Controller /
Sensor
Network
Site Network
IDMZ
Firewalls
Maint. Laptop
FactoryTalk®
Asset Centre
FactoryTalk®
Directory
Proxy Services
OT Core Switch
IT Core Switch
Active Directory
1
2
3
Secure Remote
Access Server
EWS

Computers & Endpoint Protection Anti Virus and Application
Whitelisting
 Symantec Endpoint
Protection
 Symantec Critical Systems
Protection
Thin clients and Content
Management
 Reduced attack surface
 Centralize OS management
 Enhanced authentication
capabilities
Level 3.5-4
DMZ /
IT Network
Level 3
Site Ops
Network
Level 2
Area
Supervisory
Network
Level 0-1
Controller /
Sensor
Network
Site Network
IDMZ
Firewalls
Maint. Laptop
Secure Remote
Access Server
Infrastructure &
Application Servers
Proxy Services
Enterprise Services RA Azure WSUS
OT Core Switch
IT Core Switch
WSUS

Threat Detection Threat Detection Services
 Inventory to Baseline
 Real-Time alerting on
deviations
 Incident Response
Planning
 Remote Support Services
Level 3.5-4
DMZ /
IT Network
Level 3
Site Ops
Network
Level 2
Area
Supervisory
Network
Level 0-1
Controller /
Sensor
Network
Site Network
Supply Chain
(Third Party Vendors)
IDMZ
Firewalls
Maint. Laptop EWS
Infrastructure &
Automation Servers
Proxy Services
Enterprise Services
Remote Support Services
OT Core Switch
IT Core Switch
OEM Laptop
OTSecurity
Services
Threat Detection
Platform

Industrial Security Landing webpage
http://rockwellautomation.com/security
Security Resources
Security
Advisory Index
Microsoft Patch
QualificationReference
Architectures
secure@ra.rockwell.com
Services Services
Security Technology
Security FAQ

Integrated Architecture® System from Rockwell Automation
Addresses OT Cybersecurity
Leveraging a multi-layer, risk based approach.
Strategic
Advisor
IT/OT Security
Practitioner
Trusted
Supplier
Industry-leading
Partners
DURINGBEFORE AFTER
PEOPLE,
PROCESS,
AND
TECHNOLOGY

Share your feedback
Please complete the session
survey on the mobile app
Select TechEd and login
Use your email and last name that
you used to register for the event.
Click on Schedule on the main
menu
• Select the session you are attending
• Click on the survey tab
• Complete the survey and submit
2
3
Download the Events ROK
mobile app
1

www.rockwellautomation.com
Thank you

Where and Why to Start Your ICS Security Journey

Recomendados

Recomendados

Mais conteúdo relacionado

Mais procurados

Mais procurados (20)

Semelhante a Where and Why to Start Your ICS Security Journey

Semelhante a Where and Why to Start Your ICS Security Journey (20)

Mais de Rockwell Automation

Mais de Rockwell Automation (20)

Último

Último (20)

Where and Why to Start Your ICS Security Journey