Sergey Gordeyhcik-Industrial CyberSecurity Mission Centric Approach-工業(yè)互聯(lián)網(wǎng)安全論壇

employee

IndustrialCyberSecurity

MissionCentricApproach

SergeyGordeyhcik

SCADAStrangeLove

ResearchTeam

WWW.SCADA.SL

GroupofsecurityresearchersfocusedonICS/SCADA

AlexanderTimorin

DmitrySerebryannikov

SergeyDrozdov

AlexanderTlyapov

DmitrySklyarov

SergeyGordeychik

AlexanderZaitsev

EvgenyErmakov

SergeySidorov

AlexeyOsipov

GlebGritsai

SergeyScherbel

AndreyMedov

IlyaKarpov

TimurYunusov

ArtemChaykin

IvanPoliyanchuk

ValentinShilnenkov

DenisBaranov

KirillNesterov

VladimirKochetkov

DmitryEfanov

RomanIlin

VyacheslavEgoshin

DmitryNagibin

RomanPolushin

SergeyBobrov

YuriGoltsevYuriyDyachenko

tosaveHumanityfromindustrialdisasterandtokeepPurityOfEssence

CYBERSECURITY?

INDUSTRIALCYBERSECURITY

Functional

Safetyand

Reliability

Industrial

Safety

Information

Security

Thesecretsofcybersecurity,ValentinGpanovich,EfimRozenberg,SergeyGordeychik.RailwayStrategies,Issue130

/schofieldpublishingltd/docs/railway_strategies_issue_130_june_2

THREATS?

THREATS?

/story/four-cyber-attacks-on-uk-railways-in-a-year-10498558

/technology/2016/jan/07/ukrainian-blackout-hackers-attacked-media-company

INTERCONNECTEDWORLD

32C3,Hamburg,TheGreatTrainCyberRobbery

220,558ONLINE,17,042INENTERPRISES

/analysis/publications/75343/industrial-cybersecurity-threat-landscape/

ICSONLINE:CHINA

ICSONLINE:CHINA

/blog/2016/03/census-scanning-from-siemens-s7-plc-cpustatus/

GREATERCHINA

~10,000OF“SMART”POWERGRIDOBJECTS

?GREENENERGY

?SMARTGRID

?DIGITALSUBSTATIONS121,000KMOFRAILWAYS

?19,000KMOFHIGH-SPEEDLINES

?HIGHLYAUTOMATED

?NATIONALHIGH-SPEEDRAILGRID(4+4)

DIGITALSUBSTATIONTAKEOVER

CTF-STYLEWHITEHATINDUSTRIALCHALLENGE

/press/news/41213/

DIGITALSUBSTATIONTAKEOVER:GOALS

?FINDVULNERABILITIESINIEC-61850SUBSTATIONS

?CREATEEXPLOIT

?TRIGGERCYBER-PHISICALATTACK

RelayProtection

/press/news/41213/

VULNERABILITIESINRELAYPROTECTION

REMOTECODEEXECUTION?

?togetfirmware?

?togetdebugsymbols?

?todebug?

?..PowerPC

?no“operationsystem”

CONFIRMATIONCODE“311299”

Toaccessthisinformation,theconfirmationcode“311299”needstobeprovidedwhenprompted."

...Siemensdoesnotpublishofficialdocumentationonthesestatistics.ItisstronglyrecommendedtoworktogetherwithSiemensSIPROTECcustomercareorcommissioningexpertstoretrieveandinterpretthestatisticsandtestinformation..."

DEVICEMEMORY

/2015/12/now-declared-capabilities.html

CODEREUSE

Linux

VxWorks6.x

61850Stack

MisfortuneCookie

SSHserver

Kudos@repdet@k_v_Nesterov@samincube

RAILWAYCOMPUTERBASEDINTERLOCKING

RAILWAYGSM-RISSUES

VULNERABILITIESOF(U)SIM

?Remotedatarecovery(Kc,TIMSI)

–Chaneldecryption(includingA5/3)

–?Clone?theSIMandmobilestation

?SIM“malware”

?BlockSIMviaPIN/PUKbrute

?ExtendedOTAfeatures(FOTA)

KarstenNohl,https://srlabs.de/rooting-sim-cards/

AlexanderZaitsev,SergeyGordeychik,AlexeyOsipov,PacSec,Tokyo,Japan,2014

LOCALVENDORS

INDUSTRIALCYBERSECURITY

Functional

Safetyand

Reliability

Industrial

Safety

Information

Security

Thesecretsofcybersecurity,ValentinGpanovich,EfimRozenberg,SergeyGordeychik.RailwayStrategies,Issue130

/schofieldpublishingltd/docs/railway_strategies_issue_130_june_2

MISSIONCENTRICAPPROACH

Industrialsafety:directlyaffectphysicalsafety.

Economical:decreaserailroadtrafficcapacityorotherquantitativeeconomicalcharacteristics(traindelays,localpoweroutage)

Reliabilityandfunctionalsafetyimpact:ICScrashes,outofservice,etc.

COMPUTERBASEDINTERLOCKING

1

2

FORMALREQUIREMENTS

CBI:THREATMODEL

1.Safety(CyberPhysicalThreats)

?setalessrestrictivesignallight

?operateaswitchwithatrainpassingoverit

?setconflictingroutes…

2.Economics(freightefficiency)

?CBICPUcrash

?Blockingofcontrol

?Falseindication…

3.Reliabilityandfunctionalsafety

?CBICPUreboot

?Networkcrash…

Signallingcybersecurity:theneedforamission-centricapproach

ValentinGapanovich,EfimRozenbergandSergeyGordeychik

/index.php/signalling/signalling-cyber-security-the-need-for-a-mission-centric-approach.html

FULLPICTURE

LETDOITTOGETHER!

?GOVERNMENT

REGULATORYAUTHORITIES

LAWENFORCEMENTS

CERTS

?RESEARCHERS

?ICSVENDORS

?SECURITYVENDORS

?OPERATORSOFCRITICALINFRASTRUCTURE

#SCADASOS

Q:WTFSACADSOS?

A:SCADASOS-(un)Secure

OpenSmartGridsisopen

initiativetoriseawarenesson

insecuritiesofSmartGrid,

PhotovoltaicPowerStations

andWindFarms.

Q:Howtoparticipate

A:FindInternet-connectedPV