Security Intelligence for Energy Control Systems
Download as PPTX, PDF0 likes766 views
This document summarizes a presentation on security intelligence for energy control systems. The presentation covers introductions, vulnerabilities in smart grids and appliances, security incidents involving energy systems like Stuxnet, risks facing energy companies, log monitoring best practices, and compliance strategies. The presentation aims to help energy companies identify advanced persistent threats, comply with regulations, and improve security through iterative log review and defense improvements.
Security Intelligence for Energy Control Systems
- 1. Security Intelligence for Energy Control Systems Chris Poulin Q1 Labs, CSO David Swift Accuvant, Solutions Architect Twitter: #Q1energy
- 2. Agenda Introductions and Housekeeping When Refrigerators Attack Smart Grid – Vulnerabilities and Security Concerns Energy Sector Zero Days and Logs Compliance – Best Practices Q&A #Q1energy
- 3. A man is stuck in traffic on his way to work. #Q1energy
- 4. He takes his eyes off the road to glance at his phone. #Q1energy
- 5. Did I leave the fridge open? #Q1energy
- 6. The man taps an app on his smart phone labeled “Home Automation” #Q1energy
- 7. #Q1energy
- 8. #Q1energy
- 9. Man rolls his eyes and grins at his own obsessive concern #Q1energy
- 10. #Q1energy
- 11. #Q1energy
- 12. #Q1energy
- 13. #Q1energy
- 14. Level Setting: What is the Power Grid? #Q1energy
- 15. Smart Grid Goals #Q1energy
- 16. Smart Grid Goals #Q1energy
- 17. Smart Grid Goals #Q1energy
- 18. Smart Grid #Q1energy
- 19. Smart Grid #Q1energy
- 20. Smart Grid #Q1energy
- 21. Smart Grid Benefits—Utility Side #Q1energy
- 22. Smart Grid Benefits—Utility Side #Q1energy
- 23. Extending the Grid—Into Every Home #Q1energy
- 24. Smart Grid Benefits—Consumer Control #Q1energy
- 25. Smart Grid Attacks / Vulnerabilities #Q1energy
- 26. Smart Grid Attacks / Vulnerabilities #Q1energy
- 27. Notable CIP Security Incidents #Q1energy
- 28. Notable CIP Security Incidents: Stuxnet #Q1energy
- 29. Notable CIP Security Incidents #Q1energy
- 30. Notable CIP Security Incidents #Q1energy
- 31. Smart Grid Attacks / Vulnerabilities #Q1energy
- 32. Smart Meter Event Monitoring #Q1energy
- 33. Smart Meter Event Monitoring #Q1energy
- 34. Increased Risk @ Energy Companies #Q1energy
- 35. CIA? No, AIC #Q1energy
- 36. Side Channel Security Information #Q1energy
- 37. 3rd Party Power Monitoring #Q1energy
- 38. Physical Security Information #Q1energy
- 39. Takeaways #Q1energy
- 40. SIEM Services Energy & Utilities David Swift Solutions Architect Accuvant
- 41. Energy Sector Top Concerns APTs – Advanced Persistent Threats Morphing code, DNS fast flux changing Command and Control Channels, Google searches for new C&C hosts May be state or terrorist sponsored, lots of money and resources behind some of these attacks Compliance – NERC/FERC/NRC/SOX/PCI Log, review, report and DOCUMENT #Q1energy
- 42. How do you find Zero Days and APTs? Add Context to Events Use the network hierarchy and remote networks to overly quick source network and destination network NAMES, not just IP addresses. Use GEO IP information for quick wins and situational awareness. Use Reference Lists to check for known attackers, known terminated employees, contractors logging in after hours… #Q1energy
- 43. Review Logs Analyze Volume and Variety Firewall Even when signatures don’t trigger, firewalls (when configured to log accepts), provide a record. Attacks are sloppy, not single event, look for the spray of bullets, Offender Source IP scans the network or target first with lots of drops. IDS/IPS Log Everything Filter and eliminate in SIEM by comparing Vulnerability Scan/Asset data and Known Attacker/Remote Networks #Q1energy
- 44. Review Logs Look for patterns Instant messaging logon (IDS event) IM download (IDS Event) Anti-Virus/HIPS/FIC event – EVIL FILE Now we know the source. Fuzz the logic – Look for anyone else talking to the same source /24 CIDR – Look for the same file name to have been modified on another host Any Traffic to/from a Known Attacker (remote network or reference list) Traffic outbound may indicate an already infected system calling home Any traffic from that is allowed should open an offense #Q1energy
- 45. Review Logs Everything counts in large amounts Single firewall drop – who cares? 100 firewall drops in 1 minute – Why? Misconfigurations – noise, chaff that has to be culled Reconnaissance – phase one of the attack One IDS event – IM Login – Who cares? IM Login + File Transfer + Buffer Overflow Attempt – I CARE! #Q1energy
- 46. Improve Defenses Iteratively Review Events by Signature Count of HOW MANY this month by signature And, how many unique hosts triggered the sig 10 from one host – hmm, block it, won’t break anything, might help, and check the host 1,000,000 – disable logging, crappy signature – Unless – 1Million from < 10 hosts 0 events for a given signature – block it, won’t hurt Repeat the process each month for each device #Q1energy
- 47. Compliance Strategy A successful log management strategy involves a logging tool, documentation, processes, and procedures. Key Steps: Define your Scope Document which devices are in scope for each compliance regulation Define your Events of Interest (EOI) – and create appropriate reports and alerts to monitor for them Define an Incident Handling Policy (IH) and process to follow for each EOI Define Standard Operating Procedures (SOPs) with Service Level Agreements (SLAs), for each EOI and follow up IH process Create and Maintain an Audit trail showing both EOI’s and IH responses, tracking the mean time to detect (MTD) and mean time to remediate (MTR) Define the Record of Authority (RoA) for each device in scope for an audit Document IP’s in scope and where the authoritative log source is for each. Document the retention period, and the auto-destroy policy followed. #Q1energy
- 48. Thank You!
Editor's Notes
- #49: Defenses are never complete, and must be continuously tuned.
- #50: By providing unambiguous prepared and documented sources, events of interest, and incident handling policies to auditors followed by spot checks to confirm both an event was logged, and remediated in accordance with standard operating procedures within the define service level agreement, audits can be made quite quick and painless.