Reports highlight cybersecurity risks at nuclear facilities around the world

Recent reports from the Nuclear Threat Initiative and Chatham House, both find that nuclear facilities in many countries are “easy targets for cyberattacks.” Among problems cited in the reports are a significant nuclear presence, few government regulations, and inadequate or corrupt oversight of nuclear facilities.

The reports highlight important issues, but are disappointing in that they provide little insight into the raw data used to draw their conclusions. Both reports talk about regulations existing in some jurisdictions and not in others, and also cite cybersecurity elements of regulations in some jurisdictions, but not others, but provide no sources. References to the regulations examined by the authors would help everyone interested in a deeper understanding access those regulations to understand them better.

The reports do highlight an important fact – for all the talk of cybersecurity vulnerabilities, many of the older reactors in the world are still controlled with analog controls, and those controls are immune to digital cybersabotage/compromise attempts. Newer reactors though, use digital controls and so are of greater concern. And even those reactors with analog controls for the reactor core may use digital controls for other aspects of the reactors, such as controls for cooling equipment. It was after all, cooling equipment that was damaged in the Fukishima tsunami, and whose failure ultimately resulted in explosions and the release of large amounts of radioactive materials.

Cyberattack tools, like any other software, continue to evolve and develop more features. As a result, cybersecurity attacks only become more sophisticated over time. What is today’s “advanced attack” is tomorrow’s script-kiddie tool. Nuclear generators should be leading the way for both physical and cybersecurity for industrial control systems. All industrial sites should be looking to the attacks of concern to nuclear generators and the defensive systems being deployed to deflect such attacks. What is of concern today to only nuclear sites will be every ICS site’s problem in only a handful of years.

Physical and cybersecurity at nuclear sites is a difficult problem. At Waterfall Security Solutions, we are proud to be part of the cybersecurity solution at nuclear generators throughout the USA, as well as in Japan, South Korea and Spain. Waterfall’s Unidirectional Security Gateways block 100 percent of network attacks originating on external networks at nuclear generators in these and other jurisdictions.

For more information on best practices for securing critical infrastructure, visit our Resources page.

January news roundup: Ukraine power grid cyberattack illuminates risk to critical infrastructure

It’s no surprise the cyberattack on Ukraine’s power grid dominated industrial control system (ICS) cybersecurity news in January. Following the news of the power outages and subsequent discovery of malware and other signs of a purposeful network intrusion, cybersecurity experts, DHS and others have revealed alarming instances of cyberattacks, increasing vulnerabilities and lack of adequate cyberdefenses at industrial and nuclear sites, dams and other critical infrastructure. Perhaps the Ukraine attack is the wake up call the industry needs to escalate its investment in cybersecurity protections, such as Unidirectional Security Gateways. In the meantime, learn more in our roundup of these stories below.

Confirmation of a Coordinated Attack on the Ukrainian Power Grid (SANS, Jan. 9, 2016)

With all security eyes on the Ukraine’s Prykarpattyaoblenergo utility, SANS ICS concluded hackers likely caused the outage by remotely switching breakers, after installing malware that prevented technicians from detecting the intrusion. The key takeaway is that malware may have enabled the attack, but it was hackers’ remote access to critical operational networks that resulted in the outage. 

U.S. official sees more cyber attacks on industrial control systems (Reuters, Jan. 13, 2016)

While presenting at the S4x16 conference in Miami, Marty Edwards, head of the DHS ICS-CERT, cited increased Internet connectivity and associated vulnerabilities as the main reason behind the rise in cyberattacks on ICS networks. Others aren’t convinced, believing the recent Ukraine power grid attack has prompted authorities to look for signs of intrusion that may not necessarily be intentionally harmful events. From our perspective, any external intrusion – or even attempted intrusion – of ICSs is potentially harmful and should be taken seriously. Further, there is no doubt whatsoever that connecting critical infrastructure directly to the Internet or indirectly to Internet-accessible networks creates significant vulnerabilities.

Nuclear Facilities in 20 Countries May Be Easy Targets for Cyberattacks (New York Times, Jan. 14, 2016)

According to a distressing report by the Nuclear Threat Initiative, 20 nations have no apparent government regulations requiring minimal protection of nuclear power plants or atomic stockpiles against cyberattacks. The U.S. and many other countries have adopted strong security postures including physical security measures, removable device controls, and Unidirectional Security Gateways. This is standard practice in many jurisdictions and is something that should become standard worldwide for nuclear facilities.

Cybersecurity:IT vs. OT, and the Pursuit of Best Practices (Electricity Policy, January 2016)

In this article, industry experts, Paul Feldman, director of Midcontinent ISO, and Dan Hill, board member for the New York ISO, explore the new threats to our power systems. They point out that cybercriminal sophistication has outpaced the resulting regulations and urge the Federal Energy Regulatory Commission (FERC) and the North American Electric Reliability Corporation (NERC) to establish industry regulations that reflect the current threat landscape. Hill and Feldman point out that adequate, modern ICS security is very different from doing the minimum to be in compliance and recommend the use of unidirectional security gateways to eliminate the threat of remote-control and other network attacks from business networks and from the Internet.

NSA Hacking Chief: Internet of Things Security Keeps Me Up at Night (MIT Technology Review, Jan. 28, 2016)

Rob Joyce, chief of the NSA’s Tailored Access Operations unit, shook up the SCADA security community when he stated, “SCADA security is something that keeps me up at night.” Referring to the thousands of ICSs, such as power plants and other critical infrastructure, that are connected to the Internet without proper protections in place, Joyce singled out heating and cooling systems as examples that nation-state hackers can use to infiltrate control systems. He knows this to be true since these same systems are used as points of ingress by his own team. As alarming as this seems, it’s the reality we face as more and more industrial control systems are connected to the Internet.

To learn more about the risks facing industrial control security networks, visit our resources page.

Frost & Sullivan recognizes Waterfall Security Solutions for Customer Value Excellence through Technology Convergence for 4th consecutive year

For the fourth year in a row, Frost & Sullivan has recognized Waterfall with a Customer Value Excellence through Technology Convergence award.

This honor is awarded to a company that exhibits exceptional technology convergence impact and customer impact, proving the company’s ability to have consistent growth potential, ROI benefits and a significant impact on the security industry.

Ashay Abbhi, senior analyst at Frost & Sullivan, said, “Frost & Sullivan considers Waterfall’s pioneering solution to potentially become the standard in cybersecurity across industries, brought about by its disruptive technological convergence to secure the most vulnerable and sensitive point of attack – the data.”

Highlighted in the solution assessment is Waterfall’s Application Data Control (ADC) solution, which provides fine-grained policy controls for data in motion through Waterfall’s Unidirectional Security Gateway and FLIP products. The ADC add-on provides in-line controls for data movement, content restrictions, in-line anti-virus scanning and other/custom scanning and verification of files, BLOBs and any suspect or sensitive content. ADC controls can be applied to support data exfiltration prevention as well as powerful controls over data permitted back into critical networks.

“Waterfall enables safe IT/OT integration while ensuring the amalgamation of data from these silos is secured and the vulnerability removed by moving the data in only one direction instead of the customary bidirectional movement,” Abbhi added.

We’re honored to have earned Frost & Sullivan’s recognition once again. This award is testament to the needs for stronger-than-firewall security solutions for industrial control systems and further validates our product and commitment to safeguarding these important assets.

To learn more about our technology and how it protects ICS, visit our Resources page.

Protecting Generating Networks with Unidirectional Security Gateways

There was a day when the most common question heard while demonstrating a Unidirectional Security Gateway at an electric-sector trade show was "What's that?” Today, most electric-sector security practitioners are aware of unidirectional gateway technology and its advantages over firewalls in one circumstance or another, but many are still unclear as to what a unidirectionally-protected "big picture” network looks like. In this article, we describe the network architecture we see deployed routinely to protect power plant control networks. A simplified version of the network is illustrated below.

The design strategy behind this architecture is simple - replace at least one layer of firewalls in the layered, defense-in-depth network with unidirectional gateways, thus protecting our most important control system components from network attacks originating on less-trusted networks, such as corporate networks and the Internet.

Safe IT/OT Integration

The vast majority of power plants choose the IT/OT firewall layer as the layer to replace with stronger unidirectional protections. Cross-zone communications at this layer serve many functions. In the discussions below, each IT/OT integration function is considered independently. In practice, many or all of these functions are combined into a single set of Unidirectional Security Gateway equipment. Let's look at each of the functions in turn.

Primary IT/OT Interface: The primary IT/OT interface is used to monitor real-time operations continuously for purposes such as predictive maintenance, operations optimization and widespread awareness of key performance indicators. The majority of unidirectionally-protected power plants deploy Unidirectional Security Gateways at this interface, but newer installations also use the Waterfall FLIP at this interface, and it is a FLIP that is illustrated in high-level diagram above. For readers unfamiliar with gateways or the FLIP:

• A Unidirectional Security Gateway is hardware that is physically able to transmit information in only one direction, coupled with software that makes copies of industrial servers, most often process historian databases, or various types of OPC servers. Users and applications on the corporate network needing access to real-time data can query the replicas for that data.
• A Waterfall FLIP is a kind of unidirectional gateway whose orientation can reverse on a schedule. A FLIP can physically send information in only one direction at a time, and makes copies of industrial servers just like the gateways do.

At unidirectional-gateway sites, security updates are communicated to plant networks on removable media - most commonly write-once CD's. At FLIP sites, the FLIP is configured to pull such updates automatically, on a schedule.

Vendor Monitoring: The majority of coal, gas and hydro plants have remote connections to their turbine vendors for vendor monitoring and diagnostics, and many have similar connections to other vendors as well. These vendors monitor physical equipment or control-system components continuously, and adjust system parameters from time to time. Unidirectionally-protected plants meet the monitoring need with server replication; the vendors monitor the replica servers. Most unidirectionally-protected plants meet the "occasional adjustment" need with remote screen view technology. Remote screen view makes a real-time feed of screen images available to vendor support personnel, while site personnel operate control system equipment. The vendors generally advise plant personnel over the phone throughout these adjustments.

Generation Dispatch Center: Most power plants need to report power production and other parameters to a generation dispatch center continuously. A minority of plants has production schedules set far into the future; such plants can deploy unidirectional gateways to replicate ICCP servers to permit continuous monitoring by dispatch centers. The majority of plants not only report their status continuously to a dispatch center, but receive second-by-second updates of power production set points from that center as well.

Some such plants lease serial lines to exchange ICCP information with dispatch centers, but a more secure solution is a pair of "inbound/outbound" unidirectional gateways replicating ICCP servers. Inbound/outbound gateways are two independent unidirectional gateway deployments, each replicating an ICCP server in one direction. The inbound gateway polls the dispatch center’s ICCP server and emulates that server to plant systems. The outbound gateway polls the plant ICCP server and emulates that server to the dispatch center EMS. These two channels are generally deployed on different sub-networks and are unable to communicate with each other, though both are able to communicate with control center and plant ICCP servers.

Cloud Providers: Communications with cloud services is similar to communications through the primary IT/OT interface, and is called out separately in the diagram because of the high degree of interest in this emerging field for power plants. Communications with cloud service providers may be via unidirectional gateways, or if occasional updates from cloud applications are necessary, may be via the FLIP as well.

Safety and Protection Systems

In some cases, owners and operators decide they wish to continue to use firewalls at the IT/OT interface, but still need safety instrumented systems and protective relays protected unidirectionally. Such plants always deploy unidirectional gateways at the interface between control networks and the safety & protection networks. Unidirectional gateways poll safety and protection devices and emulate those devices to control systems. This design provides for continuous monitoring of the status of safety systems and equipment protection systems without any risk of a network attack pivoting through intermediate systems and networks in order to reconfigure, reprogram, disable or otherwise compromise safety systems and protective relays.

Benefits of Unidirectional Protections

The primary driver for deploying a unidirectionally-protected network is improved security and cyber-threat risk reduction. The biggest cyber threat to power plants is not random, accidental side-effects of infections by high-volume malware, but targeted attacks. When an individual or group deliberately targets a site, they design their attack to bring about as much damage as possible, at a time as inopportune as possible for the targeted site. By far the biggest attack vector for these modern, targeted attacks is interactive remote-control attacks, across the Internet, pivoting through intermediate networks, connections and systems and breaching intermediate firewalls. Unidirectional Security Gateways and related technologies defeat these interactive remote control attacks, as well as more conventional network virus, worm and insider attacks.

A secondary driver in North America, France, Israel and other jurisdictions with cyber security regulations in place, is reduced compliance costs. The NERC CIP V5 and proposed V6 standards for example, have 37 additional, costly “external routable connectivity” rules that large medium-impact power plants must follow when they use firewalls, rules that do not apply to plants protected exclusively by Unidirectional Security Gateways.

An additional driver for unidirectional gateway deployments is operating cost reductions. Power plant IT/OT firewalls tend to be complex: many streams of data, applications and users are typically configured to reach through the firewall to request data from plant systems. Maintenance of these complex firewall configurations is costly, because of the risk that any error in configuration might relax firewall protections unacceptably. Monitoring of firewall logs and communications through firewalls is even more costly, but such monitoring is essential, because of the very real risk that some attack will breach the firewall.

In contrast, Unidirectional Security Gateways and related technologies are generally deployed to replicate a number of servers in whole or in part, and these configurations rarely change. Furthermore, even if unidirectional configurations change over time, unidirectional gateway technologies do not forward messages, and the physical, unidirectional, remote-control-defeating nature of the gateways makes them intrinsically safer than firewalls. As a result, gateway deployments do not warrant the same degree of continuous, costly scrutiny that is mandatory for firewalls.

Looking Forward

Unidirectional communications technologies are an idea whose time has come. Control system security standards all over the world are being updated to reflect the strength of unidirectional protections. Industrial control system owners and operators in all industries are considering and deploying unidirectional gateways to dramatically improve the security posture of their industrial control system networks.

Waterfall Security Solutions has published a whitepaper describing this power plant network architecture in detail, and has network architecture whitepapers in progress for other parts of the electric sector, and for other industries as well. For the full whitepaper, please contact me at andrew.ginter@waterfall-security.com.