DHS report recommends unidirectional communications for ICS protection

Three of the seven strategies in the December 2015 report from the DHS NCCIC/ICS-CERT, “Seven Strategies To Secure Industrial Control Systems,” recommend unidirectional gateways for maximum protection from cyberattacks.  

The report points to an increase in the frequency and complexity of cyber incidents. ICS-CERT received reports of 295 incidents in 2015, although it is believed that many more went unreported or undetected. Increasingly capable cyber adversaries who can, and have, defeated traditional IT-centric security protections perpetrate these attacks.

To mitigate this growing threat, the DHS encourages us to deploy technology to prevent these increasingly sophisticated attacks.

Seven Strategies to Defend ICSs

1. Implement Application Whitelisting (AWL) – When antivirus and malware detection tools fail, AWL can prevent execution of most malware.
2. Ensure proper configuration/patch management – Unpatched systems are low-hanging fruit for attackers. What the report does not point out is that patching is costly, and does little to deter sophisticated attackers, because of the large number of ICS zero-days waiting to be discovered. The report does point out that unpatched laptops connecting to ICS networks are a major infection vector. I agree with this latter point – any laptop or other equipment that is ever connected directly or indirectly to the Internet must be regarded as eventually compromised.
3. Reduce your attack surface – The report points out that real-time connectivity between ICS networks and less-trusted networks is best achieved using hardware-enforced unidirectional communication, such as Unidirectional Security Gateways.
4. Build a defendable network – Network segmentation can limit the damage from an intrusion and reduce cleanup costs by limiting how far the compromise can spread through the ICS network. Again, the report points out that the best design for transferring real-time data is unidirectional gateways.
5. Manage authentication – Adversaries increasingly focus on stolen credentials, especially for highly privileged accounts. Among other things, the report recommends employing separate credentials for corporate networks and industrial control system networks. I disagree. I think the report would have been more effective recommending much stronger perimeter protections to lock remote adversaries out entirely, even those with every password to every ICS computer in the building.
6. Implement secure remote access – The report recommends surveying and systematically removing vendors’ and other back doors that appear in the form of modems, DSL lines and other undisciplined connections to outside networks. The report also recommends unidirectional gateways to enforce “monitoring-only” access, such as Waterfall’s Remote Screen View product provides. The DHS cautions against reliance on “read-only” access enforced by software configurations; no such software provisions can be as safe or reliable as the hardware-enforced monitoring-only access of Unidirectional Security Gateways.
7. Monitor and respond – As always, the DHS recommends practiced intrusion monitoring, incident response, and system recovery capabilities.

 

The DHS cites the much-publicized and analyzed “Black Energy” malware as an example relating to direct or indirect Internet connectivity. Black Energy relies on a connection to a command and control center on the Internet. The malware uses this connection to receive instructions, download additional software – such as the “DiskWiper” cited in the Ukrainian intrusions – and report intelligence gathered about the layout of the ICS for use in future, more specific attacks.

The example could have been applied much more widely in the report. In particular, with Unidirectional Security Gateways as the sole connection between an ICS network and any external network, Black Energy’s connection to a command and control center is impossible. The gateways send information where they are configured to send it, not to random IP addresses on the Internet, or on the corporate network. In addition, the gateways, of course, permit no software downloads, remote control, or other instructions from a command and control center back into the protected network.

The report is short, and is very much worth reading.

To learn more about unidirectional security gateway technology and how it works to protect ICS networks, visit www.waterfall-security.com.

Electric sector security leaders Paul Feldman and Dan Hill recommend unidirectional gateways

Paul Feldman, director of Midcontinent ISO, and Dan Hill, board member for the New York ISO, recently published “Cybersecurity: IT vs. OT, and the Pursuit of Best Practices” in the January 2016 edition of Electricity Policy. The article reviews the state of control system security in the power grid and makes recommendations to improve security. A central recommendation in the article is that “it’s time for transmission and distribution companies to install unidirectional gateways between their SCADA/OT networks and their business networks.” At Waterfall Security, we are steadfast in maintaining that increased use of unidirectional security gateways will measurably improve the security and the reliability of the Bulk Electric System. It is rewarding to see these experts agree.

In their article, Hill and Feldman review ongoing efforts by the Federal Energy Regulatory Commission (FERC) and the North American Electric Reliability Corporation (NERC) to have industry regulations reflect the current threat landscape.  The authors point out that cybercriminal sophistication has outpaced the resulting regulations, and observe that:

“(A) special methodology to bridge IT and OT/ICS systems is now required in all nuclear plants,” the two authors wrote. “That methodology employs a hardware-based unidirectional gateway … to move data from the OT/ICS network to the IT/business network on a real-time basis.”

The article goes on to explain that using a unidirectional security gateway eliminates the threat of network attacks moving from an IT network into an industrial control system (ICS) network.

“Firewalls are also becoming more sophisticated and more complicated to manage,” the authors write. They continue, pointing out that “It’s an arms race between the firewall providers and attackers. Separate from the arms race, but related to whether the good guys or the bad guys can develop sophisticated software faster, there is also the bug issue. Firewalls are enabled by software, and software often contains bugs.” Firewalls are simply not adequate to deflect modern attacks on industrial control systems.

Hill and Feldman point out that adequate, modern ICS security is very different from doing the minimum to avoid a fine.  Unidirectional security gateways eliminate the threat of remote-control and other network attacks from business networks and from the Internet. Eliminating these threats entirely is far more effective than continuing a cat-and-mouse battle with attackers.

Unidirectional protections for electric generation (A white paper)

Waterfall Security Solutions released a new white paper describing how Unidirectional Security Gateways and related products are used in power generation applications. The white paper documents the big picture of how, where and why Waterfall’s customers are using the company’s products to protect generating networks. To my knowledge, this is the first time a comprehensive network architecture or use case for unidirectional protections of generating networks has been documented.

The various icons in the diagram depict either unidirectional security gateways, inbound/outbound gateways, the Waterfall FLIP or Waterfall’s Application Data Control add-on. Waterfall customers generally deploy this architecture because they have decided that the risk of an online attack from the corporate network or the Internet that could affect control systems, safety systems or protection systems is unacceptable. To address these risks, customers generally use unidirectional security gateways and related products to replace one layer of firewalls in their layered, defense-in-depth network architectures. With this layer in place, the chain of infection from the Internet and through corporate networks is broken.

Most customers deploy the layer of unidirectional protections at their plants’ IT/OT interfaces, separating plant networks or unit networks, from their corporate networks. The remaining customers generally deploy the unidirectional layer to protect safety-instrumented systems and networks of protective relays from plant and control networks.

In either case, the layer of unidirectional protections separates the most important plant systems from remote attackers. This results in dramatic reductions in cyber risk and the associated cost of risk. NERC CIP and other compliance programs are also very much simplified and reduced in cost, because the strong security of unidirectional protections means far fewer compensating measures need be deployed to reach security targets, and the NERC CIP and other standards increasingly recognize this. In addition, unidirectional gateways and related technologies deployed at the IT/OT connection require far less labor to maintain and monitor than do porous firewalls.

An ever-increasing number of customers are recognizing the benefits of unidirectional security gateways and related unidirectional protective technologies in power plants. Standards authorities agree. Power plants are, after all, not expendable, either to electric utilities or to society at large.

For more information about how unidirectional security gateways reduce threats to critical infrastructure, and to download a copy of the new white paper, check out our resources page.