Defense in Depth: Layering Multiple Defenses - Part 2 of 2

In my earlier column on the philosophy of Defense in Depth, I discussed how relying on a single defensive solution exposes a system to a single point of failure. No matter how well designed or strong that single defense is, either resourceful adversaries or Murphy’s Law eventually results in the defense malfunctioning or being bypassed. When that happens, the entire system is wide open to attack.

A far more effective strategy for reliable security is called “Defense in Depth”. Today’s blog will discuss what this actually means in the real world of SCADA and ICS security.

Back to the Basics

The Defense in Depth strategy is not something unique to ICS/SCADA security. In fact, it is not even unique to cyber security. It is a military strategy that has been around since days of the Romans. If you search the Internet the first definition you will find is the military one on Wikipedia:

Defense in depth (also known as deep or elastic defence) is a military strategy; it seeks to delay rather than prevent the advance of an attacker, buying time and causing additional casualties by yielding space. Rather than defeating an attacker with a single, strong defensive line, defence in depth relies on the tendency of an attack to lose momentum over a period of time or as it covers a larger area.

Defense in Depth for Banking Security

Unfortunately, if you want to secure your control system, the above definition doesn’t help you much. So let’s look at security in a bank and see what we can learn.

Ever wonder what it is that makes a typical bank so much more secure than a home or convenience store? It’s not because banks have stronger steel doors or armed guards. Those help a bit, but are quickly offset by the fact that a bank’s adversaries (i.e. professional bank robbers) are also better armed and more determined than the typical house burglar.

The first answer is that a bank employs multiple security measures to maximize its security. For example, just to name a few defenses, a typical bank has steel doors, bulletproof windows, security guards, room sized safes, security boxes, alarm systems, cameras and security-trained tellers.

Even more important, not only are there more defensive layers at a bank, but each layer is designed to address a specific type of threat at the point where it is employed.

For example, bank doors are effective, but simple security devices. They are either locked or unlocked. They either grant or deny access to customers on an all-or-nothing basis – regardless of what a visitor looks like or how the visitor behaves.

One layer up is the security guards – they perform access control to ‘clean’ the general flow of people into the bank.  They ensure that access to the bank is for people who have a legitimate need to be there and will ‘behave’ within expected norms. They regard each visitor based on specific criteria, such as, not wearing a mask, suspicious behavior, acting erratically etc.

At yet another level, the tellers, security box keys, passwords, etc. keep these pre-screened customers from accessing other accounts or information. Rather than worrying if a visitor should or should not be in the bank, the tellers and passwords present a different layer of security: account security. These measures ‘filter’ what account access individual customers are allowed, based on who they are.

More than Just Another Layer

The bank analogy points out three important aspects of Defense in Depth:

1. Multiple layers of defense. Do not rely completely on a single point of security, no matter how good it is.
2. Differentiated layers of defense.  Make sure that each of the security layers is slightly different. This ensures that just because an attacker finds a way past the first layer, they don’t have the magic key for getting past all the subsequent defenses.
3. Context and threat specific layers of defense. Each of the defenses should be designed to be context and threat specific.

This last point is the most subtle and perhaps the most important. Going back to the bank example, note that banks do not simply have additional security guards at every level. Banks understand that threats come in different flavors, ranging from the desperate drug addict with a gun, to the sophisticated fraud artist. Thus for the banks, each defensive layer is optimized to deal with a specific class of threats.

Designing for the Threat

So what does this have to do with security on the plant floor? Like the bank, the SCADA/ICS system can be exposed to a variety of different security threats, ranging from disgruntled employees, to computer malware, denial of service attacks and information theft. Each needs to be considered and defended against.

For example, a boundary firewall can act like the bank guard, so that network messages using specified protocols are either permitted or denied access into the control network. This is ideal for keeping the bulk attacks out, particularly the average IT worm or the common denial of service attack.

Deeper into the control system, more sophisticated SCADA-aware firewalls can observe the traffic beyond the obvious protocol types. This allows defenses based on the behavior and context of the systems using these protocols on the control network. For example, if an operator station computer suddenly starts trying to program a PLC, then perhaps a worm like Stuxnet or a disgruntled employee is at work. This attack needs to be immediately blocked and alarms raised to prevent serious risk to the system.

Finally, servers and controllers with a robust security implementation can act like a well-trained bank teller. After a user successfully connects to a server or controller, the security configuration ensures they only get access to the specific applications and data they are supposed to have access to. Attempts to access other services or data should be blocked and logged.

As with the steel doors, the bank guard and the teller example, the perimeter firewall providing the boundary security, the SCADA/ICS firewall providing the internal security and the server providing the application security are an essential team. For example, a firewall can block millions of randomly malformed messages directed at a control system as part of a Denial of Service (DoS) attack. At the same time, deep packet inspection and user authentication checks can prevent an attacker or worm inside the firewall making changes that might risk property or lives.

Providing Reliable Security for the Plant Floor

Depending on a single defence, such as perimeter firewall, is building a security solution based on a single point of failure. Make sure that your facility has a proper Defense in Depth design where the network, control devices and systems are collectively hardened - thereby providing reliable security for the plant floor.

Related Content to Download

Note: you need to be a member of tofinosecurity.com and logged in to have access to the document below. Register here to become a member.

Article - "The Line - Defense in Depth Sound Security Strategy"   In this article, Eric Byres goes into detail about the Defense in Depth strategy and explains how companies cannot keep relying on traditional firewalls with a single point of failure. Only a proper Defense in Depth design where the control devices and systems are hardened, both individually and collectively, can provide reliable security for the plant floor.

Related Links

• Defense in Depth is Key to SCADA Security - Part 1 of 2
• Making Cyber Security Work in the Refinery
• 7 Steps to ICS and SCADA Security plus White Paper
• #1 ICS and SCADA Security Myth: Protection by Air Gap
• Air Gaps won’t Stop Stuxnet’s Children

Subscribe to the "Practical SCADA Security" news feed

Author Eric Byres