The Secret to Easy and Effective SCADA Security (plus White Paper)

How can I reliably and easily secure my control system?

A lot of people are re-examining this question and giving it higher priority after learning about Stuxnet and the recent publishing of SCADA system vulnerabilities on the Internet.  It is no longer possible to believe that ‘air gaps’ between your systems and the rest of the world, or that ‘security by obscurity’ are effective security strategies.

In considering how to approach ICS and SCADA security nowadays, a significant factor to be dealt with is the widespread use of commercial off-the-shelf (COTS) information technologies like Windows and Ethernet on critical control systems. The use of these common networking, computer and software technologies has certainly reduced costs and increased business agility.

However, it has also increased the demands to balance the need for accessibility to control system data with the need to safeguard the integrity and usability of mission critical systems.

Reducing the Attack Surface

One of the most effective ways to manage the conflict between the demands of efficient access and the demands of effective security is to minimize the variety of interfaces and protocols operating between the control system and external networks.

Having one approved connectivity solution serving multiple corporate requirements not only reduces administration costs, but also reduces the opportunities open to the attacker or worm. This is known as “reducing the attack surface” of a system.

Thus the key task for an administrator is to select an appropriate communications technology that can be used by the widest variety of control AND business systems. While there are a number of possible candidates, OPC is without question one of the easiest and most widespread standards to address the demands of universal data access in the industrial automation world.

By layering defenses that are OPC-aware, high security solutions can be created that meet both the security and access expectations of a company, all without administrative overload on the network or controls team. The result is a standards-based solution that has been proven across numerous control systems.

Standards-based Solutions are Key

It is important to emphasize the standards in recommending an OPC security solution.  There are many so called “security solutions” that are secure only because they are obscure. It only takes one determined hacker (such as Luigi Auriemma who published 34 SCADA/HMI vulnerabilities in March 2011) to break into proprietary systems and publish the exploit code on the Internet.  Then “security by obscurity” is useless.

Not following the standards also makes it hard to secure the system with proven solutions. When I wrote the ICS-CERT OPC papers in 2005, one of the possible ways to significantly improve the security of OPC Classic was to make a few changes to the Window’s registry. The problem was that so many vendors did not use the registry according to the specification; causing computers to either not read the changes or just crash. This made this low cost security solution impractical in the end.

Example Solution

(Warning: Tofino Security and MatrikonOPC product promotion coming)

In terms of providing network-focused security, an OPC-aware solution is the Tofino Security Appliance with the Tofino OPC Enforcer Loadable Software Module.  It is designed to secure ANY OPC product, because it uses core IP, TCP, RPC and DCOM standards exactly as they were intended.

Similarly, for application-focused security, and for granular role and user-based security, the MatrikonOPC Security Gateway is fully based on the OPC Security specification and provides complete security for OPC architectures.

These two products have been successfully tested together with the Tofino technology providing front line protection from 99.99% of all network based attacks such as Denial of Service, unapproved clients, malformed DCOM connections etc. Once network traffic related to OPC has been vetted, the MatrikonOPC Security Gateway enforces the specific security policies chosen by the administrator– ensuring each user only gets access to the specific data he or she has authorization to work with.

The Secret to Easy and Effective SCADA Security

The bottom line for control engineers looking for a reliable security solution is: if you use one protocol, OPC, for control system communications and if you select standards-based OPC security products, you can achieve high security without administrative overload.

Download the White Paper “Effective OPC Security for Control Systems”

Note: you need to be a member of tofinosecurity.com and logged in to have access to the paper. Register here to become a member.

Effective OPC Security for Control Systems (1.4 MB)

Last week we published a White Paper (above) in partnership with MatrikonOPC that describes how to use diverse security technologies for different layers of defense.   Whether or not you use OPC, it is a great case study on defense in depth.

If you use OPC, the paper illustrates how Tofino technology and the MatrikonOPC Security Gateway can be used together for reliable and easy control system security.

Related Links

• April 4, 2011 Blog Article “OPC Security: More than the Sum of the Parts”
• May 11, 2011 Webcast  "OPC Security you can Bank on" - participate in this live event with presenters Eric Byres of Tofino Security, Darek Kominek of MatrikonOPC and Tom Burke of the OPC Foundation.
• OPC Feature page - for links to multiple Tofino Security White Papers on OPC Security.

Subscribe to the "Practical SCADA Security" news feed