Perimeter
1/8/2015
07:10 AM
Connect Directly
Google+
Twitter
RSS
E-Mail
100%
0%

Using Free Tools To Detect Attacks On ICS/SCADA Networks

ICS/SCADA experts say open-source network security monitoring software is a simple and cheap way to catch hackers targeting plant operations.

Operators at Iran's Natanz nuclear facility might well have caught Stuxnet before it spread and sabotaged operations at the plant if they had been watching the wires for anomalous network traffic, a pair of ICS/SCADA experts say.

Rob Caldwell and Chris Sistrunk of Mandiant, a FireEye company, say network security monitoring is a simple and inexpensive technique for detecting attack attempts against power plants and other ICS/SCADA environments. Various free open-source monitoring tools can help spot unusual file traffic or command and control communications.

"NSM would have caught" Stuxnet, says Sistrunk, senior consultant with Mandiant's ICS practice. It would have shown, for example, the infamous malware getting updated, he says.

"Any time a PLC gets a new code update, [for example], and if you were aware of your files, you could see that file go across the wire," he says.

Sistrunk and Caldwell, principal consultant with Mandiant, say network security monitoring also could catch the infamous Havex and BlackEnergy malware associated with attacks on ICS/SCADA networks, for example. The monitoring technique could be set to detect known indicators of compromise, says Caldwell, who with Sistrunk next week at the S4 Conference in Miami will school ICS/SCADA operators on the use of open-source NSM for their networks.

"We're really just trying to evangelize, getting folks to start looking at what's going in their [industrial] control systems. You can do all of this stuff with open source [tools] out there. And if you want to take advantage of automation and some GUIs, you can look at commercial software" as well, Caldwell says.

Passive network security monitoring isn't new to the traditional IT network space, and security experts such as Richard Bejtlich, chief security strategist for FireEye, have recommended it for some time as a key element to incident response. Sistrunk and Caldwell say it's a perfect fit for the ICS environment because it's non-intrusive, so there's no risk of it disrupting critical processes or operations.

"It all comes back to the premise … know your network," Caldwell says. That means watching the flows of traffic and knowing what's normal and what's not, and drilling down into what types of sessions and transactions occur, he says. "Not just looking at data, but at any extracted content, what kind of files are spreading around the network, and what Web pages are being hit or DNS servers are being resolved," he says.

"A network-centric point of view gives a lot of clues to tie into seeing if anything has been compromised," he says.

There are several open source network security monitoring tools; Caldwell and Sistrunk at S4 will demonstrate a set of tools from the open-source Security Onion Linux suite, including Wireshark, NetworkMiner, Bro, and Snorby, for network monitoring and intrusion detection.

Few ICS/SCADA operators today employ network security monitoring. Dale Peterson, CEO at ICS/SCADA consulting firm Digital Bond and host of the S4 Conference, says some large oil companies and other critical infrastructure operators with more mature security programs employ NSM. "NSM is a huge tool," Peterson says, especially for helping an organization detect and recover quickly from an attack or attempt. "It depends on the maturity of the ICS security program. So we typically don't recommend it unless you have good perimeter [security] and the ability to recover" from an attack, he says.

Peterson says it's relatively simple to institute network security monitoring in an ICS network. "Communications going to and from PLCs … should be very consistent," so it would catch any unusual traffic, he says.

"If you want to keep it simple, just do log management and alerting," Peterson says. The next level of monitoring would be the use of commercial monitoring tools commonly found in security operations centers such as SIEM and IDS/IPS, he notes.

Open-source NSM isn't a set-it-and-forget-it process, though. "The fundamental thing is you've got to have people involved, using their intel to be able to say 'this is not  normal'" traffic, Caldwell says. 

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: You should see what I wear on my work from home days!
Current Issue
The Changing Face of Identity Management
Mobility and cloud services are altering the concept of user identity. Here are some ways to keep up.
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7445
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

CVE-2015-4948
Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

CVE-2015-5660
Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

CVE-2015-6003
Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

CVE-2015-6333
Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio

The cybersecurity profession struggles to retain women (figures range from 10 to 20 percent). It's particularly worrisome for an industry with a rapidly growing number of vacant positions.

So why does the shortage of women continue to be worse in security than in other IT sectors? How can men in infosec be better allies for women; and how can women be better allies for one another? What is the industry doing to fix the problem -- what's working, and what isn't?

Is this really a problem at all? Are the low numbers simply an indication that women do not want to be in cybersecurity, and is it possible that more women will never want to be in cybersecurity? How many women would we need to see in the industry to declare success?

Join Dark Reading senior editor Sara Peters and guests Angela Knox of Cloudmark, Barrett Sellers of Arbor Networks, Regina Wallace-Jones of Facebook, Steve Christey Coley of MITRE, and Chris Roosenraad of M3AAWG on Wednesday, July 13 at 1 p.m. Eastern Time to discuss all this and more.