Secure Mobile Access to the Local ICS Network. Jan Vossaert Veilige industriële netwerken 29/09/2016

Transcription

1 Secure Mbile Access t the Lcal ICS Netwrk Jan Vssaert Veilige industriële netwerken 29/09/2016

2 Intrductin ffice netwrk prductin cell ruter /24 Internet ICS DMZ servers /24 prductin cell ruter

3 Intrductin prductin cell ruter /24 ICS netwrk ruter /24 prductin cell ruter

4 Intrductin Industrial Mbile Apps: Wh's Using Them and Why We use the app t mnitr ur gas detectin devices, but we als use a few cntrls in the app that allw us t remtely silence the alarms (Bayer Crp. in Pittsburgh) We have a few in-huse mbile applicatins fr handling wrk rders and purchase rders, as well as preventative maintenance and inventry. A mbile HMI reduces cmmunicatin errrs between peple by allwing the field peratr t access the same data as the cntrl rm peratr. mnitr any area f prductin packaging status, ck temperature r frying capacity frm the palm f their hands... (Hillshire Brands) anytime access t real-time and histrical prductin data and trends, peratrs can see where there are prblems, where prblems might ptentially arise, r where additinal capacity exists t increase prductin r run an alternative prduct. (Hillshire Brands)

5 Intrductin Use mbile devices in ICS envirnments Hardware platfrm Cheap ff-the-shelf hardware They re cmpact, lightweight, affrdable, and readily available. They ffer pwerful prcessrs and rich UI capabilities Rich wireless cmmunicatin interfaces Applicatin platfrm ICS equipment vendrs have started t prvide mbile app supprt Applicatins that interact with crprate r ther services Built-in security technlgies (VPN/MDM/app sandbxing/ )

6 Requirements Functinal requirements Use mbile t interact with ICS equipment Use mbile t access cmpany resurces/services in back-end Access resurces n the internet Security requirements Only traffic frm specified ICS apps can reach the ICS netwrk Only authrized emplyees can access ICS netwrk (via WiFi)

7 Slutin Architectures ICS traffic prductin cell ruter /24 nn ICS traffic ICS netwrk ruter prductin cell ruter /24

8 Slutin Architectures Firewall-based slutin Separates mst traffic nicely Can match with expected netwrk signatures Malicius apps targeting ICS equipment Other apps generating traffic fr ICS netwrk Lack f required cntext infrmatin

9 Slutin Architectures ICS traffic prductin cell ruter /24 nn ICS traffic ICS netwrk ruter prductin cell ruter /24

10 Slutin Architectures MDM-based slutin COSU: Crprate-wned, single-use kisks r purpse-built devices : ne applicatin is intended t run n the device Simple but greatly restricts use f mbile device Prvided by Andrid via lck task mde Requires applicatin awareness Activated via MDM r enfrced by applicatin COBO: Crprate-wned, business nly COPE: Crprate-wned, persnally enabled BYOD: Bring yur wn device

11 Slutin Architectures MDM-based slutin Create applicatin/cntext-awareness by managing traffic n the mbile device Usually all traffic passes thrugh the same interface Can we separate ICS and ther traffic? Create a virtual VPN interface VPN ICS traffic ruter & VPN gateway Nn-ICS traffic

12 Backgrund VPN technlgy n Andrid MDM n Andrid (Andrid fr Wrk)

13 VPN Technlgy n Andrid Andrid has a built-in IPSec VPN implementatin Bth PSK and RSA device authenticatin Passwrd-based user authenticatin Des nt supprt fine-grained cntrl White listed apps, MDM-based cnfiguratin

14 VPN Technlgy n Andrid Andrid has a built-in IPSec VPN implementatin Bth PSK and RSA device authenticatin Passwrd-based user authenticatin The Andrid framewrk prvides APIs t develp VPN applicatins Mainly OpenVPN prts Interface als used fr firewalling internet traffic (n rt required)

15 VPN Technlgy n Andrid Andrid has a built-in IPSec VPN implementatin Bth PSK and RSA device authenticatin Passwrd-based user authenticatin The Andrid framewrk prvides APIs t develp VPN applicatins Mainly OpenVPN prts Interface als used fr firewalling internet traffic (n rt required) Sme clients cnnect with predefined VPN servers Sme pure VPN client implementatins

16 VPN Technlgy n Andrid Andrid prvides APIs t allw VPN implementatins t allw/disallw specific applicatins access t the VPN

17 Andrid fr Wrk Platfrm frm Ggle that imprves Andrid usability, security, and flexibility in wrk envirnments Built-int recent Andrid devices (5 and higher) Newer Andrid versins add mre features Supprts tw virtual prfiles n Andrid device Persn prfile managed by user Wrk prfile managed by emplyer

18 Andrid fr Wrk AfW APIs are used by Enterprise Mbility Management (EMM) prviders t enfrce cmpany plicies System-wide plicies/settings Cntrlled sharing f data between prfiles Passwrd plicies Require full disk encryptin Allw camera Allw develper ptins Allw screenshts Allw cnfiguratin f netwrk access Allw reset t factry settings Wrk prfile plicies Specify apps that can/shuld be installed in the wrk prfile Aut wipe prfile upn synchrnizatin failure Credentials fr access t cmpany netwrks/services App-specific plicies/cnfiguratins fr wrk apps Share cntent frm wrk t persnal prfile Cpy/paste cntent frm wrk t persnal prfile

19 Andrid fr Wrk APIs/capabilities are used by Enterprise Mbility Management (EMM) prviders

20 Andrid fr Wrk Device enrllment Install EMM app n device EMM app creates wrk prfile Plicy-based islatin between bth prfiles Cntrl ver cmpany prfile via MDM Andrid system

21 plicies Andrid fr Wrk Plicy specificatin Andrid system

22 plicies Andrid fr Wrk Plicy enfrcement managed prfile /app restrictins system plicy Andrid system

23 Andrid fr Wrk Plicy enfrcement Andrid system User has bth wrk and persnal apps installed Users can have the same app installed in bth the wrk and persnal prfile Each versin runs in its wn sandbx Users can distinguish between apps via

24 Realizatin MDM prviders Preliminary tests with Ggle Apps fr Wrk Des nt yet supprt managed prfile

25 Realizatin MDM prviders Preliminary tests with Ggle Apps fr Wrk Des nt yet supprt managed prfile Used Test DPC as an alternative Sample device plicy cntrller fr use with Andrid fr Wrk Client-side specificatin f plicies Set up wrk prfile Enable wrk apps Set applicatins restrictins Manage security plices

26 Realizatin managed prfile /app restrictins VPN cnfiguratin Crypt parameters Endpint address Credentials/certificates CA certificate Client certificate Client key VPN apps Andrid system system plicy

27

28 Realizatin Unfrtunately mst apps d nt yet implement managed prfile API A ppular OpenVPN client is pen surce (Apache 2 license) Extended implementatin Added Managed Prfile supprt Disabled n-device cnfiguratin

29 Realizatin Persnal cmmunicatin By default all traffic ver regular interface Andrid system Business cmmunicatin

30 Realizatin Persnal cmmunicatin ICS cmmunicatin By default all traffic ver regular interface Emplyee activates VPN when required VPN endpint is nt always reachable Multiple VPN cnfiguratins pssible ICS traffic ver VPN interface Other traffic ver regular interface Andrid system Business cmmunicatin

31 Test Setup KU Leuven netwrk /21 Gw Nexus 6 TP-LINK_9BD /21 Wireless access pint pfsense wireless adaptr wired adaptr business netwrk /21 DHCP WAN Dem laptp /24 LAN ICS netwrk /24

32 Test Setup KU Leuven netwrk /21 Gw Nexus 6 TP-LINK_9BD /21 Wireless access pint pfsense wireless adaptr wired adaptr business netwrk /21 DHCP WAN Dem laptp /24 LAN ICS netwrk /24

33 Test Setup KU Leuven netwrk /21 Gw /24 DHCP Nexus 6 TP-LINK_9BD /21 Wireless access pint pfsense wireless adaptr wired adaptr business netwrk /21 DHCP WAN Dem laptp /24 LAN ICS netwrk /24

34 Evaluatin Functinal requirements Use mbile t interact with ICS equipment Use mbile t access cmpany resurces/services in back-end Access resurces n the internet Security requirements Only traffic frm specified ICS apps can reach the ICS netwrk Only authrized emplyees can access ICS netwrk (via WiFi) Malicius emplyees External attacker Malicius apps Malicius emplyees External attacker

35 Evaluatin Malicius emplyees Can access ICS equipment via app Cannt cpy cnfiguratin/credentials User authenticatin and lgging at VPN gateway (accuntability) Only specified apps can cnnect ver VPN Restrict functinality f app via Managed Prfile Requires applicatin awareness

36 Evaluatin External attacker Access cntrl t device Secure passcde Device encryptin Disable adb Upn theft/lss Remte wipe Blck credentials

37 Evaluatin Malicius apps Islatin between wrk and persnal prfile (cannt access wrk prfile VPN) Wrk prfile Only traffic frm specified apps in wrk prfile is sent ver VPN MDM manages apps that can be installed in wrk prfile App sandbxing Traffic analysis shws nly allwed traffic in ICS netwrk

38 Evaluatin External attacker Secure WiFi netwrk (can be cmpany wide) Credential based access cntrl f emplyees t ICS VPN gateway Malicius emplyee Can access WiFi netwrk Has n direct access t credentials Only allwed emplyees can access ICS netwrk frm managed app

39 Evaluatin Security depends n sftware integrity f trusted cmputing base Keep sftware updated! Reactive measures Remte wipe Blck credentials

40 Evaluatin Frm dem setup t deplyment in practice

41 Evaluatin Frm dem setup t deplyment in practice Andrid 5(+) devices apprved devices Mbile device management Management mdel MDM prvider which supprts the required features (mainly Managed Prfile) Mst apps still need t implement Managed Prfile API (nly small mdificatins required) Lgging

42 Evaluatin Frm dem setup t deplyment in practice Set-up PKI infrastructure Industry-grade VPN gateway pfsense deplyment Cmpatibility with ICS VPN ruter Secure WiFi (xeap) User management Emplyees External service engineers

43 Evaluatin Frm dem setup t deplyment in practice Simplified setup (withut Managed Prfile) Only allw VPN and ICS-apprved apps t be installed in wrk prfile Manual cnfiguratin f VPN app Emplyees can access credentials t access VPN Malicius Careless Limits flexibility in wrk prfile

44 Cnclusin Managed Prfile prvides interesting pprtunities t tailr apps fr specific crprate needs but requires applicatin awareness Ggle Apps fr Wrk is nt up t date with latest MDM capabilities f Andrid

45 Dem Setup Nexus 6 pfsense Wireless access pint /24 wireless adaptr Dem laptp /24 LAN wired adaptr /24 business netwrk ICS netwrk

46