SCADA Systems and Cyber Security

Transcription

1 SCADA Systems and Cyber Security Fred Toone Data Flow Systems, Inc. Melbourne, FL Florida Rural Water Association Annual Conference Daytona FL August 10 th, 2015 Telemetry? (Te-lem-i-tre) noun The technology of automatic measurement and transmission of data by wire, radio, or other means from remote sources to receiving stations, for the purpose of recording and analysis. 1

2 SCADA? Supervisory Control And Data Acquisition. What does it do? And What are its parts? SCADA? Supervisory Control And Data Acquisition. Monitoring of remote sites. including Security Video Surveillance. SCADA? Supervisory Control And Data Acquisition. Monitoring of remote sites. Control functions at remote sites. Historical data files (data bases). Report generation! 2

3 SCADA System Components 1. Central Site 2. Remote Sites 3. Data Dissemination 4. Communications! Who are SCADA customers? Who are SCADA customers? Water Utilities Water Plants Distribution Systems Wastewater Utilities Wastewater Plants Collection Systems Reuse Systems Stormwater Utilities Lift Station Maintenance Companies 3

4 Kinds of SCADA Systems Kinds of SCADA Systems - Plant SCADA - Remote SCADA Plant SCADA Inside the fence Process Control (PLC) Wired or Networked 4

5 Remote SCADA Outside the fence Independent Controls Radio or Wireless SCADA Monitoring/Control Network WATER Utility Operations WASTEWATER Utility Administration EOC REUSE MIS Data Center Engineering GIS Security CMMS Any Client Workstation STORMWATER 5

6 System Configuration Storm Water Pump Stations Radio Network Lift Stations Well Fields Storage Tanks Reuse Facilities Radio Central Site Computer Wired Network 4. PC PC NT Server 1. Central Site Central Site Radio Computer Hub Plant Network LAN Network 6

7 7

8 8

9 9

10 Types of Telemetry Systems: Based on distance of remote sites? Kinds of technology? Types of data collected? Type of software used? PLC or non-plc based? Communications path? Types of Telemetry Systems: Wired Communications vs. Wireless Communications 10

11 Wired Telemetry Systems: Wired (serial cable, 6-pair wire, etc.) Telephone lines (auto-dialer) Fiber Optical cable LAN (Ethernet network) Wireless Telemetry Systems: CDPD (cell-phone) Infrared Wireless LAN (Ethernet) Radio Terms: Analog: moving scale, i.e., 4-20 ma or 1-5 Vdc Digital: on or off (binary) 911 call-out 411 call-in 11

12 2. Remote Sites Storm Water Pump Stations Lift Stations Well Fields Storage Tanks Reuse Facilities 12

13 13

14 Remote Terminal Unit () Equipment being monitored and controlled Lift Station Storage Tank Pump Station Well Generator Stormwater Gate System Configuration Storm Water Pump Stations Radio Network Lift Stations Well Fields Storage Tanks Reuse Facilities Central Site Wired Network Radio Computer PC PC NT Server 3. Communications Radio Network Local Area Network Central Site Radio Computer Wired Network 14

15 Wired vs. Wireless vs. Radio (RF) System Configuration Storage Tanks Well Field Radio (RF) Network Wireless LAN Radio Utility Offices PC SCADA Central Location Wired LAN WTP #1 City / County LAN Internet WTP #2 Radio Telemetry 15

16 Radio Frequencies: FCC license Frequency Coordinators VHF UHF MHz MHz Trunking System MHz Spread Spectrum 900 MHz, 1W max radio output. Radio Terms: ERP: effective radiating power. db: (decibel) measure of change in the gain or loss of volume or power. antenna gain: ability of antenna to focus signal strength as measured in db, and expressed in ERP. fade margin: point at which db loss will cause signal path to go off line. Antenna Gain: each 3 db gain doubles ERP. Example: 2w radio signal thru a 6dB gain antenna would equal 8w of ERP. 16

17 Unity or 0-gain Antenna: Unity or 0-gain Antenna: Side View High-gain Antenna: 17

18 Omni-Directional Antenna: Side View Top View 360 Radiation Pattern 18

19 Off-set Antenna: Side View Top View Yagi Antenna: Side View Top View Dish Antenna: Side View Top View 19

20 System Configuration Storage Tanks Well Field Radio (RF) Network Wireless LAN Utility Offices WTP #1 Radio PC Hub SCADA Central Location Wired LAN WTP #2 20

21 Wired LAN Network: Ethernet network IEEE TCP / IP Transmission Control Protocol / Internet Protocol Internet technology SCADA and on same network. 10 Mbps / 100 Mbps Wireless LAN Network: Wireless LAN Utility Offices WTP #1 PC Hub SCADA Central Location Wireless LAN Network: Ethernet network IEEE TCP / IP Transmission Control Protocol / Internet Protocol Internet technology SCADA and on same network. 10 Mbps / 100 Mbps 21

22 SCADA? Monitoring of remote sites. Control functions at remote sites. Journal files (data bases) of historical data. Report generation SCADA? Monitoring of remote sites. Control functions at remote sites. Automated Controls Automated Controls 22

23 Automated Controls The SCADA computer uses inputs from remote point A to control processes or outputs at remote point B The SCADA computer uses internal programming to control processes at remote points. Automated Controls Point-to-Point Applications PID Loops Automated Controls Point-to-Point Applications 23

24 Automated Controls Point-to-Point Applications Sending data from one remote point to another remote point. Example: Sending a tank float level to a well pump. Automated Controls PID Loops (Proportional Integral Derivative) Automated Controls PID Loops (Proportional Integral Derivative) Using a logic controller (PLC) to monitor inputs and control processes. Program loops for continuous feedback. 24

25 Programmable Logic Controller PLC shall monitor line pressure, and control booster pumps, in order to maintain 58 psi in the water distribution line. Programmable Logic Controller PLC shall monitor line pressure, and control booster pumps, in order to maintain 58 psi in the water distribution line. PLC Control Strategy Formal, signed document Changeable set-points Back-up or default program Acceptance Test/Start up Well #2 Well #3 Ethernet LAN Hub Central Site WTP Fresh Water Radio Network Well #1 EST 25

26 Overflow Prevention Overflow Prevention LS 43 LS 33 LS 42 LS 45 LS 34 MLS 2 LS 41 High Well MLS 4 High Well POWER LOSS WWTP Wastewater Collection Flow Management System 26

27 Wastewater Collection Flow Management System LS Pump Management WWTP Inflow Management Sediment Elimination Pump Management LS 43 LS 75 Central Force-Main W W T P Pump Management - Line Capacity - MLS 5 LS 43 MLS 2 LS 75 MLS 3 Line Pressure Line Capacity Central Force-Main W W T P 27

28 Pump Management - Plant Capacity - MLS 5 LS 43 MLS 2 LS 75 MLS 3 Central Force-Main 105% W W T P Pump Management Plant Capacity Flow Volume Collection System Capacity In-flow Midnight Morning Noon Evening Midnight Before Pump Management 28

29 After Pump Management Sediment Elimination Sediment Elimination LS 43 Undeveloped Area Seasonal LS 42 Infiltration & Intrusion LS 45 Slow Growth LS 41 MLS 4 29

30 Stormwater Stormwater Drain Area Level (elevation) Transducer CTU Modem LAN Central Site Computer Pump Station Weir Gate Main Canal -- A central computer is collecting data from remote sites. -- Rainfall measuring devices can be installed at the remote sites. 30

31 -- Rainfall data can be collected from the remote sites. -- With programming, the data can be used to generate rainfall predictions, and flooding alarms. Rainfall Prediction & Alarm Program Daily Total Rainfall. Current Rainfall Rate - - Inches/Hour. Average Rainfall Last 6-hours. Rainfall During Last 30-minutes. 31

32 GIS Interface 32

33 SCADA System Planning Test: RFP and Contract litigation Analog Input Analog Input Digital Input Digital Input 33

34 Analyzed SCADA Requirements Start/stop the VFD drive Digital Output Monitor that VFD is engaged or online. Digital Input Remotely control VFD with changeable set points. Analog Output Monitor the VFD speed. Analog Input Analyzed SCADA Requirements Start constant speed motor Digital Output Monitor that constant speed motor is running Digital Input Stop constant speed motor Digital Output I/O connections to SCADA: DI = 4 AI = 3 DO = 3 AO = 1 34

35 I/O connections to SCADA: DI = 4 AI = 3 DO = 3 AO = 1 PID Control Loops w/ PLC? Alarm Configurations Alarm points Delays Snooze alarms Virtual alarms Alarm Enunciation Voice at the central Voice at the work stations Phone call-out w/voice Pager 35

36 I/O Troubleshooting Electrical Grounding: Station Control Panel Electrical Grounding: Station Control Panel 36

37 Analog Signal Troubleshooting: 4-20 ma instrumentation: Flow Pressure Position Level VFD control Analog Signal Troubleshooting: Example: monitoring water system pressure of 60 PSI Which meter scale? 0-60 PSI 0-80 PSI PSI PSI PSI Analog Gauge Accuracy: (Higher) Accuracy (Lower) 0 PSI 120 PSI 4 ma 20 ma 37

38 Analog Gauge Accuracy: (Higher) Accuracy (Lower) 0 PSI 60 PSI 120 PSI (4 ma) (20 ma) Analog Signal Troubleshooting: 0 ma 4 ma 20 ma - 30 PSI 0 PSI 120 PSI Cyber-Security Why is security so important in our business sector? Unlike the business IT network, which runs for eight to twelve hours per day, SCADA systems are required to run continuously. Business systems are relatively passive; whereas, SCADA systems are mostly active, and in many cases, provide both the logic and controls that run a utility s local and remote assets. 38

39 Cyber-Security In the 1990 s, based on customer pressure, many suppliers moved from proprietary systems (e.g.- Allen Bradley DF-1, Bristol Babcock BSAP, etc) to open architecture systems. All hacking tools are freely available on the internet. Cyber security is an area of great concern to all businesses, especially those in the public sector. Water and wastewater systems have already been hacked!!!! Cyber-Security Shamoon virus (Aramco Oil)Took out 30,000 servers. Erased the OS, and wiped the hard drives! Cyber-Security Shamoon virus (Aramco Oil)Took out 30,000 servers. Erased the OS, and wiped the hard drives! Russian hackers broke into SCADA supplier s database, downloaded usernames and passwords, then broke into utility and destroyed a pump by rapidly starting and stopping it! A utility in Pennsylvania said they didn t know they were being hacked, until they saw unusual behavior in their system the hackers were already in!! 39

40 7 Steps to Secure Control Systems 7 Steps to Secure Control Systems Assess existing system(s); Document Policies and Procedures; Train Personnel and Contractors; Segment the Control System Network; Control Access to the system; Harden the System Components; Monitor and Maintain Security. Keep the viruses out!!!!! 40

41 Video Surveillance Can the gentleman in the brown jacket on the bike please dismount! You are in a pedestrian walk zone. TEST: Video surveillance cameras are used for: a. remote operational monitoring and control. b. remote site security. c. looking at people on the beach. d. both a. and b. 41

42 American Society for Industrial Security Physical Protection System (PPS) Detection Delay Response American Society for Industrial Security Detection includes Assessment. You cannot conduct a proper Response without Assessment. Fear of Detection can create a Deterrence. 42

43 Video Security Objectives: - I want to see the security situation in real-time. - I want to see the security situation just before, during, and after an alarm activation. - I want high quality video recording of all site activity for operational analysis and legal evidence. - I want to integrate security alarms and video into my existing SCADA system. Video System Central Site Cameras Operator Interface Network Video Recorder 43

44 Video System Remote Site Cameras Operator Interface Video Recorder Network Networks: Cameras Video Recorder - Leased phone lines - T1 / Frame Relay - Local Area Networks (TCP/IP) - Wireless LAN (802.11b/g) - Satellite & Cellular - Radio (Licensed RF) Operator Interface Networks: - Video security networks use the same technologies as your existing networks. - Your existing networks will probably not be robust enough! 44

45 Bandwidth! - Frames-per-second: 30fps is movie quality - Resolution: 320X240 low / 1280X1024 high - How often transmitted: streaming video Bandwidth! Cameras Operator Interface Longwatch RVE or Micro Network Bandwidth! Cameras Operator Interface Longwatch RVE or Micro - High speed - High quality - 24/7 recording At the remote site: Network - Slower speed - Less quality - Event clip transmission Across the network: 45

46 Video & SCADA Integration DFS Hyper SCADA Server Cameras Longwatch RVE or Micro Network Primary Workstation & Longwatch VCC Video & SCADA Integration Cameras DFS Radio Hyper SCADA Server Longwatch RVE or Micro DFS Network Hub Primary w/ VCC Professional Education for I & C ISA International Society of Automation. 46

47 ISA Certification Programs 47