Konstantin Rogalas CYBER SECURITY PROGRAM & SOLUTIONS

Transcription

1 Konstantin Rogalas CYBER SECURITY PROGRAM & SOLUTIONS

2 Focus: Up to But Not Including Corporate and 3 rd Party Networks 1 Level 4 Corporate and 3 rd Party/Vendor/Contractor/Maintenance Connections Firewall IT Cyber Security Level 3.5 DMZ Domain Controller ESF PHD Server Experion Server EAS Terminal Server Patch Mgmt Server Anti Virus Server 3 RD Party App Subsystem Interface eserver PHD Shadow Server Level 3 Router ESC ESF ACE Experion Server EST ESVT Optional HSRP Router Safety Manager Terminal Server Domain Controller Industrial Cyber Security Level 2 Qualified Cisco Switches Level 1

3 Cyber Security follows the Business Risk 2 New cyber failure scenarios Decision engine (Business justification) IDENTIFY Risk estimation Risk to be controlled RESPONSE Technical controls and operational controls Immediate risk facing the plant MONITORING Key Risk Indicators, trends, threats TECHNICAL CONTROLS Design and implementation NON-TECHNICAL CONTROLS Operations, awareness and incident response ENVIRONMENTAL CONTROLS Physical security controls, HVAC, UPS,.. Execution engine (IT / OT implementation)

4 Agenda 3 Honeywell Industrial Cyber Security (H-ICS) Cyber Security Profile Cyber Security Solutions Security Operations Center Conclusions Open Discussion

5 About the Presenter 4 Konstantin Rogalas MSc, MBA Business Lead for Honeywell Industrial Cyber Security - Europe; in Discrete Automation & Process Control; in Telecommunications: Broadband-M2M/IoT; Konstantin.Rogalas@Honeywell.com 2013 Oil&Gas, Energy, Pharmaceuticals & Chemicals industry Certification study for ENISA in Industrial Cyber Security; ICS Council with policy makers, asset owners and service providers; Member of the European ICS Stakeholders Group.

6 Leading Cyber Security Specialist for ICS Certified Cyber Security Professionals Global team Cyber Security Standard driven IEC (ISA 99), ANSSI, BSI, CPNI Embedded or Stand-alone 400+ Security assessments for Industrial Control Systems Cyber Security Services Numerous Partners Cyber lab 500+ Remediation Projects Multi Vendor Cyber Security Products 350+ Managed Security Networks

7 Honeywell ICS 6 Edmonton Bracknell Aberdeen Amsterdam Global setup to serve global organizations as well as local asset owners Vancouver Montreal Offenbach Bucharest Houston Atlanta Dubai Kuala Lumpur Santiago Perth SSC + HICS HICS Office Private LSS SSC HICS Resource(s) Industries served: Oil & gas Gas distribution Power Refineries Chemical Water treatment Pulp & paper Maritime

8 7 Honeywell s Industrial Cyber Security Lab Flexible model of a complete process control network up to the corporate network Honeywell Cyber Security solutions development and test bed Demonstration lab for customers Cyber security related academic programs Hands-on training Simulate cyber attacks Demonstrate Honeywell cyber security solutions

9 8 Typical systems H-ICS have secured Distributed Control Systems - E.g. Chemical, Petrochemical, Refining, Offshore platforms Leak Detection Systems, Machine Monitoring Systems, Metering Systems, Compressor Control Systems Supervisory Control and Data Acquisition (SCADA) systems - E.g. Gas Distribution, Power utilities, Pipelines, oil fields Distributed Energy Systems - E.g. Wind turbines, hydropower Maritime systems - E.g. Harbor systems, shipping

10 Driven by standards and regulations 9 IEC (Formerly ISA 99) Industrial Automation Control Systems (IACS) Security Global standard for wide range of industry Honeywell ICS is active contributor to the development of the standard through ISA NERC CIP North American Power ANSSI, BSI, CPNI, MSB, INCIBE, etc. European guidelines, best practices and country-specific measures JRC & ENISA recommendations European Union NIST US technology standards (SP ) And others: ISO, API, OLF E.g. ISO 27000, API 1164, OLF 104 Local regulations

11 Honeywell ICS specialists background 10 Unique combination of long time experience in process control, networks and cyber security Gain knowledge, demonstrate knowledge and maintain knowledge - CISSP - CCNA - MCSE - VCP - CISM - CCNP - MCSA - CEH - CCIE - CRISC - CCSP Specialists with many backgrounds - Honeywell - Penetration testing Languages - Yokogawa - IT departments - Emerson - Telecom providers - Schneider - ABB

12 Agenda 11 Honeywell Industrial Cyber Security (H-ICS) Cyber Security Profile Cyber Security Solutions Security Operations Center Conclusions Open Discussion

13 12 Honeywell ICS CYBER SECURITY PROFILE

14 Security Profiling 13 Cyber security requires: - Standardization consistency in design, implementation, management and maintenance - Completeness effective remediation of all applicable vulnerabilities based on pertinent threats - Awareness monitor the system s security posture and respond to changes in security posture and threat environment - Coherence the collection of cyber security controls should all work together to protect the system - Readiness keep all system components and security controls up to date - Manageability measure and correct security performance deviations Security profile describes: - What security controls (technical and non-technical) need to be in place to meet the threat - How to organize this all in a way to be and stay effective in meeting the threat

15 Typical security level 14 IEC Skills Motivation Means Resources SL4 Nation-state ICS Specific High Sophisticated (Campaign) Extended (multidisciplinary teams) SL3 Hacktivist, Terrorist ICS specific Moderate Sophisticated (Attack) Moderate (groups of hackers) SL2 Cyber crime, Hacker Generic Low Simple Low (Isolated individuals) SL1 Careless employee, contractor No attack skills Mistakes Nonintentional Employee, contractor

16 C2M2 Maturity Indicator Levels 15

17 Cyber Security Profile 16 SL4 SL3 SL2 SL SL1 SL2 SL3 SL Refining process facilities 1401 Fertilizers 1102 O&G LNG terminals 1403 Petrochemicals 1103 O&G processing 1404 Plastics and fibers 1104 O&G production - on-shore 1405 Specialty chemicals 1105 O&G production - off-shore 1406 Biofuels 1108 O&G Marine - LNG IAS 1501 Alumina 1110 Gas To Liquid 1502 Aluminium 1112 Production - Coal bed M 1503 Base materials 1114 Pipeline - Liquid 1504 Cement 1115 Pipeline - Gas 1505 Coal & coal gasification 1201 Pulp 1506 Iron 1203 Paper 1509 Precious metals 1204 CWS 1510 Steel making 1303 Utility power 1508 Other SL1 SL2 SL3 SL4 MIL0 MIL1 MIL2 MIL3 Cyber Security strength is determined by the security design effectiveness (Security Level) and security operations effectiveness (Maturity Level) IEC standard provides the Security Level, Cobit or C2M2 toolkit provides the Maturity Level The Security Profile defines for each facility how to protect and how to organize Honeywell ICS has a complete portfolio and services to address each aspect of the profile (technical, non-technical); typically with SL2/SL3+ assessments Defines the Security Profile

18 Security profile and objectives 17 Create overview Tighten control Measure performance Monitor and manage risk Create control Standardize Document Maintain

19 Security profile and countermeasures 18 Create Control Access filters (Identification, FW, ACL, traffic policies (H)IPS) Antivirus (Blacklisting) Use control (Authorization, media use) Standardize Create reference architecture, baseline Best practices, standards Document Policies and procedures Guidelines Roles and responsibilities Maintain Make back-ups Maintain Antivirus, security patches (Service Node, EPO, WSUS) Maintain vaccine, TI Tighten Control Access filters (Multi-factor authentication, NGFW (application filters, User ID filters), data diode) Check program code integrity (AWL) Correlate events (SIEM) Create overview Consolidate logs / events (SIEM) Consolidate threat intelligence (TIE) Measure performance Measure security readiness (Risk Manager, Service Node, EPO, WSUS) Maintain dashboard Monitor and manage risk Monitor changes in risk (Risk manager)

20 Sustainable security requires a Program 19 SP 16 Increase maturity level SP 15 SP 12 SP 11 Increase maturity level 4 SP 10 SP 7 SP Increase security level SP 5 SP 2 SP 1 1 Increase security level Q1 Q2 Q3 Q4 Q1 Q2 Q3 Q4 Q1 Q2 Q3 Q4 Q1 Q2 Q3 Q4 If you run too fast or jump too high you might trip

21 Where would your Security Profile be? 20

22 Benefits of security profiling 21 Enter a defined path - When to invest into technical controls - When to invest into organizational improvements Assess your multi-year investment - Cyber security is not a one time action, it is an additional management task - Plan Capex and Opex for enhancing your security protection Offers sustainable security - Develop your organization while developing your technical capabilities - Prevent disappointments by jumping higher than today s abilities Benchmark your plants - Easy comparison between different plants - Easy comparison within the industry Planning is the first step

23 Agenda 22 Honeywell Industrial Cyber Security (H-ICS) Cyber Security Profile Cyber Security Solutions Security Operations Center Conclusions Open Discussion

24 23 Honeywell ICS H-ICS CYBER SECURITY SOLUTIONS

25 Our Solution Portfolio Backup and Recovery Incident Response Disaster Recovery Cyber Security Assessments Thread Risk Assessments Network & Wireless Assessments Audits and Design Reviews Secure Design and Optimization Zone & Conduit Separation 24 Risk Manager (in SOC) Continuous Monitoring Compliance & Reporting Industrial Security Information & Event Management (SIEM) Security Awareness Training Firewall, Next Gen FW Intrusion Prevention (IPS) Network Access Control Industrial Anti-Virus & Patching End Node Hardening Industrial Application Whitelisting Portable Media/Device/USB Security

26 The First Step to Security Is Understanding the Current Environment 25 Response & Recovery Situational Awareness Assessments & Audits TECHNOLOGY Architecture & Design Network Security Customer problems solved/needs addressed: Identifying and prioritizing the biggest risks Meeting industry/government regulations and guidelines Finding which systems and devices are the most exposed, and the most vulnerable Prioritizing cyber security efforts for the maximum return Endpoint Protection Honeywell Offerings: Risk Assessment Cyber Assessment (coincidental & intentional attacks using simple means) Risk/Thread Assessment (targeted attacks using sophisticated means) Validation Testing ICS White box / Tandem Audits, Compliance Assessments & Reports Wireless / Wired Network Assessment

27 CYBER SECURITY RISK 26 Tactics, Technologies, Practices (TTP) Exposure, Accessibility, Technology SECURITY RISK Software, Firmware, Protocol, Operation

28 Sources of vulnerability 27 An ICS has many sources of vulnerability: Infrastructure - Network - Computer platform - Computer operating system - Topology Application - Application components (e.g. database, middleware) - Authorization levels - Protocols used Embedded components - Field equipment (Transmitters, actuators) - Controllers, PLCs, safety controllers People - Plant personnel - Contractors Processes

29 Thoroughness Thoroughness The level of effort 28 RISK SL3 SL4 The strength of the attacker determines the tactics, technologies and practices (TTP) used. SIMPLE GENERIC EXPLOIT SL1 COMPLEX ICS SPECIFIC EXPLOIT SL2 SL2 VULNERABLE, BUT EITHER UNKNOWN, NOT EXPOSED, OR INSUFFICIENT CAPABILITIES TO EXPLOIT SL3 Completeness SL4 Strong attackers have a very clear plan and objective The risk increases depending on the strength of the attacker The need for thoroughness and completeness increases when the strength of the attacker increases The need for very specific skills increases when the strength of the attacker increases SL1 Completeness

30 Security levels and security capabilities 29 SL1 58 capabilities SL2 87 capabilities SL3 118 capabilities SL4 128 capabilities Out of the box installations, plus antivirus, back-up Requires additions such as domain, deep packet inspection, device control Requires additions such as multi-factor authentication, IPS, SIEM, security monitoring, white listing Requires additions such as multi-factor authentication for all systems, biometrics, dual control

31 30 Security levels and security capabilities SL3 118 capabilities Required capabilities vary based upon applied technology, exposure, accessibility, and attacker Risk analysis determines which likely tactics, technologies, and procedures (TTP) are used based upon attack scenarios and selects which actual capabilities are needed List of capabilities grows overtime because of new TTP of attackers, new technologies used Cyber Security is not a one time project, it is a lifetime service. Both changing environment, insufficient maintenance, and changes require periodic (re-)evaluation The Threat Landscape Continuously Changes

32 CYBER ASSESSMENT THREAD/RISK ASSESSMENT Thoroughness Different assessments SL2 and SL3+ 31 SL4 SCENARIO (TTP) DRIVEN APPROACH SL3 SL2 CHECKLIST DRIVEN APPROACH SL1 Completeness

33 Once You ve Found the Gaps, Fill them 32 Response & Recovery Assessments & Audits TECHNOLOGY Architecture & Design Customer problems solved/needs addressed: How to use network design to promote strong security Implementing Zones & Conduits (per IEC 62443) to minimize the impact of an incident Situational Awareness Network Security Endpoint Protection Honeywell Offerings: Network Design & Optimization Services Wireless Design & Optimization Services Cyber Security Design Services Zones & Conduits Documentation of current architecture and security

34 Most Threats Come from the Network 33 Response & Recovery Assessments & Audits Architecture & Design Customer problems solved/needs addressed: How to make it harder for the bad guys to get in What to do if/when they do get in TECHNOLOGY Situational Awareness Endpoint Protection Network Security Honeywell Offerings: Network Design Services Firewall/NGFW Installation & Configuration IPS Installation & Configuration Data Diode Network Access Control Perimeter Security Management

35 Soft Systems Are Easy Targets 34 Response & Recovery Situational Awareness Assessments & Audits TECHNOLOGY Architecture & Design Network Security Customer problems solved/needs addressed: Identify which PCs and Servers are vulnerable to threats Determining if the proper access controls are in place (missing critical patches, AV is out-of-date, etc.) Endpoint Protection Honeywell Offerings: Endpoint Hardening Anti-Virus Installation & Configuration Application Whitelisting, Installation & Configuration

36 35 Endpoint Hardening USB Port Disable Whitelisting Reduce inadvertent cyber intrusions via memory stick Enhanced DSA Security Secure Communications Restrict access to all apps unless authorized via approved list Authentication with flexible account using least privilege Encrypted and authenticated communications

37 Awareness Is Critical 36 Response & Recovery Situational Awareness Assessments & Audits TECHNOLOGY Endpoint Protection Architecture & Design Network Security Customer problems solved/needs addressed: Staying diligent with limited security staff & resources Understanding what s happening, what s at risk, and why Identifying the early-warning signs to prevent incidents Knowing what to do if/when an incident does occur Honeywell Offerings: Risk Manager (further discussed in SOC section) Security Information and Event Management (SIEM) Continuous Monitoring Compliance & Reporting Security Awareness Training

38 We Have a Problem 37 Response & Recovery Assessments & Audits Architecture & Design Customer problems solved/needs addressed: What do you do when an incident occurs? How do you recover? How do you regain safety and reliability? TECHNOLOGY Situational Awareness Network Security Endpoint Protection Honeywell Offerings: Backup & Restore Services (Security) Incident Response Services 24 x 7

39 Disaster recovery solutions 38 Business success depends on consolidating cost and equipment, reducing management time, and ensuring process control applications are always available when disaster strikes Backup control centers (BCCs) are used in the event the main control center (MCC) becomes inoperable, and operations must be switched to a backup location

40 Honeywell Security Service Center (HSSC) 39 Amsterdam Houston Amsterdam Bucharest Houston

41 Managed Industrial Cyber Security Services 40 Patch and Anti-Virus Automation Security and Performance Monitoring Activity and Trend Reporting Advanced Monitoring and Co- Management Secure Access Tested and qualified patches for operating systems & DCS software Tested and qualified antimalware signature file updates Comprehensive system health & cybersecurity monitoring 24x7 alerting against predefined thresholds Monthly or quarterly compliance & performance reports Identifying critical issues and chronic problem areas Honeywell Industrial Cyber Security Risk Manager Firewalls, Intrusion Prevention Systems, etc. Highly secure remote access solution Encrypted, two factor authentication Complete auditing: reporting & video playback Monitoring, Reporting and Honeywell Expert Support

42 EMEA Managed Security Service Center 41 Estonia Norway Finland SSC and support team Sweden Egypt Kuwait Saudi Arabia Abu Dhabi Oman North Sea Poland United Kingdom Cameroun Belgium Germany Slovakia France SSC Support team Zambia Zwitserland Austria Romania Namibia Italy South Africa Portugal Spain Sites 203 Protection Management 147 Tunisi Monitoring 112 SSC EMEA support Locations: Amsterdam The Netherlands Bucharest - Romania

43 Agenda 42 Honeywell Industrial Cyber Security (H-ICS) Cyber Security Profile Cyber Security Solutions Security Operations Center Conclusions Open Discussion

44 43 Honeywell ICS SECURITY OPERATIONS CENTER Managed Security Services & Risk Manager

45 Security Operations Center 44 Security challenges - Onslaught of security data from disparate systems, security controls, and applications - Numerous point solutions (AV, AWL, firewall, IPS, NAC, HIPS, etc) - Threats growing - Regulatory compliance coming - Shortage of specialist cyber security skills - Dynamic world The answer is Security Operations Center (SOC) - Provides consolidation of information - Provides continuous protection - Provides continuous detection - Provides response capabilities - Optimizes use of specialist cyber security skills Honeywell ICS connects both worlds

46 Typical ICS SOC 45 Security management, compliance management, network management (analysis, correlation, policy management, (remote) access management) Policy Threat Intelligence Risk indicators Performance indicators Logs Events Data acquisition layer Production management, operations management Vendor A ICS Vendor B ICS Honeywell understands cyber security in ICS

47 46 Honeywell ICS CYBER SECURITY RISK MANAGER

48 Honeywell Risk Manager 47 Translate complex cyber security indicators into simple measurements for ongoing situational awareness Quick, intuitive workflow from risk notification to detailed threat and vulnerability analysis Designed by people who know industrial control and cyber security No need to be a cyber security expert. Easy to use interface Vendor-neutral. Low impact technology Accurate measurement of risk

49 Honeywell Risk Manager 48 Risk Manager evaluates indicators of risk using patented algorithms to generate accurate risk scores in line with industrial risk management standards

50 Honeywell Risk Manager 49 Risk Appetite The amount and type of risk an organization is willing to accept in pursuit of its business objectives Risk Tolerance The specific maximum risk that an organization is willing to take regarding each relevant risk Trends reflect risk appetite and risk tolerance for that particular site

51 Agenda 50 Honeywell Industrial Cyber Security (H-ICS) Cyber Security Profile Cyber Security Solutions Security Operations Center Conclusions Open Discussion

52 Cyber Security Profile 51 SL SL SL SL MIL0 MIL1 MIL2 MIL3 Manageability requires a S.M.A.R.T. and holistic approach

53 Security solutions 52 SL SOC SL SL SL MIL0 MIL1 MIL2 MIL3 Manageability requires a S.M.A.R.T. and holistic approach

54 Technical controls 53 3 rd generation Firewall Next Generation Firewall Security Management Console Microsoft Workgroup Microsoft Active Directory Microsoft RADIUS Intrusion Prevention System Intel Security SIEM Cisco Access Point Cisco WLC Network Admittance Control Microsoft Windows Secure Access Portal RSA multifactor authentication Cisco Catalyst IOS Threat Intelligence Exchange (TIE) Antivirus black listing Endpoint protection white listing Endpoint protection device control Endpoint protection host IPS Honeywell Risk Manager Honeywell Experion Backup Recovery Honeywell Service Node AV update Honeywell Service Node Vaccine update Honeywell Service Node TI update Honeywell EPKS Secure Communications Honeywell EPKS Modbus firewall RO Modbus firewall RW OPC firewall DNP3 firewall Data Diode Bi-directional Data Diode Bluecoat USB protection Available capabilities for SL3+ security requirements

55 Industry-Leading Industrial Cyber Security 54 Industrial Cyber Security Experts Global team of certified Industrial Cyber Security experts 100% dedicated to Industrial Cyber Security Experts in process control cyber security Leaders in security standards ISA99 / IEC62443 / NIST Proven Experience 10+ years industrial cyber security 1,000+ successful industrial cyber projects 300+ managed industrial cyber security sites Proprietary cyber security methodologies and tools Investment and Innovation Largest R&D investment in industrial cyber security Partnerships with leading cyber security vendors Industry first Risk Manager First to obtain ISASecure security for ICS product State of art Industrial Cyber Security Solutions Lab Refining & Minerals, Petrochemical Oil & Gas Chemicals Power Generation Metals & Mining Pulp & Paper 54 Proven Industrial Cyber Security Solution Provider

56 This is what we do: 55 Open Discussion

57 56