CYBERSECURITY AND SERVICE STATIONS

Size: px

Start display at page:

Download "CYBERSECURITY AND SERVICE STATIONS"

Candace Chase
5 years ago
Views:

1 CYBERSECURITY AND SERVICE STATIONS Hocine AMEUR and Simon Elrharbi 1

2 AGENDA 1. WHO WE ARE 2. IoT and Security 3. Connected service stations security 4. How to improve IoT security 5. Secure Elements for IoT 2

3 WHO WE ARE CoESSI Collaborators 20 was founded Active clients Recognized as a Young 2013 Innovative Company 25% A N R Project Sites Paris & Nantes Of the sales are invested in R&D Consultants & Engineers 2017 FUI Project 3

4 WHO WE ARE: COESSI CORE ACTIVITY Risk assessment, management cyber-security evaluation Compliance testing Standard and norm development Security auditing penetration testing intrusion detection Developing penetration testing tools Security-by-design privacy-by-design EIS (Enterprise Information System) IoT (ZigBee, SigFox ) ICS (PLC ) 4

5 WHO WE ARE: RISK ASSESSMENT PROJECTS System Description Risk Assessment result Smart Grid Security 5

WHO WE ARE: PENETRATION TESTING PROJECTS Penetration testing

development Mobile Apps Wireless communication in IoT (IEEE

4, 6LowPAN, Z-Wave) using SDR Communication APIs ICS/SCADA

6 WHO WE ARE: PENETRATION TESTING PROJECTS Penetration testing methodology development Penetration testing tools development Mobile Apps Wireless communication in IoT (IEEE , 6LowPAN, Z-Wave) using SDR Communication APIs ICS/SCADA networks CAN bus networks (cars, boats ) Hardware (JTAG/UART exploitation, binary exploitation) Networks protocol stack fuzzing 6

..) (Cloud) Application Surveillance, Retail, Transportation, Financial service, etc Management service Data flow management, Security control,

7 IOT AND SECURITY: IOT INFRASTRUCTURE Sensors/Actuators (Edge) IoT communication network (ZigBee, Z-Wave, EnOcean, PLC, CAN, MODBUS...) Concentrators Gateways (Gateway) Cellular/Core network Cloud (Storage, analytics...) (Cloud) Application Surveillance, Retail, Transportation, Financial service, etc Management service Data flow management, Security control, Configuration, etc. Gateway and Network Sensors connectivity and network Radio comm. modules, Access Point, SIM, etc Network activity, Wi-Fi, Ethernet, RFID, Sensors & Actuators Mobile App (Mobile) Enterprise Information System 7

8 IOT AND SECURITY: IOT ATTACK SURFACE - Hardware - Firmware Sensors/Actuators (Edge) IoT communication network (ZigBee, Z-Wave, EnOcean, PLC, CAN, MODBUS...) Concentrators Gateways (Gateway) - Internet facing services - Cloud infrastructure Cellular/Core network Cloud (Storage, analytics...) (Cloud) - Communication API - Wireless media Mobile App (Mobile) - Mobile Apps Enterprise Information System 8

9 Cloud Cloud interface security Cloud data security Communications APIs security Displays WAN Remote management / monitoring - Mobile app security - Securing web interfaces/apps - Communication APIs security Wireless LAN - Isolating guests network - Securing wireless communication Tank Gauge Pressure sensor - SCADA network segregation - Requiring authentication ATM LAN (Wired, Wireless) Payment, Control - Hardware security - Network segregation - Securing network traffic - Requiring authentication Payment Terminal 9

10 CONNECTED SERVICE STATION SECURITY Cloud WAN Displays Remote management / monitoring Wireless LAN ATM Tank Gauge Pressure sensor LAN (Wired, Wireless) Payment, Control Payment Terminal 10

11 HOW ATTACKS CAN BE PERFORMED Hardware attacks SDR hardware 11

12 ATTACK SCENARIOS Taking advantage of vulnerable remote display protocols (eg. downgrade attack) Taking advantage of the patch management policy (firmware updated in such a manner that open an attack vector) Taking advantage of an insecure key management policy Extracting credentials and hardcoded passwords from the connected objects Man in the middle attacks SQL injection, XSS, CSRF, Command injection Denial of service, Jamming Buffer overflow on services Web HMI vulnerabilities 12

13 WHAT CAN BE DONE Bringing control/distribution to a standstill. Changing pump names (eg: unleaded to diesel) Changing pumping volume (putting the volume as full when it is empty) Data leakage, block access to data 13

14 THREAT ACTORS Cyber Attacks Statistics HACKMAGEDDON. [Online]. Available: 14

15 IOT SECURITY INCIDENTS Mirai botnet 2.5 million IoT devices infected by Mirai botnet in Q4 2016:McAfee Cold in Finland IoT reaper 2 million IoT devices in only one month 15

16 HOW TO IMPROVE IOT SECURITY Risk assessment Identifying critical elements (Impact x likelihood) Using norms and standards Identifying the feared events Risk assessment Identifying the context Identifying threats Identifying risks Propose countermeasures Identifying critical threats Updating the likelihood of threats Penetration testing Evaluating the security level Identifying vulnérabilities Penetration testing (OS, Application, Network, Hardware) 16

17 KEY MANAGEMENT Low power devices Symmetric cryptography only (AES, ChaCha20 ) using either AEAD or MAC for authentication Bad strategy : randomly generated and stored Good strategy : diversification, using KDF(device_id, key_version, master_key) High power devices Asymmetric cryptography (RSA, Elliptic Curves), Standard protocols (IPsec, TLS ) Manufacturing ; Device is ready to use, possibly headless installation, what about expiring certificates in stored devices? When first installing the device, needs access to a registration authority What if the network is unavailable? 17

18 PATCH MANAGEMENT BEST PRACTICES Know your dependencies Do watch for new vulnerabilities Need to have a dedicated, accelerated, validation procedure for security fixes Work upfront to lower the need to ship fixes, embark minimal, hardened programs. No one needs OpenSSL in a thermometer! Prefer LTS branches Audit the software and the configuration Do impact analysis on new vulnerabilities to assess exposure 18

SECURE ELEMENTS FOR IOT Security issues from: Communication Storage (secrets) Integrity It is time for the IoT industry to consider securing connected devices with Secure Elements, like Mobile

19 SECURE ELEMENTS FOR IOT Security issues from: Communication Storage (secrets) Integrity It is time for the IoT industry to consider securing connected devices with Secure Elements, like Mobile Phones, Bank Cards, Identity Cards, and Hardware Authentication Tokens have been for many years. Secure Element as firewall: Identity (Certificate) + Security (associated Private key) Tamper resistance + secure communications + storage 19

20 ABOUT SECURE ELEMENTS 10 billion of SE has been shipped in 2017, for SIM modules, bank cards, epassport, PKI tokens. A Secure Element (SE) is a tamper resistant microcontroller whose security is enforced by multiple HW and logical countermeasures: Specific reg. (EventRegister) logs abnormal operating conditions (V, CLK, T ) Bus & Memories encrypted Sensor mesh against the physical intrusions Countermeasures against attacks DPA, etc Certification according to the Common Criteria (CC, ISO 15408) standards with proven National Scheme and with Evaluation Assurance level (EAL) Multiple standards (ISO 7816, 14443, ETSI, etc.) and consortium group (GP, NFC Forum, EMVCo) have defined the interface (physical, electrical and communication protocol) and through which secure transaction are negotiated between the outside world and the Secure Elements and finally defining a process for application selection. 20

21 SE WITH DIFFERENT FORM FACTORS FOR MULTIPLE DEVICES The client of a service (stored in the SE) is identified and not the terminal Mobiles and devices are equipped with SE running the TLS stack Strong mutual authentication based on TLS SE Terminal Smart Phone - OS Android Tablette - OS Android PC NFC wearable Device 1 User SE holder NFC ISO Proxy App or ISO Authorization Server 21

THE CLOUD OF SECURE ELEMENT PLATFORM 2 trusted services https Auth the client through the certificate On the server side, a simple php script handles the strong Mutual Authentication

22 THE CLOUD OF SECURE ELEMENT PLATFORM 2 trusted services https Auth the client through the certificate On the server side, a simple php script handles the strong Mutual Authentication between the NFC card and the remote server RACS HSM: PKCS#15 device are hosted in a RACS HSM server, possibility to login with the Certificate and PW with the electronic signature operation 22

Selected authorized resources have direct device access through a mobile phone

23 USE CASE WITH SE AND IOT NFC trusted services IoT device is managed remotely by the operator. Selected authorized resources have direct device access through a mobile phone with an identity module (optionally imbedded in a secure element for added security, such as preventing the tampering/cloning of embedded apps). 23

SMART CITY & NFC Internet of Things but also Internet of People Smart city concepts based on Information + ICT infrastructure deployment that aims to enhance, among other things, efficiency of

24 SMART CITY & NFC Internet of Things but also Internet of People Smart city concepts based on Information + ICT infrastructure deployment that aims to enhance, among other things, efficiency of mobility and economy. NFC is also a major contributor technology for promotion of IoT Emergence of new digital banking technologies Cless smart card, NFC devices, NFC HCE, etc.) Deliver real-time value transfer capabilities without jeopardizing trust and security NFC interoperability communication issues, still ongoing concern 24

25 SKILLS WE CAN BRING Risk assessment and risk management in a cyber-security context Technical cyber-security evaluation of developed solutions Security-by-design and privacy-by-design specification and implementation Technical and methodological expertise on cyber-security (IoT, Smart-*, SCADA) Standard and norm development Compliance testing and evaluation regarding existing/developed standards Developing tools and methods for security auditing, penetration testing and intrusion detection Security controls and policy enforcement tools development Security modeling (Attack trees, threat modeling) 25

26 SKILLS WE CAN BRING Security issues: SE based Infrastructure for securing on-line payment, remote access, cloud storage, IoT. TLS stacks that are embedded in SE to enable strong mutual authentication based on certificates and asymmetric keys NFC interoperability communication issues, NFC Low level + Transmission protocol Remote power supply, loading effect, data transmission quality, etc Still ongoing concern and need to take actions to improve the actual situation Not only managing but solving (as far as possible) the NFC communication issues 26

27 Thank you! Questions? WWW Twitter.com/coessi_fr Linkedin/company/coessi 27

Security+ SY0-501 Study Guide Table of Contents

Security+ SY0-501 Study Guide Table of Contents Course Introduction Table of Contents About This Course About CompTIA Certifications Module 1 / Threats, Attacks, and Vulnerabilities Module 1 / Unit 1 Indicators