Why firewalls are not recommended for securing SCADA systems
PLC
Why firewalls are not recommended for securing SCADA systems
Alex · 30 November 2016
SCADA systems need to be secure, yet according to one expert, firewalls are not up to the task, and should be replaced with Unidirectional Security Gateways. Learn what to look for in a USG.
There are those who say the only reason critical American infrastructure, such as the power grid, has not been digitally hacked and taken down is that doing so would affect the bad guys as much as us. However, that is not much consolation when the Department of Homeland Security's (DHS) Critical Infrastructure 2025 Strategic Risk Assessment report states:
"... information and communication technology (ICT) is highly likely to continue being extensively incorporated into critical infrastructure during the next decade. As a result, the variety of cyber-physical system components (operating systems, computational hardware, and firmware) in ICT is likely to make universal security across critical infrastructure sectors problematic creating immeasurable vulnerabilities and attack vectors."
The immeasurable vulnerabilities and attack vectors are part and parcel of what are called Supervisory Control and Data Acquisition (SCADA) systems. Carl Gould, co-director of software engineering at Inductive Automation, defines SCADA as:
"A SCADA system at its most basic is a software system that is used for controlling, monitoring, and analyzing an industrial process."
"A SCADA system communicates, in real-time, with controllers out in the field that are running the actual process," continues Gould. "The SCADA system will gather real-time information from the field controllers, bringing the data into the SCADA system where it is presented using a Graphical User Interface (GUI), to the operators who are in charge of the process."
Operational computers, the in-place SCADA system, and field controllers must be networked and are often accessible via the internet. It does not take much of a stretch to see how nefarious types could remote in and take control of some vital process such as the power grid through the SCADA system. The DHS's Strategic Risk Assessment report mentions that in 2014, Industrial Control Systems-Cyber Emergency Response Team (ICS-CERT) reported 245 cyber-related incidents, most of which were in the energy sector.
More about IT Security
The Strategic Risk Assessment report then adds, "According to ICS-CERT, the scope of incidents encompassed a vast range of threats and observed methods for attempting to gain access to both business and control systems infrastructure, including unauthorized access and exploitation of internet-facing Industrial Control Systems and SCADA devices."Firewalls vs. Unidirectional Security Gateways
Most networks, including SCADA systems, are currently guarded by firewalls. Andrew Ginter, vice president of industrial security at Waterfall Security, says that can contribute to the vulnerability problem. SCADA traffic, both inbound and outbound, is controlled by the firewall's software, which could have built-in weaknesses or have programming errors. (For more information, refer to Ginter's ISA paper: 13 ways through a firewall: What you don't know can hurt you.) In this HelpNetSecurity podcast, Ginter mentions, "All software has bugs; firewalls can be hacked." Ginter prefers to use devices called Unidirectional Security Gateways (USGs) because the one-way flow of traffic disallows adversaries to remote—which requires two-way traffic flow—into SCADA systems and control them. USGs consist of a transmit module and a receive module as depicted in the diagram in Figure A. Figure A
The transmit and receive modules are connected via a short fiber-optic cable. The transmit module contains a fiber-optic laser, allowing it to send traffic through the fiber-optic cable to the photocell in the receive module. The point being that optical traffic can only flow one way.