Cyber attacks to Industrial Control Systems (ICS)

An industrial control system are those facilities that allow manufacturing a product (food, beverages, medicines etc), provide a service (electric power, gas, water, etc.), even other less conventional industries such as power generation, extraction of oil etc.

Components

According to the NIST in GUIDE TO INDUSTRIAL CONTROL SYSTEMS (ICS) SECURITY an ICS is composed of two main elements:

• Control Components: 

Composed for

• Control server
• Scada Server o MTU
• Remote Terminal.
• Programable Logic Controller (PLC)
• Intelligent Electronic devices (IED)
• Human Machine Interfaces (HMI)
• Data historian
• Sensors and actuators or I/O

• Network components

Composed for

• Fieldbus Network
• Control Network
• Communications Routers
• Firewall
• Modems
• Remote Access Points

Cybersecurity in ICS still have deep gaps to solve, among them and more difficult to evaluate are all those behaviors that would allow a social engineering attack, Kaspersky Lab has shown 5 myths about industrial safety that can make operational personnel think that there is no risk in a certain activity.

Image Credit: <tfldz.com>

1. Myth 1. Control systems are not connected to the internet

Although many companies are still on their way to a digital transformation, it is still possible to find that control systems do not control both physically and logically open ports, the use of easy-to-use USB devices and large storage capacities opens up the door for the operation or maintenance personnel to allow the insertion of a malicious code in the control systems without having to be connected to the internet.

2. Myth 2. Firewall is enough

A firewall is a device that monitors network traffic and decides whether to block it or not, for this uses predefined rules defined, from the point of view of an attack, there are threats such as outdated firmware, updates to the rules, etc. as well as the configuration and access by the staff.

3. Myth 3. Control systems are closed systems

PLCs, DCS and PAC are programmable systems, generally from a portable computer, social engineering can be done to download malicious updates to the controllers, for this it is not necessary to know of controllers only to have access to valid packages and tools to modify them, generally these updates are available in manufacturers' pages.

4. Myth 4. Nobody can be interested in tying us

Attacks do not always look for a particular objective, they can be only a game or perhaps a trial for the attacker, from the point of view of the control systems the integrity of the data that is generated must be total, therefore not be the main objective an exit line in one of them can be disastrous.

5. Myth 5. We trust our security systems.

Each day new attacks are generated, more and more sophisticated, implementation of a system by itself does not guarantee protection, therefore the operation, maintenance personnel and all those who interact with control system must be made aware so that it is strengthened security system.