State sponsored and financially motivated cyber criminals have targeted automation systems including those that serve water, electricity, and gas utilities. Securing these systems and their digital assets is critical to ensure reliability and continued operations.
Common Threats
Common cyber threats that may affect control systems include:
- Rogue Control: Unauthorized party takes control of a system to perform malicious actions such as adjusting chemical feeds through a Supervisory Control and Data Acquisition (SCADA) system.
- Cyber Warfare: Another nation or terrorist hacks a system to cripple essential infrastructure.
- Disgruntled Employees: A past employee gains access via Virtual Private Network (VPN) privileges that are not terminated at the same time employment ends, or an employee may create a backdoor to access the system without knowledge of the utility.
- Spyware / Data Breach: Sensitive data or customer information is exported from the system, such as credit card numbers or social security numbers.
- Ransomware: Most common cyber-attacks encrypt or lock computer systems, rendering them useless. After such an attack, an entire computer system would need to be rebuilt to prevent the same type of attack from happening again.
Best Practices
The best way to keep your systems safe from cyber threats is to prevent them from happening in the first place. Some common ways malevolent actors gain access is through the following tactics. Utilize the tips below to prevent a would-be attacker from succeeding:
- Email Phishing: A cyber attacker sends an email that attempts to trigger a staff member to provide sensitive data such as a username and password. The emails will often seem urgent and may appear to be sent from a trusted fellow employee. Staff should be trained to carefully review email addresses, not just the sender’s name, before entering information. If there is any doubt, instruct them to contact the fellow employee or their IT Department directly via phone or another existing channel.
- Phishing Via Phone: Phishing scammers may also call staff claiming to be a member of the IT team. The scammer may say they need a staff member’s password to perform updates on their computer. Or they may ask for information such as an internet protocol (IP) address. Employees should be trained to hang up and contact a member of IT directly to confirm it is a legitimate request.
- Brute Force: The cyber attacker guesses passwords until one works. After a data breach, lists of usernames and passwords can be found on the dark web. Scammers can run down a list of these, trying the usernames and passwords until they find one that works. Encourage your staff to use different secure passwords for all their online accounts. Secure passwords consisting of at least 15 characters utilizing a mix of numbers, special characters, as well as upper and lowercase letters will be more difficult for a scammer to guess. Furthermore, varying a person’s passwords across accounts makes it less likely a data breach will expose their work account.
- Open Ports: Cyber attackers scan IP addresses on the internet for open ports. An open port can be found in programs that require open access to the internet. Examples include SCADA, Human Machine Interface (HMI), Wonderware InTouch Access Anywhere, Ignition, alarm software, security systems, and even VPN services. Significant care must be taken when configuring these programs to ensure they are done correctly and do not leave your system vulnerable to attackers.
- Person-in-the-Middle: An attacker sits between two networks or two devices, observing the data transmission to access usernames, passwords, and other sensitive information. It is important to ensure all sensitive data is encrypted before it is transmitted via the internet.
The impacts from a cyberattack could be devastating. Mike Chorne, AE2S Lead I&C Specialist, says during an attack a Programmable Logic Controller (PLC) program that operates a utility could be deleted or destroyed, which would stop automated processes and disable alarms from alerting staff. This type of attack would completely interrupt operations and take the system offline. Another possibility is the data could be modified so facility operators believe infrastructure is operating appropriately when it is not – from an empty water tower to a lift station releasing raw sewage. “A lift station spill or water main break and/or contamination can cause environmental harm, be costly to repair, and erode the trust of your customers. The impacts of a cyberattack can be multifaceted,” says Chorne.
Additional Recommendations
To reduce the chance of a cyberattack impacting your controls systems, Chorne recommends the following:
- Check for weak or default passwords – Use a long, memorable passphrase instead of a short complex password. A phrase made up of several unrelated words is easier to remember and significantly harder for attackers to crack. Aim for 16+ characters, use a unique password for every account, and enable MFA whenever available.
- Add multi-factor authentication wherever available, but for remote access at a minimum. This involves entering a username and password, plus a secure code that can only be obtained by a device physically linked to the end user.
- Remove former employee access or temporary user access immediately when access is no longer needed.
- Seek out qualified technical personnel for assistance in expanding upon the tools and resources available to make your system more secure.
- Provide an appropriate level of access to users and devices to complete assigned tasks. For instance, a PLC does not need direct access to the internet, and a worker who is accessing SCADA does not need direct access to the PLC or to the internet.
- Network segregation – Separate control networks from enterprise networks. Workstations and servers requiring email and internet access should be completely separated (either physically or virtually) from the workstations and servers that make up the control network.
- Apply software patches as quickly as possible. Install patches in a test environment to confirm compatibility with control software prior to deployment in the production environment.
- Review physical security measures – Ensure network closets, server rooms, PLC and control system cabinets, communication equipment, and other points of entry to the network remain secure, access-controlled, and free from unauthorized tampering.
Chorne also suggests developing an Incident Response Plan and updating it regularly as better strategies and procedures become available. In addition, having up to date backups can make the difference between restoring a compromised system in hours as opposed to days or weeks.
Contact AE2S I&C Practice Leader Erika Kukaswadia if you have questions about your SCADA system.