ICS Security Update. Jacob Herbst, CTO, Dubex A/S. Den 26. januar 2018

Transkript

1 ICS Security Update Jacob Herbst, CTO, Dubex A/S Den 26. januar 2018

2 TILBAGEBLIK

3 WannaCry 12. maj 2017

4 Sundhedsvæsnet - England Fartovervågning Australien Bilfabrikker - Frankrig Offentlig transport - Tyskland

5 27. juni 2017 (Not)Petya

6

7 "In the last week of the quarter we were hit by a cyber-attack, which mainly impacted Maersk Line, APM Terminals and Damco. "Business volumes were negatively affected for a couple of weeks in July and as a consequence, our Q3 results will be impacted. We expect that the cyber-attack will impact results negatively by USD $ M." Søren Skou, CEO of A.P. Moller-Maersk

8 The worldwide operations of TNT Express were significantly affected during the first quarter by the June 27 NotPetya cyberattack. Most TNT Express services resumed during the quarter and substantially all TNT Express critical operational systems have been restored. However, TNT Express volume, revenue and profit still remain below previous levels. Omkostninger: USD 300 mio.

9 ICS Speciffic malware CRASHOVERRIDE (A.K.A. INDUSTROYER) TRITON This malware was built to target different critical infrastructure environments. It had capabilities of performing attacks for multiple ICS protocols such as IEC 101 and 104, IEC 61850, and OPC. While these protocols are mainly used in electric power, they are also leveraged in other ICS industries. Once on a system, CrashOverride looks for configuration files necessary for instrumenting remote terminal units (RTUs) and intelligent electronic devices (IEDs). The purpose is to learn about the actual memory addresses to target the most critical control points. CrashOverride had the interesting ability to operate independently of the initial Command and Control (C2). This means that after the initial incident, CrashOverride could maintain activity on the network without the need to speak to the C2, bypassing the most common behavioral checks. The malware has directly affected the civilian population, causing a blackout in Ukraine. This was the most recent malware tailored to attack an Operation Technology (OT) environment, and more specifically, safety instrumented system (SIS) controllers from Schneider Electric (Triconex 3008 processor modules). Until TRITON, there had been only four publicly known malwares specifically designed for OT environments: Stuxnet, Havex/Dragonfly, Blackenergy2 and Industroyer. The attackers reverse engineered the proprietary TriStation protocol and embedded specific functions necessary for the malware to disrupt the SIS controllers, such as halting the device or writing to memory. TRITON - Schneider Electric Analysis and Disclosure

10 Aktør & motiv Angreb Evner & metoder Mulighed

11 Aktører - hvem angriber os? Spionage Konkurrenter Terrorisme Politiske & aktivister Cyberkrig Kriminelle Angreb Interne

12 Motiver - hvorfor bliver vi angrebet? Organiserede kriminelle Stater og regeringer (efterretningstjenester) Politiske aktører (aktivister & terrorister) Vandaler Interne Økonomisk berigelseskriminalitet Industrispionage Politisk motiveret Vandalisme Internetsvindel (CEO fraud) Tyveri af kreditkortinformation Identitetstyveri Denial of Business DDoS & Ransomware Målrettede angreb efter fortrolige informationer Informationlækage Sabotage

13 Alle angreb er avancerede angreb Regeringers cybervåben overfører avanceret teknologi til kriminelle Social engineering Indirekte angreb via betroede eksterne tredjeparter

14 Metoder - Hvordan bliver vi angrebet? - aktuel status Metoder Angreb, der omgår perimeterforsvaret Angreb via tredjepart Angreb mod brugere Social engineering angreb f.eks. phishing Angreb via sociale netværk Webbaserede angreb Indirekte angreb rettet mod klienter Indirekte angreb via betroede eksterne tredjeparter Angreb sløret i krypteret ssl-kommunikation Sårbarheder og avancerede dag-0-angreb Hurtig udnyttelse af sårbarheder Udnyttelse af ukendte sårbarheder dag-0 Unik og målrettet malware Angreb uden malware scriptbaserede IoT og Cloud. Angreb via tredjepart Målrettede angreb er simple Avancerede angreb er blevet det normale Living-ofthe-Land Phishing e- mail Ukendt dag- 0-malware

15 Statistik over ICS sårbarheder Number of new vulnerabilities found in ICS components Vulnerabilities by severity level Localization of new vulnerabilities in ICS components Types of vulnerabilities in ICS components Number of vulnerabilities disclosed in 2017 by major ICS vendors

16 Online accessibility of ICS components ICS components accessible online Number of Internet-accessible ICS components, by protocol 1911 Tridium Niagara Fox The Fox protocol, developed as part of the Niagara framework from Tridium, is most commonly seen in building automation systems (offices, libraries, Universities, etc.) Google, Shodan (shodan.io), and Censys (censys.io)

17 Anbefalinger Segmenter ICS operative netværk fra virksomhedens LAN og eksterne netværk. Begræns fysisk adgang til ICS-netværk og -komponenter. Foretag en streng adgangskodepolitik. Konfigurere netværksudstyr og firewallregler korrekt Beskyt privilegerede konti Minimer rettigheder for brugere og tjenester. Brug antivirus software. Installer regelmæssigt opdateringer til operativsystemer og applikationer Overvåg aktiviteter og netværkstrafikken

18 Kommende arrangementer her kan du møde os Dubex Security & Risk Management Summit marts 2018, Konference DGI-byen Deltag og få indblik i udviklingen inden for itsikkerhed og risikostyring i både offentlige og private virksomheder. Dubex Security & Risk Management Update maj 2018, Konference, Horsens, Scandic Bygholm Park, Horsens Vores årlige konference i Jylland med fokus på it- og informationssikkerhed og risikostyring i både offentlige og private virksomheder. Infosecurity Denmark maj 2018, Øksnehallen, København Dubex' og Delacours GDPRuddannelse - uddannelse i EUpersondataforordningen Hold i København: - Dag marts Dag april 2018 Læs mere på

19 Hold dig opdateret Tilmeld dig Dubex nyhedsbrev Besøg Følg Dubex på LinkedIn & Twitter Deltag på Dubex arrangementer twitter.com/dubex

20 Tak! Dubex A/S Jacob Herbst, CTO Tlf