The Pragmatic Pwn of ICS: Engineering and Cyber Skills to Understand and Attack ICS

No ratings

Presented at s4 2015 by

Bryan Singer

With the rapid rise in ICS vulnerabilities, information exfiltration worms such as Flame and DuQu, and significant research on attack and defense of ICS networks, one thing rings true: There is still very little understanding of what the actual cyber risk is to an industrial process. With most vulnerabilities to date, plant engineering see their highest risk from cyber attacks at best being able to create a nuisance trip in their environment. Or even from assessments as recently as this year, active attacks and malware are often allowed to exist on an ICS network because it is too difficult to fix, and there is perception that it isn’t causing a problem anyway. Engineers tend to rely on engineered layers of protection such as independent relief valves or machine protection systems as a fallback against catastrophic ICS failure scenarios. Fundamentally this is a misunderstanding of what skills are required to attack an ICS. Engineers tend to muse that they are different from IT, but in the next breath when asked to address cyber issues, the first call they make is to IT! Attacking ICS effectively requires knowledge of cyber security, knowledge of the control systems themselves, and knowledge of the actual process in order to be effective. But this knowledge Is not unattainable with the right skills. In this presentation, a sample of a common piece of process equipment, a distillation column, will be analyzed live by experts in both chemical engineering and in cyber security to illustrate the analysis and attack techniques required to complete a successful attack against an ICS environment. It is the intent of this session to demonstrate the skills required to properly analyze, assess, and protect industrial equipment, and how simple vulnerability discovery and research is insufficient when addressing process risk.