Review of Supervisory Control and Data Acquisition (SCADA) Networks

Abstract

Supervisory Control and Data Acquisition (SCADA) networks are used across the globe to manage commercial and industrial control systems connected to energy, water and telecommunications infrastructures, as such they are a prime target for cyber-attacks by criminals, rogue states and terrorists. Remote Terminal Units and Intelligence Electronic Devices in these networks have resource limitations, which make security applications a challenging issue. Efficient key management schemes are required besides lightweight ciphers for securing the SCADA communications. Most industrial sectors are in transition from legacy protocols to Internet Protocol-based (IP-based) communications. An unplanned consequence of implementing IP communications is that SCADA and Industrial Control Systems (ICS) have become very popular targets of attack. Access to the devices in these networks must be secured or critical equipment and information face the risk of compromise. This paper presents a review of the current state of our SCADA systems and advocates for encryption methods to enhance protection. It first discusses the purpose of the study, its significance, sample research method used, data collection and analysis approach.

Keywords

Supervisory Control and Data Acquisition (SCADA), Industrial Control Systems (ICSs), Internet Protocol-based (IP-based), Critical infrastructure (CI), Cyber Emergency Response Team (ICS-CERT), Cryptography, Encryption, Internet Protocol Security (IPsec), programmable logic controller (PLC), Modbus, Replay Attack, Man-in-the-Middle Attack, Brute Force Attack, Dictionary Attack, Eavesdropping, Denial-of-Service Attacks, War Dialing, Default Passwords, Advanced Encryption Standard (AES), and algorithm.

Problem Statement of the Study

The major security problem we are currently facing with our SCADA is our inability to adequately secure the communication system within these networks. Even though there are tried and true established and trusted encryption systems purposely designed for industrial use and SCADA, the overwhelming majority of these systems which serve as the collection and monitoring nerves of sensors and systems to control and/or supervise processes such as our power grid, gas terminals, telecommunications, transportation and other critical infrastructure do not use any authentication or encryption methods. To delve deeper into this issue, which is crucial to ensuring safe and reliable resources for all, the following sub-questions will be thoroughly researched and discussed.

• What are the threats and vulnerabilities of SCADA?
• Are these threats and vulnerabilities significant?
• How easy will it be exploit the vulnerability of these systems?
• What will the exploitation of these systems do to an organization?
• Who will be affected?
• What are some suggested mitigation measures to reduce the impact?
• What encryption techniques can be utilized to secure SCADA systems?

Purpose of the Study

Several attacks on our critical infrastructure serves to highlight the importance of protecting critical infrastructure data and SCADA control systems with the strongest high-assurance encryption.

Years ago, before cyber became cyber, SCADA systems were considered secure. However, as the world has become more connected with technology, doors have opened for cyber-terrorists and state-sponsored malicious actors. Unfortunately, today we are witnessing a direct equation of connectivity equal vulnerability.

Most, if not all of our critical infrastructure (energy, water, telecommunications, rail and traffic management) is controlled by SCADA systems that are connected to the rest of the world via high-speed data networks. Their vulnerability to hackers and other cyber-criminals cannot be underestimated.

Whilst a self-contained private network or “air-gapped” system would make it more difficult for unauthorized parties to access SCADA data, it wouldn’t be impossible. Given the critical nature of infrastructure control systems, they are a prime contender for the strongest protection – high-assurance encryption.

According to an article on www.peerlyst.com, “Critical Infrastructure (CI) systems need to be protected from eavesdropping, but more importantly against the injection of rogue data. The impact of fooling a water treatment plant into thinking a process had already been completed, or a power plant to think it was cooler than it really was, could be catastrophic.”

The article notes further that “one of the core components of a high-assurance encryption solution is the end-to-end, authenticated nature of the encryption. It is this authentication that delivers one of the critical security benefits of high-assurance encryption” (Senetas, 2018).

Without a doubt, if ever there was a data network technology that demanded the strongest high-assurance, authenticated encryption security, it has to be SCADA. In an ideal world, where SCADA control systems are used, the first rule should be to never connect it to the Internet. It is simply not secure enough to entrust with control of our critical infrastructure. Unfortunately, that would be too ideal. Further research supports “that whatever high-assurance encryption solution is chosen, it should also be “crypto-agile” and quantum ready. That ensures the best long-term encryption security solution” (Senetas, 2018).

Significance of the study

SCADA, a system for gathering real time data, controlling processes, and monitoring CI equipment from remote locations is a popular target for attacks. As more companies are implementing an open SCADA architecture through the Internet to monitor CI components such as power plants, oil and gas pipelines, chemical refineries, flood control dams, and waste and water systems, vital systems are becoming increasingly open to attack.  Communications protocols are necessary for the movement of electric power, gas, oil, and transportation, and great interest in these systems has yielded several attacks in recent years. Some attacks were viruses specifically targeting programmable logic controller (PLC) and SCADA systems. Even though there are proven and reliable encryption systems designed for industrial use, the overwhelming majority of SCADA systems in use do not use any authentication or encryption methods. In addition, they often use clear text communications. This presents an attack vector, allowing the insertion of illegitimate commands or the capture, modification, and replay of system commands by an attacker. Another problem that is rarely discussed is that SCADA systems tend to be promiscuous—endpoints and concentrators accept data from any host regardless of whether an authorization has been received or not.

As more sophisticated and successful cyberattacks are launched, increased attention is being given to the security and protection of SCADA systems. According to the Industrial Control Systems Cyber Emergency Response Team (ICS-CERT), the energy sector is a popular avenue for cyberattacks. Given the projected growth in the electric power market in the near future, it is essential that the security of these systems be addressed. With more systems connected by networks, operators must take special care to ensure that these systems are not vulnerable. Online threats to SCADA pose as much risk as physical attacks. As cybercriminals become more sophisticated and understand more about SCADA and ICSs, the risk of attack becomes greater. In order to defend against such attacks, users must learn the sequence of events and methods by which an attacker is able to be successful. Appendix A expands on this. SCADA systems, in addition to presenting information to operators, acquire data from remote locations. These kinds of communications between devices are the foremost attack avenue for criminals.

The widespread use of encryption is new to the SCADA world. Today, encrypted protocols are in use by some progressive critical infrastructure sectors. Relays and breakers are essential to the safe and secure transmission of electrical power. The gas in a pipeline is protected by sensors and valve controls. These systems require protection from espionage and attack from illegitimate operation commands.  Attackers have several methods to exploit vulnerabilities and gain unauthorized access to critical systems. This includes replay attack, man-in-the-middle, brute force, dictionary, eavesdropping, denial of service, war dialing and default passwords.

Sample Research Method used

To delve into the issues of how encryption techniques can be utilized to secure SCADA systems, I mainly used the qualitative method; specifically narrative and case study. I also used secondary data analysis, literature review and archival study.

Data Collection Approach

I utilized existing data/data mining for my research. 75 % comprised of online research, 10% comprised of literature research at the library and 15% from general knowledge obtained throughout my coursework. Literature review played a great role in my research. The date range from the materials I used are 2000 – present.

Data Analysis Approach

There is a wide range of literature that documents the importance of encryption to SCADA in particular and all networks in general. I used an inductive approach for my data analysis since I was condensing extensive and raw data into an abbreviated research paper. The following questions were researched;

• What are the threats and vulnerabilities of SCADA?
• Are these threats and vulnerabilities significant?
• How easy will it be exploit the vulnerability of these systems?
• What will the exploitation of these systems do to an organization?
• Who will be affected?
• What are some suggested mitigation measures to reduce the impact?
• What encryption techniques can be utilized to secure SCADA systems?

First, threats and vulnerabilities of SCADA include replay, man-in-the-middle, brute force, dictionary, eavesdropping, denial-of-service, war dialing and default passwords. These are discussed in detail in the following pages.

Secondly, are these threats and vulnerabilities significant? Without a doubt, yes. These electronic real-time process networks, across the globe, are all the time subjected to serious cyber damage and disruption by due to the fact that they are standardized and remain connected to other networks. A few years ago, a report was released by the President’s Commission on Critical Infrastructure Protection outlining the country’s reliance on increasingly vulnerable, interconnected physical and cyber infrastructures. An important policy document known as the Presidential Decision Directive 63 (PDD63) defined critical infrastructure as “those physical and cyber-based systems essential to the minimum operations of the economy and government” (Homeland Security Digital Library, n.d).  It defined critical infrastructure as including: telecommunications, energy, banking and finance, transportation, water systems, emergency services and essential government services.

Thirdly, how easily can the vulnerabilities be exploited? The recent drift in software and hardware standardization used in SCADA systems makes it even easier to conduct SCADA specific attacks. “Thus the security for SCADA systems can no longer rely on obscurity or on being a function of locking down a system”. (Zhu, B., et all, 2011) Figure 1 depicts a typical Modbus frame. It “is a de facto standard of application layer protocol used in industrial networks. A Modbus client (or master) can send a request to a Modbus server (or slave) with a function code that specifies the action to be taken and a data field that provides the additional information.” In addition, “given that Modbus does not have encryption or any other security measures, there are many ways to directly explore such weakness on the function code level.” (Zhu, B., et all, 2011)

The exploitation of these systems will cripple an organization and could possible make an organization non-functional. These attacks have a tendency to disrupt and destroy our  critical infrastructure, cause major budgeting issues, pollute ecological environment and even more dangerously, claim human lives.

The entire nation as well as its bordering nations and several parts of the world who depend on us will be affected if an exploitation was successful.

Some suggestions to lessen the impact of  an exploitation are, implementing access control instructing engineers on the importance of password or PIN management, advocating the use of passwords in documentation and training materials, implementing two tiered access controls and  obfuscating the password length. Properly implemented, Public Key Infrastructure (PKI) certificates enable authentication, encryption, and non-repudiation of data transmissions.

Lastly, implementing packet level encryption techniques that can be utilized to secure SCADA systems. Through proper use of cryptography and cryptographic algorithms, it is possible to achieve private communications with improved assurance of communicating partner identity. According to Igure, et all, (2006) the American Gas Association (AGA) has “developed a set of good cryptography standards for protecting SCADA network communications. Its purpose is to provide assurance of message integrity while maintaining the performance requirements of the SCADA link. This is achieved by connecting additional cryptographic modules at each end of the SCADA serial link. At the transmitting end, the module encrypts the message packet before transmitting it onto the receiver. At the receiving end, the module decrypts each packet before forwarding the SCADA message to the receiver device. The modules use a cryptographic implementation technique called “position-embedded” cryptography. This makes it difficult for an attacker to randomly insert malicious packets into the SCADA message.”

Introduction

“Using encryption on the Internet is the equivalent of arranging an armored car to deliver credit card information from someone living in a cardboard box to someone living on a park bench.”

                                    — Gene Spafford

This section of the paper discusses several threat vectors and encryption techniques that can be utilized to secure SCADA systems. Understanding threat vectors is important for countering and protecting against them. There are several key threat vectors which must be understood to ensure that the appropriate security is applied. Some are discussed below.

Replay Attack: A replay attack occurs when a malicious attacker intercepts, captures, and stores communications for later reuse. For example, when the attacker faces a prompt for a password, the stored data (e.g., the captured password) is sent. Another example is an intruder who captures a wireless communications stream sent to a SCADA device plays back the command later.

Man-in-the-Middle Attack: In this attack, the attacker puts himself between different users or devices. The attacker makes an independent connection to the network, breaks the connection of the user or device under attack, then impersonates the connection to which the victim was connected. The connection is then reestablished through the attacker, and the victim’s data are forwarded to the original endpoint. Once a connection is established, the attacker can control the connection, eavesdrop on data passing through, and inject fabricated messages.

Brute Force Attack: Brute force attacks target encrypted data and/or passwords. It attempts to decode encrypted messages by using all possible key combinations – a trial and error approach. In 2018, ICS-CERT released a quarterly report showing a sharp increase in brute force attacks against critical infrastructure. Unfortunately, the number continues to rise. (Dept. of Homeland Security, 2018)

Dictionary Attack: attempts to illegally gain access to a system by using dictionary words as possible passwords. 

Eavesdropping: Eavesdropping occurs through many forms such as sniffing or snooping.  For an attack against a SCADA system, the attacker must first obtain information about the system either through passive or active means. The best countermeasure for eavesdropping is data encryption.

Denial-of-Service Attacks (DoS): This attack is launched with the intent of halting the availability of network services. The network is flooded with an abundance of requests, causing oversaturation, so much, so that legitimate traffic is halted. Electric power grid operators have been targets of DoS attacks. On May 2019, Sobczak reported a DoS attack at a Western utility company, significant enough for the company to file a report.

War Dialing: This is a technique used to identify modems which are popular targets because they are connected to a company’s internal network. War dialing calls a range of phone numbers with the intent of discovering modems and logging their numbers for future uses. When a connection is established, the attacker can obtain a command or login prompt and gather information about the device from the banner. 

Default Passwords: This is probably the greatest risk to network systems. Many devices still use default passwords, assigned by the device manufacturer.

This next section discusses encryption and authentication methods that can be used for SCADA. There are many methods, programs, and techniques linked to Internet Protocol (IP) communications to compromise systems. In order to mitigate these types of attacks there needs to be a basic understanding of encryption methods.

  Strong encryption algorithms provide confidentiality, while integrity is provided with the use of message validation schemes known as checksums and hashes. A hash is a one-way mathematical function that transforms a string of data into a fixed-length. This one-way operation means that the input data cannot be re-created from the hash value. By comparing the hash value of a sent message to the hash value of a received message, the receiver can easily confirm that the message was not altered.  Wrapping SCADA traffic in a protective IPsec stream provides secure communications between a gateway and end devices. 

Advanced Encryption Standard (AES) is a globally recognized standard for encrypting data. AES splits data into groups called matrixes and operates on each one. The AES algorithm performs multiple rounds of scrambling the data by substituting data, shifting rows, and mixing columns. As with the goal of any encryption, AES provides data confidentiality and integrity. It is the most widely used symmetric key algorithm (i.e., an algorithm in which a single key is used to encrypt and decrypt).

Conclusion

Encryption can and should be applied to SCADA systems to provide security, confidence in data integrity, confidentiality of sensitive information, and authentication and authorization of the operator. The objective of any security plan is to reduce risk. Encryption is very important for engineering access; authentication is important for real-time. Encryption lowers enterprise risk when selected and applied correctly. It also allows an organization to control who has access to information and how it is seen.

Strong encryption with authentication provides great defense. Encryption alone for SCADA may be inadequate for some types of attacks. Defense-in-depth should be utilized.

A single measure cannot solve all security threats. In short, SCADA systems require end-to-end authentication to be secure.

Appendix A

Vulnerability – Public access to communication lines

Threat: Malicious intrusion

Attack: Intruder scans hundreds of phone numbers. When a possible connection is detected, multiple returns. Login dialogue is acquired, followed by social engineering to determine login information or dictionary-based or brute force attack is launched.

Once connection is completed, attacker gains entry to shut off the device, gather data, change settings, plant instructions, change the data and/or degrade the device. Several actions can be taken by the attacker to destroy or manipulate the system and harm populations.

References

• Ahmed, N. (2019). Cyberattacks on manufacturers could bring UK to its knees. Retrieved 1 July 2019, from https://www.raconteur.net/manufacturing/manufacturing-cyberattacks
• Bartman, T., & Carson, K. (2019). Securing communications for SCADA and critical industrial systems – IEEE Conference Publication. Retrieved 1 July 2019, from https://ieeexplore.ieee.org/document/7914914
• Brute Force Attacks Conducted by Cyber Actors | CISA. (2018). Retrieved 2 July 2019, from https://www.us-cert.gov/ncas/alerts/TA18-086A
• Fernandez, J., & Fernandez, A. (2005). SCADA systems: vulnerabilities and remediation. Journal Of Computing Sciences In Colleges, Volume 20(Volume 20 Issue 4, April 2005 Pages 160-168), 160-168. Retrieved from https://dl.acm.org/citation.cfm?id=1047872
• Hildick-Smith, A. (2005). Retrieved 1 July 2019, from https://www.controlglobal.com/assets/Media/MediaManager/wp_026_security_sansinstitute.pdf
• Igure, V., Laughter, S., & Williams, R. (2006). Security issues in SCADA networks. Retrieved 1 July 2019, from https://www.sciencedirect.com/science/article/pii/S0167404806000514
• Mamidi, V. (2019). Prediction Series #2: Companies are unprepared for cyber-attacks that continue to threaten ICS/SCADA systems – Virsec Systems. Retrieved 1 July 2019, from https://virsec.com/even-though-companies-are-unprepared-cyber-attacks-continue-to-threaten-ics-scada-systems/ 
• Oman, P. & Schweitzer, E. (2000). Concerns about intrusions into remotely accessible substation controllers and SCADA systems. Retrieved 1 July 2019, from http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.20.6519&rep=rep1&type=pdf
• Presidential Decision Directive 63: Protecting America’s Critical Infrastructures [Fact Sheet]. (1998). Retrieved 1 July 2019, from https://www.hsdl.org/?abstract&did=3544
  • Top of Form
• Bottom of Form
• SCADA Cyber Security | Yokogawa America. (2019). Retrieved 1 July 2019, from https://www.yokogawa.com/us/library/resources/application-notes/scada-cyber-security/
• Sobczak, B. (2019). SECURITY: ‘Denial of service’ attack caused grid cyber disruption: DOE. Retrieved 2 July 2019, from https://www.eenews.net/stories/1060254751
• Staff, M. (2019). Critical infrastructure cyberattacks: nations still aren’t ready. Retrieved 2 July 2019, from https://www.raconteur.net/technology/critical-infrastructure-cyberattacks
• Why SCADA systems require high-assurance encryption security – Senetas. (2019). Retrieved 2 July 2019, from https://www.senetas.com/why-scada-systems-require-high-assurance-encryption-security/
• Yun, J. (2008). High-Performance Computer Security Solutions Protect SCADA Networks. Retrieved 2 July 2019, from https://www.utilityproducts.com/test-measurement/article/16003455/highperformance-computer-security-solutions-protect-scada-networks
• Zhu, B., Joseph, A., & Sastry, S. (2011). A Taxonomy of Cyber Attacks on SCADA Systems – IEEE Conference Publication. Retrieved 1 July 2019, from https://ieeexplore.ieee.org/abstract/document/6142258