SCADA system’s threat model and Zero Trust Architecture as mitigation

SCADA system E2E full-stack use cases range from RTU, industrial field bus, PLC, frontend/backend integration and physical connectivity planning to core hardware/software modules development concerning lower power/lighting-proof/MTBF and much more factors depending on actual use cases (functional safety and real-time operating, various industry compliances etc.).

Background and facts

According to Gartner 2021 research report, “ by 2025 cyber attackers will be able to weaponize operational technology (OT) environments to harm or kill humans”. Quoted from another research program from Inmarsat on industrial IOT, “Companies are increasingly producing ‘digital twins’ of their supply chains, so each stage is visible and trackable in digital form. 54 per cent of respondents are unable to use IoT data effectively due to security/privacy concerns”.

Quick note: knowing Inmarsat long time ago when I worked on industrial telemetry system, which integrates InmarsatC’ s 300bps data link as VHF/UHF backup into our RTU for remote data collecting, which plays critical role for Reservoir Dam safety monitoring and water reservoir flood forecasting.

Threat model

1. USB removable media and various OT/IT facing connectivity dramatically expands SCADA system’s attack surface. “Adversaries are leveraging USB removable media as an initial attack vector, at which point they will attempt to establish remote connectivity to download additional payloads, exfiltrate data, and establish command and control. ”, quoted from Honeywell cybersecurity threat report 2021. As one of most famous OT targeted attacks, ***Stuxnet*** was a multi-part worm that traveled on USB sticks and spread through Microsoft Windows computers and crippled Iranian nuclear program.

[embed]Industrial Cybersecurity USB Threat Report 2021 SMX analyzes USB devices as they are actively used in industrial facilities, providing a highly focused view of…www.honeywell.com

2. OT side infrastructure lack of modern security protection and access control, making it vulnerable to different class of attacks and intrusion. Conventional SCADA security architecture is based on physical perimeter based defence principle as defined in the Purdue model showed as following diagram. It attempts to protect the OT network by separating it from Internet connected IT network via IDMZ.

Physical perimeter based Purdue threat model is outdated against latest industrial OT/IT Adversary modelling(*MITRE ATT&CK for ICS and OT*) and modern attack vectors eg. supply chain attack and other covert side-channel attacks.

Within SCADA industrial security zone, there are RTU mainly for data collecting and PLC-centric electric control system connecting with all sorts of digital or analog actuators or relay, switches via industrial field bus such as MODBUS, CAN bus, RS485 or industrial Ethernets. RTU and PLC system all connects to field operating centre. This is most critical assets and high-value system requiring protection from bad actors or unauthorized access. Conventional IDMZ can build up isolation firewall between IT and OT security domains, however it cannot protect from bad actors entering from within industrial security zone such as insider attacks, supply chain attacks, USB removable media based attacks and other un-authenticated or un-authorized access via field bus or maintenance interface etc.

In such threat model to deal with insider or supply chain, software update and un-authorized maintenance access, Zero Trust model comes into rescue as an augment on top of physical firewall based protection.

Zero trust model basics

Zero Trust model focuses on providing an identity-centric security policy model for controlling and authorizing access to network, data or any services. It requires strict identity verification with “never trust, always verify”, “explicit permission” and “least privilege” for every user and device trying to access resources on an enterprise’s network, regardless of whether an entity (human or devices, users, admins) is within the network or accessing the network remotely.

Some important attributes Zero Trust Model are presented as follows:

1. Identity and Access Management (IAM): is used authenticate entities and as a source of context for making policy decisions. Cryptography keys or identity X509 certificates are generally used for user or device identities.
2. Multi-Factor Authentication (MFA).
3. Micro-Segmentation and Privileged Access Management: Micro-segmentation uses Software Defined Perimeter (SDP) to compartmentalize small zones with separate access and least privilege. Micro-segmentation facilitates granularity of networking controls and and helps preventing attackers from moving laterally across the network(secure by separation). SDPs require endpoints to authenticate and gain authorization using identity-based solution before obtaining network access.
4. Continuous authentication and intrusion detection during run-time.

Zero Trust as Augment mitigations defending legacy SCADA industrial system

Zero Trust model requires continuous authN and authZ on each ongoing transactions. Principle of least privilege and access control applies to both micro-segments and users in finer granularity.

Define the network: Organizations’ attack surface is constantly evolving, which makes protecting the entire surface an impossible task. Implementing Zero Trust begins with defining the attack surface to be protected, such as critical applications, assets, data and services.

Map traffic: The flow of traffic across the network then needs to be mapped and documented to gain insight around how resources interact. This provides context around the controls required to protect applications and data.

Architect the network: The Zero Trust architecture can be mapped to the needs of a business, starting with a next-generation firewall (NGFW). The NGFW provides a segmentation gateway or micro-perimeter around the business’ protected surface, which enables them to add further layers of access control and inspection.

Create a policy: With the network architected, a Zero Trust policy enables the business to whitelist devices and people. This allows them to define who should have access to which resources, where resources are accessed from and further granular enforcement to only enable legitimate traffic.

Monitor and maintain: The final step ensures the Zero Trust architecture is logged and monitored to provide valuable insight into network activity and allowing them to follow their required processes to approve updates for on-premises devices.