Comment

01 December 2004

Safe and Secure

Crowds pack in security sessions; automation industry picking up.

While the industry outlook remained optimistic despite jitters on Wall Street stirred by record-breaking oil prices, it was very easy to find the hot-button topic at ISA EXPO 2004 in Houston. All you had to do was look for the standing-room-only crowds in the security technical sessions. They were easy to find.

Officials needed to bring in dozens of extra chairs to seat attendees at a security standards panel discussion organized by Bryan Singer, chair of the ISA-SP99 standards committee focusing on control systems security. Singer said the SP99 committee's membership now totaled 240 individuals from a broad cross section of industries, including international interests.

Singer said the standards committee's goal was to reduce the complexity of implementing standards, provide a common means for vendors and customers to communicate and receive expert guidance, and reduce industry-wide risks.

Most manufacturing security standards that now exist "are of a guidance nature," he said, and not focused on plant control systems' specific needs.

Agencies involved in related standards, besides ISA, include the National Institute of Standards and Technology (NIST), International Electrotechnical Committee (IEC), American National Standards Institute (ANSI), Institute of Electrical and Electronics Engineers (IEEE), International Organization for Standardization (ISO), Chemical Industry Data Exchange (CIDX), regulatory agencies such as the Food and Drug Administration (FDA), and the U.S. Department of Homeland Security.

However, "manufacturing is not adequately covered" by existing standards, which is why SP99 is actively at work and working with groups like CIDX and NIST, Singer said.

ISA-SP99 has completed the first editions of two key ISA technical reports.

The first, ISA-TR99.00.01, Security Technologies for Manufacturing and Control Systems, appeared in publication on 12 March 2004.

The second technical report, ISA-TR99.00.02, Integrating Electronic Security into the Manufacturing and Control Systems Environment, became available on 12 April 2004.

ISA-SP99 will now focus on developing its first ANSI/ISA standard, while at the same time periodically updating the two technical reports to reflect new information and technology updates, Singer said.

Panel member Joe Weiss, of KEMA Consulting Inc., is heading up an IEEE task force for the electrical power industry, which is looking at improving security against cyber attacks. Based on his experience attending various meetings on the subject, "there is still a lot of disagreement" among various standards-making bodies on definitions of terms, he said.

"ISA is basically coming up with a standard for control systems, and then you can take it back to the other industries" for further refinement, Weiss said.

Security issues at the show were not just limited to the standards arena. Suppliers were keeping a sharp eye on the topic. But they also realized all systems are not tamper-proof.

"I think in a year's time to twenty-four months, security will be a given. Right now, people don't know what they don't know," said Mike Caliel, president of Invensys Process Systems. "I don't think people are prepared today."

Mike Bradley, Wonderware president, agreed users are not prepared, adding, "this will take a while to get it fixed."

Industrial cybersecurity expert Eric Byres brought a new twist to who is really hacking into systems in a panel of government and private industry cybernetworking and critical infrastructure specialists at the session entitled, "Automation Systems—An Achilles' Heel to Our Critical Infrastructure."

No longer are the majority of attacks on industrial computer control systems coming from internal sources, Byres said.

Joining Byres for the forum were Dave Sanders of the U.S. Department of Homeland Security, Dave Scheulen of British Petroleum (BP), Elizabeth Rhodenizer of Public Safety and Emergency Preparedness Canada (PSEPC), and Karl Williams of the U.K.'s National Infrastructure Security Coordination Centre (NISCC).

Byres, research faculty in critical infrastructure security at the British Columbia Institute of Technology (BCIT), introduced research numbers that he and Justin Lowe, principal consultant at PA Consulting Group in London, gathered.

Their breakdown of 13 incidents of industrial intrusion between the years 1982 and 2000 show that incidents were almost evenly split between accidental, internal, and external sources, with only 31% of the events being generated from outside the company. Accidents, inappropriate employee activity, and disgruntled employees accounted for most of the problems.

These statistics correlate well with the numbers expressed by security researchers in the traditional information technology (IT) world at that time. For example, one statistic was widely quoted in 2001: "A study by the FBI and the Computer Security Institute on Cybercrime, released in 2000, found that 71% of security breaches were carried out by insiders."

They then analyzed the same events for the 2001–2003 period. Externally generated incidents accounted for 70% of all events, indicating a change in threat source.

Interestingly, the IT world appears to be experiencing the same shift. For example, Byres quoted a report from Deloitte and Touche:

"Deloitte & Touche's 2003 Global Security Survey, examining 80 Fortune 500 financial companies, finds that 90% of security breaches originate from outside the company, rather than from rogue employees. For as many years as I can remember, internal attacks have always been higher than external," said Simon Owen, Deloitte & Touche partner responsible for technology risk in financial services. "Sixty to 70% used to be internally sourced. But most attacks are now coming from external forces, and that's a marked change."

Why did the threat source change so significantly in such a short period of time?

Byres and Lowe said they have no definite answers, but there are a few possibilities to explain the impact on industrial control systems. First, the emergence of automated worm attacks starting with Code Red on 19 July 2001 means that many of the intrusions have become nondirected and automated. The control system has become just a target of opportunity rather than a target of choice.

Second, Lowe and Byres said, common operation systems (e.g., Windows 2000 or Linux) and applications (e.g., SQL Server) now dominate the human-machine interface (HMI), engineering workstation, and data historian systems. These often come configured more appropriately to business requirements and are vulnerable to a wide variety of common IT attacks and viruses. Issues with applying patches to these critical systems exacerbate the problem.

Finally, the increasing interconnection of critical systems has created interdependencies users haven't been aware of in the past. As the Slammer incident documented by the North American Electric Reliability Council illustrates, Internet incidents can indirectly affect a system that doesn't use the Internet at all. In this case, the power utility used frame relay for its supervisory control and data acquisition (SCADA) network, believing it to be secure. Unfortunately, the frame relay provider utilized a common Asynchronous Transfer Mode (ATM) system throughout its network backbone for a variety of its services, including commercial Internet traffic and the SCADA frame relay traffic. The worm overwhelmed the ATM bandwidth, blocking SCADA traffic to substations.

"All SCADA systems have weaknesses," said InduSoft's Fabio Terezinho, "The only completely secure system is one that doesn't work."

Terezinho, whose presentation was "Is Your Plant Vulnerable to Cyberattack?", spoke before another standing-room-only symposium at the Reliant Center titled "Cyberthreats to Your Automation Systems—Why Worry?"

Donovan Tindill of Matrikon spoke about the increasing rate with which viruses spread, citing some numbers. The Red virus in 2001 infected 24,000 hosts per hour.

The Slammer in 2002 infected 140,000 hosts per hour and infected a nuclear power plant. The Blaster in 2003 moved even faster, and though it did not cause a blackout in the northeast, it certainly encouraged it.

The Sasser virus in 2004 moved faster yet. Likewise, and as a mitigating factor, patches for these virulent maladies develop and become available at a faster rate. A patch for the Sasser appeared within eight days, while back in 2001 it took nearly six months to fix the Red.

"The largest problem is the poor implementation of existing security. Security is not a technical problem, it's a people problem," Tindill said.

During the session, Byres went on to compromise a programmable logic controller (PLC) that he had in the front of the hall running a program of blinking lights. Using a hacker's device called Foundstone that he downloaded from the Internet for free, Byres altered the speed and the direction of the lights, and then he just shut down the PLC altogether.

"This is the state of the Blackhat community's capabilities," Byres said.

The way the Foundstone utility works is that it logs into the machine and peppers it with protocols and checks portals until it finds an open portal and a protocol that works on the device. On the screen, it identifies both.

Another problem is the number of defects per thousand lines of code (KLOC). Byres's studies show 0.6 defects/ KLOC. A modern embedded controller has 100 KLOC.

Byres went on to talk about attack tree methodology as applied to analyzing common SCADA protocol for possible security vulnerabilities.

Attack tree analysis works for many companies and has many applications. As to cybersecurity, it breaks down into these steps.

1. Create a model of ways one can attack the system.
2. Predict how your enemies will attack by comparing their capabilities with your vulnerabilities.
3. Evaluate the impact of each attack scenario.
4. Determine the level of risk associated with each attack scenario.
5. Monitor the system for signs of attack.

With the goal to become "proactive" rather than "reactive" to cyberspace security hackers, Microsoft is spurring ongoing meetings and discussions with major industry groups, a company executive said at Tuesday's session.

"You can chase off hackers in a reactive mode, or you can go into a preventive mode and build up a shield. It's better to be proactive," said Don Richardson, director of Microsoft's manufacturing industry unit in Redmond, Wash.

Asked which manufacturing industry segments had paid the most attention to security, Richardson had a quick answer: "The process industry—by far," he said. "Petroleum, chemical, petrochemical companies . . . to them, it's a very real issue." Discrete industries "are probably a little behind."

Richardson said Microsoft has held security-focused meetings in Redmond with CIDX and also with Microsoft's manufacturing user group (MUG). Agendas covered progress in Microsoft's "trustworthy computing" initiative, launched two years ago; details about Service Pack 2, a major security update recently released to Microsoft users; and input from numerous independent software vendors and customers.

Among issues of interest to manufacturers desiring to download a security patch, Richardson said, is "patch management," but they are concerned about downtime that might result from doing that.

"Feedback has been great," Richardson said. "We've learned the need to get past the emotional issues—who do I blame?" In manufacturing, the challenge is to keep systems running, to keep plant operators from seeing implementing security as "a burden," he said.

"There are some [manufacturing] companies that have implemented very successful strategies—they have strict policies in place—not just software security, but for the entire plant," he said. Ideas come from the bottom up, as well as from the top down.

If security was the top issue on the minds of ISA EXPO show goers, then the state of the automation industry was close behind.

"We're optimistic," said Loren Engelstad, an engineering manager with Emerson Process Management at the company's Chanhassen, Minn., plant. Engelstad said he feels that way because Emerson's products "are seeing increased interest by customers."

Barbara Kline, who works with Ethernet products maker GarrettCom, also sees good signs in the North American economy. "We're confident enough that we've just introduced new product and we're developing more for two to six months down the line," she said.

Another show attendee, whose company sells analyzers to the oil refining business, said his firm's sales were up. "We are not seeing a spike in sales due to $50-a-barrel prices. Our spike is because of the sulfur regulations for gasoline and diesel fuels. Business is good!"

EXPO keynoter John Sieg, director of corporate operations for DuPont, said the chemical giant is enjoying 13% annual growth and is exceeding $20 billion a year in sales.

Microsoft and Invensys disclosed that, to date, more than 180 companies have implemented over 300 projects using Wonderware's technology. Richardson underscored his firm is seeing "good momentum" with many of its partners. Mark Davidson, vice president at Wonderware, said his company's orders have tripled in the past year.

Mark Neas, regional general manager for the southern region for Honeywell Process Solutions, said things are really starting to pick up. "Right now, our customers have the money to spend," he said. "Customers that have put off upgrades have found out that now is a 'must' time for them."

"We just got a good-sized project out of Houston for a [gasoline] pipeline," said Adrian Totten from MTS Sensors. "The company has wanted to do [the project] for the past three years, but they finally pushed it through. That's a good sign."

Iconics's Tim Donaldson said his company is continuing to see growth. "Business is going well. We have had double-digit growth for the last four to five years in HMI-SCADA," he said.

Ellen Fussell, Nick Sheble, Jim Strothman, and Gregory Hale contributed to this report.