Home » Cyber Security Issues » SCADA
SCADA: Get the FactsWhat is SCADA?SCADA stands for Supervisory Control and Data Acquisition. SCADA systems are computer-based monitoring tools that are used to manage and control critical infrastructure functions, such as the transmission and distribution of electricity, pressure and proper flow of gas pipelines, water treatment and distribution, wastewater collection, chemical processing and railway transportation systems control, in real time. They are just one implementation of Process Control Systems (PCS), a term commonly used in conjunction with SCADA. SCADA systems collect, display and store information from remotely-located data collection transducers and sensors to support the control of equipment, devices and automated functions. They are comprised of all hardware and software elements associated with the control and monitoring of a system, including graphical user interfaces (GUIs), databases, sensors, relays, switches, remote terminal units (RTU), networks and applications. A SCADA system is software that is positioned on top of hardware to which it is interfaced, often through Programmable Logic Controllers (PLCs) or other commercial hardware modules. While SCADA systems are most commonly used in industrial processes such as power generation and distribution, they are also used in experimental facilities such as nuclear fusion. A SCADA system’s primary function is to efficiently transfer information to and from a wide range of sources and locations, while ensuring that data integrity and appropriate updates are maintained. How have SCADA systems evolved in recent years?Before the 1960s, utility plants were monitored and managed by humans. For example, to turn on a water valve, an employee had to physically come to the water plant to do so. At that time, SCADA devices were only connected by phone lines and dedicated circuits. When computer use became mainstream in the 1980s, SCADA systems ran on DOS, VMS and UNIX, but were traditionally “walled-off” from the corporate networks. Today, almost all SCADA systems have moved to Windows NT/XP or Linux operating systems and are connected to corporate TCP/IP networks. In fact, much of the Western world’s critical infrastructures such as water, electricity and transportation systems are completely automated and computerized, running on these electronic, software-based control systems. Until recently, SCADA systems were often used in a reactive manner to identify system faults as they occurred, recording system data and events for later analysis. With escalating demands on businesses for increased efficiency, SCADA systems have been re-architected to now include data management functionality that prevents problems, rather than recording them. Unfortunately, the security of SCADA systems is lacking, due to the narrow focus on using the systems for increased productivity, reliability and greater operating efficiencies. Why is SCADA security receiving increased attention?Because today’s SCADA systems are completely computerized and located on centralized networks, they are a tempting target for a major physical or cyber attack. SCADA equipment often covers large geographical areas with some equipment residing in remote locations. These remote areas are an easy target for intruders or vandalism. Protecting these vital plants from system failures, intrusions or terrorist attacks is critical to the viability of overall critical infrastructures. A major physical or cyber attack on the control and data systems of electric power plants, or oil and gas refineries and pipelines could potentially bring a country to a halt. The problem is compounded because private companies control 85 to 90 percent of critical infrastructures, leaving governments few avenues to ensure that IT systems are secure. The increased adoption of technologies with known vulnerabilities, the widespread use of commercial-off-the-shelf (COTS) systems and the increased connectivity of SCADA systems to the Internet are the key reasons why the security of SCADA systems must be given higher priority. The disruption of utilities and other critical infrastructures could be harmful to both the environment and the general public. What are the main threats to SCADA systems?SCADA systems, like all computer networks, are vulnerable to hacking, intrusions, viruses, data loss, data alteration and the like. There are four main threat categories to consider:
Most utility companies are finding it difficult to deploy security measures such as anti-virus and firewalls because of technical challenges with the current systems in place. Many older Distributed Control Systems (DCS) and SCADA systems cannot accommodate current enterprise security solutions that soak up central processing unit (CPU) capacity and clog connectivity. Patching vulnerable software is a key challenge due to the network downtime that utility companies cannot afford and the risk that security patches could interfere with the operation of existing applications. Most SCADA systems operate in real-time and cannot be offline for lengthy upgrades or security installations, for fear of degradation in performance. Additionally, there is too much widely-available public information about utility companies’ corporate networks, which could be used for a more focused network attack. Have there been any SCADA-specific attacks to-date?A few of the most well-known, verified SCADA security incidents include:
Some have speculated that the blackouts across the Northeastern United States in August 2003 might have been caused by a SCADA-related attack, as it left 50 million customers and parts of eight states and Canada without power. The outage cost an estimated $7 billion to $10 billion in financial losses and shut down parts of a two million barrel-per-day pipeline and airports in 13 cities. What has the U.S. government done to address SCADA security in recent years?Over the past few years, the U.S. Department of Homeland Security (DHS) has become increasingly concerned over the lack of security of SCADA systems because many of these control systems are owned by private companies and are increasingly being interconnected to improve efficiency. Because SCADA and other types of control systems regulate critical, real-world activities, their lack of security has worried experts for some time. Government attention to critical infrastructure protection dates back to 1997, when the U.S. President’s Commission on Critical Infrastructure Protection issued a report that raised considerable awareness for the nation’s increased reliance on vulnerable, interconnected physical and cyber infrastructures. A year later, the White House issued an important policy document, Presidential Decision Directive 63 (PDD-63), which defined critical infrastructures as: “those physical and cyber-based systems essential to the minimum operations of economy and government.” The directive had the goal of, by 2003, protecting the nation’s critical infrastructures, defined as banking and finance, energy, telecommunications, water systems, transportation and emergency services. It called for significantly increased security to government systems by 2000, and laid the foundation for the protection of today’s critical infrastructure SCADA systems by establishing several new communication structures, including the Information Sharing and Analysis Centers (ISACs) and the National Infrastructure Protection Center (NIPC). Two months after 9/11, the Critical Infrastructure Protection Act of 2001 was passed, stating that any disruption of critical infrastructure must be “infrequent and minimally detrimental” to the nation. When the DHS was created a year later, a Director of Information Analysis and Infrastructure Protection (IAIP) position was created to oversee cyber and critical infrastructure protection. The IAIP was later renamed the Directorate for Preparedness, tasked with facilitating grants and overseeing nationwide preparedness efforts to support first responder training, citizen awareness, public health, infrastructure and cyber security and ensuring proper steps are taken to protect high-risk targets. Homeland Security Presidential Directive 7 (HSPD-7) was issued in December 2003 to update policies intended to protect the country from terrorist attacks. This directive superseded PDD-63 and requires federal departments and agencies to develop methods and technologies to protect all critical infrastructures and key resources of the government and economic sector. Some of the most noteworthy progress the U.S. government has made regarding SCADA security includes:
What has the European Union done to-date regarding SCADA security?In June 2004, the European heads of state and government asked the Commission to prepare an overall strategy to enhance the protection of critical infrastructures. In response, the Commission transmitted a Communication entitled “Critical Infrastructure Protection in the Fight against Terrorism,” putting forward a number of suggestions to enhance European prevention, preparedness and response to terrorist attacks involving critical infrastructures. The Commission's intention to propose a European Programme for Critical Infrastructure Protection (EPCIP) and a Critical Infrastructure Warning Information Network (CIWIN) was accepted by the European heads of state and government in December 2004. Throughout 2005, intensive work was done on the elaboration of EPCIP. Two European seminars on critical infrastructure protection and a number of informal meetings were held, bringing together experts from all EU Member States. This work culminated in the Commission’s adoption of the Green Paper on a European Programme for Critical Infrastructure Protection (COM (2005) 576 final) on November 17, 2005. The Green Paper provided options on how the Commission could respond to the request by the Member States to establish EPCIP and CIWIN and constituted the second phase of a consultation process concerning the establishment of EPCIP. Furthermore, it provided an indicative list of critical infrastructure sectors and services which includes SCADA. In addition, the Green Paper foresaw a number of funding sources for activities related to the protection of critical infrastructures in Europe. As a result, the European Commission launched the Pilot Project on the Fight against Terrorism which invited interested parties to submit proposals covering one or more of the following themes:
In December 2006, the European Commission put forward its proposals for the creation of a European Action Programme for Critical Infrastructure Protection. The proposals consist of:
These proposals will now be reviewed by the EU Member States for their approval. Aside from these initiatives, the European Commission has funded CIP research activities through its Preparatory Action on Security Research and will continue funding these through the new 7th Research Framework Programme (2007-2013), which includes a joint initiative between ICT & Security Themes on Critical Infrastructure Protection. The focus of the ICT part will be on building secure, resilient, responsive and always available information infrastructures linking critical infrastructures to build secure and resilient SCADA systems. Are there any standards for securing SCADA systems?The U.S. Federal Energy Regulatory Commission selected the NERC to set and enforce mandatory Critical Infrastructure Protection (CIP) security standards for the energy sector. The CIP rules cover areas such as reporting sabotage, ensuring physical security, monitoring and running antivirus controls, and doing patch updates on all critical assets, including control centers, substations and SCADA systems. The power industry is considered further along in SCADA security than other critical industries. What is CSIA’s position on SCADA security?Although some progress has been made recently, CSIA believes that critical infrastructure protection and SCADA security are important issues that have not been given enough attention globally by governments or the private sector. In the U.S., the appointment of Greg Garcia to oversee implementation of the National Strategy to Secure Cyberspace is an important first step to addressing SCADA security. Preparedness exercises, such as Cyber Storm I and II, are also useful; however, NCSD and DHS must use the lessons learned and rapidly turn them into solutions. Establishing programs that mitigate attacks and forming a clearer plan for an early warning program are essential for better security across agencies. CSIA urges President Bush to form a task force of key government agencies, appropriate regulators, experts in the cyber security field and representatives from across all utilities and suppliers, to meet and recommend concrete actions to improve the security of control systems supporting critical infrastructure. In addition, CSIA has three key recommendations for DHS concerning cyber security preparedness and response:
Additional Resources:U.S. Department of Energy – Control Systems Security The Center for SCADA Security – Sandia National Labs Idaho National Laboratory – National SCADA Test Bed Program Pacific Northwest National Laboratory (PNNL) National Institute of Standards and Technology (NIST) – Guide to SCADA and Industrial Control Systems Security Federal Energy Regulatory Commission (FERC) The Process Control Systems Forum The Institute for Information Infrastructure Protection (The I3P) British Columbia Institute of Technology (BCIT)
|
