Chemical Engineering July 2013 - 33

This is the exact opposite of how
control system networks are managed.
Control system networks are
generally configured to be unable to
exchange information directly with
the Internet, and so are not under
constant attack. The biggest risk to industrial
networks is the connection to
the business network.
The discipline used to keep a control
system safe and operating reliably is
called " engineering change control. "
Every change to a control system is a
potential threat to safety and reliability.
Anti-virus signatures can cause
" false-positive "
matches that shut
down and quarantine essential parts
of control system software. Security
updates can contain arbitrary changes
to operating system and application
code, and must be assessed, tested
and very cautiously rolled out in order
to preserve safety and reliability. Because
of their constant change, antivirus
systems and security updates
are very costly programs to roll out
on control system networks, and everyone
has a horror story to tell about
the impact of these programs on - at
least - reliability.
Vulnerabilities
The bad news is that vulnerabilities
and security problems do not go away
simply because IT (information technology)
solutions to those problems
work badly. Control system software
is notoriously vulnerable to even very
simple attacks. Back-of-the-envelope
calculations suggest that there are
at least 100,000 buffer-overflow vulnerabilities,
alone, waiting to be discovered
in control system software.
Security researchers who look for
vulnerabilities confirm this calculation.
They report that after only a
morning's effort, they typically find
up to a dozen critical vulnerabilities
in every bit of industrial software
product they examine.
The problem is not limited to bufferoverflow
vulnerabilities.
Until very
recently, cybersecurity was simply not
a design criterion for industrial-software
product development. Industrial
control-system products are notoriously
vulnerable to everything from
SQL (Structured Query Language)-injection
attacks, to hard-coded vendor
passwords, to simple denial-of-service
network flooding attacks.
A confusing factor associated with
these vulnerabilities has been the
" responsible disclosure " debate. How
should new vulnerabilities be disclosed?
Responsible disclosure holds
that details of newly discovered vulnerabilities
should not be disclosed
publicly until the vendor has had an
opportunity to produce a fix for the
problems, and anti-virus and intrusion-detection
vendors have had an
opportunity to craft new signatures.
Security researchers who have disclosed
vulnerabilities outside of this
process have been sharply criticized.
But think about it - how much
less secure are we if someone publishes
a serious security vulnerability
in industrial software before a fix is
available? Most industrial sites are
unable to apply security updates in
a timely manner because of safetyand-reliability-focused
testing requirements,
even if those updates are
available. Worse, any attacker worth
their salt can spend a morning with
the software and find their own half
dozen " zero-day " undisclosed,
critical
vulnerabilities themselves. They
don't need disclosed vulnerabilities
when finding their own undisclosed
ones is trivial.
The extreme vulnerability of control
system software is compounded
by well-known problems, such as the
use of plain-text communications protocols
and very old software components.
An attacker with access to an
industrial network can simply send
plain-text commands to any device
on the network and those devices will
carry out the commands without question.
Very old equipment presents a
similar problem. How many anti-virus
vendors still support their products on
Windows NT systems? Does Microsoft
issue security updates any more for
Windows 2000 systems?
All of these problems will take a
very long time to solve, if that is even
possible. Control systems administrators
have proven to be very reluctant
to deploy device-communications
encryption because of the impact on
maintainability and reliability. Old
software versions on old operating
systems are often essential to the operation
of old equipment - equipment
that is extremely costly to replace, because
the testing and scrutiny necessary
to ensure that replacement hardware
and software are sufficiently
reliable and are configured and deployed
correctly.
Deploying a new version of software
is more than a process of a little
testing. Deploying sweeping changes
to control systems or to the physical
process itself, as often occurs at long
intervals during site refurbishment,
is a daunting task. The task involves
months and even years of planning,
then an intense burst of effort deploying
and upgrading everything, and
then additional weeks of " all hands on
deck " effort to bring the plant back online,
safely, to full production.
Take all this together and it is easy
to see that while control systems use
technologies that are similar to IT systems,
control systems are constrained
in ways that are alien to IT systems.
As a result, a wide array of IT-style
cybersecurity approaches are either
ineffective on control systems, or are
in fact counter-productive on control
systems, resulting in net impairments
of safety, or reliability, or both.
Cyber-threat spectrum
If control systems are more vulnerable
than IT systems, what are they
vulnerable to? Who are we worried
about? Today's cyber-threat spectrum
is outlined in Table 1.
Organized crime. Organized crime is
still responsible for the vast majority
of malware circulating on the Internet.
Professional virus authors produce
products that steal credit-card and
banking information, and that harness
compromised machines to send
spam and launch denial-of-service attacks.
Organized crime has resources
(money and talent) to spend producing
sophisticated attack tools. And by and
large, the resulting attacks are autonomous
- they spread automatically to
as many machines as possible.
Insiders. Disgruntled insiders are a
perennial threat, one typically dealt
with via personnel and background
checks, as well as via detailed auditing.
With sufficient auditing, it is difficult
for an insider to be confident
of causing damage without being
CHEMICAL ENGINEERING WWW.CHE.COM JULY 2013 31
http://WWW.CHE.COM
Chemical Engineering July 2013

Table of Contents for the Digital Edition of Chemical Engineering July 2013
