Chemical Engineering July 2013 - 34

Cover Story
caught and prosecuted. In addition,
well-meaning IT-security practitioners
- who do not have a clear sense
of the change-control discipline that
must be applied to safety-critical and
reliability-critical networks - are a
special problem. These individuals
may not mean to do harm, but examples
abound where IT administrators
with the passwords and permissions
to reach through firewalls and modify
systems by remote control have
" applied corporate policy " to critical
networks without understanding the
consequences of undisciplined change,
and have caused plant outages or
batch failures as a result.
Advanced/targeted attacks. These
are the so-called " advanced persistent
threats, " which have been in the press
for some years. These attacks are generally
attributed to nation-state military
and intelligence agencies. These
organizations have tremendous resources
(money and talent) to direct at
the problem of attacking specific targets.
These adversaries have repeatedly
demonstrated the ability to bypass
conventional IT defenses. These
attacks have been credited with the
theft of source code, trade secrets, and
other intellectual property valued at
up to several trillion dollars. The preferred
method of attack of these adversaries
is low-volume malware that
is operated by interactive, manual remote
control. They spread cautiously
so as to avoid detection and they steal
enormous amounts of information, or
more. While information theft is by
far the most common motive for these
targeted attacks, cases of sabotage
have also been reported using these
same techniques.
Cyber cold-warriors. This class of
attacks does not have a widely accepted
name. Some lump these attacks
in with " advanced persistent threats "
but the methods and objectives of this
class of attack differ sharply from
that of the advanced attacks. Some
call this class of attack " cyber warfare "
and maintain that a " cyber war "
is in progress. This is akin to saying
a " naval war " is in progress, without
war having been declared, and without
any other kinds of military forces
having been mobilized.
In many senses, this class of attack
Threats
Cyber coldwarriors
Advanced
threats
Targeted
attacks
Insider
with ICS
network access
Insider with IT
network access
Organized
crime
Resources Motives
High
High
TABLE 1. THREAT SPECTRUM
Methods
Sabotage Highly targeted,
autonomous
Industrial
espionage
Medium Industrial
espionage
Low
Low
Targeted, manual
remote control
Targeted, manual
remote control
Sabotage Targeted: social
engineering
Sabotage,
or benign
Medium Identity theft,
spam, distributed
denial of
service
has more to do with cold war tactics
than with anything else. Stuxnet is
credited with destroying 1,000-2,000
Iranian uranium gas centrifuges. The
worm was apparently crafted using
detailed insider knowledge of the
control system, which was the target
of the attack, and with similar knowledge
of how that target was defended.
The Shamoon attack is credited with
effectively erasing the hard drives
of over 30,000 computers in MiddleEastern
petrochemical firms. There
is speculation that the worm was
planted in the target networks by
insiders. The motive of this class of
attacker is clearly sabotage, and the
preferred " weapon " is malware that
spreads and operates autonomously.
Much has been written about Stuxnet
specifically, and how to defend
against the worm. Much of that information
pits the artifact, which is the
Stuxnet worm, against one kind of cybersecurity
technology after another.
" This technology would have stopped
the worm " but " that technology would
not have. " Such analysis very much
misses the point.
For every defensive technology deployed,
there is an offense or attack
that will defeat the technology. There
are no silver bullets. If a site has
trusted, " sleeper " insiders planted in
its workforce decades ago by enemy
nations, and those insiders are exposing
detailed intelligence as to the design
of the control system network and
of the control-system cybersecurity
32 CHEMICAL ENGINEERING WWW.CHE.COM JULY 2013
Targeted: social
engineering
High volume,
automated
Examples
Stuxnet,
Shamoon?
Flame, DuQu,
Gauss, APT
Night Dragon,
hacktivists
Maroochy
IT errors and
omissions
Zeus,
Conflicker
defenses to enemies willing to spend
tens of millions of dollars to devise an
attack specific to that site, then that
site does not have a cybersecurity
problem. That site has an espionage
problem. No additional cyber-defenses
will prevent a Stuxnet-class attack. A
site with this kind of problem needs
to escalate the problem to its own national
intelligence authorities.
" Advanced persistent threats " are a
different matter. It is absolutely possible
to protect industrial sites against
these attacks, but there is a strange
reluctance in some organizations to
apply the protections. The reason is
that so far, the vast majority of these
incursions have had only industrial
espionage - stealing information -
as a motive. Some industrial sites feel
this is reason to be complacent, because
they have no information that is
worth stealing, and so they feel they
will never be targeted.
This is akin to saying " There is
a hole in our perimeter fence, and
heavily armed criminals are wandering
in and out through the hole
at will. " And then saying " But that's
OK, all they want to do is steal stuff,
and they aren't finding what they
want to steal in our site so they're
really not doing that much damage. "
This is nonsense. Anyone with this
kind of hole in their perimeter would
say " Close that hole. Close it now. "
Unauthorized, untrained individuals
on the other side of the planet with
remote control of industrial control
http://WWW.CHE.COM
Chemical Engineering July 2013

Table of Contents for the Digital Edition of Chemical Engineering July 2013
