Industry sign banking idaho presentation secure
good morning everybody this is Jarek harp the founder chairman of CSA and I'm real excited that you've all chosen to attend our webcast with one of our our top and early supporters Waterfall as you know Cisse is a not-for-profit a 501 C 6 organization and we largely our budgets are established by supporting companies and Waterfall has been one of the was one and and it still it is one of the very first sponsors to ever sign up and then has consistently been supportive in in many ways beyond just the financial underwriting that our organization needs from companies also supplying us with expertise and advice and help in launching specific projects and this is more than we can ask from any of our s ApS and we really appreciate Waterfalls leadership in that area since the origin of our organization and clearly we have other companies that we're grateful to as well and we're always looking for additional companies if you want to get involved there's more ways than ever to support and be involved and be recognized in helping a the world's largest peer-to-peer networking educational opportunity for the work force focused on securing industrial control systems we are still growing all over the world there's an organic nature to this it's clearly a topic of great interest we've passed 16,000 organic registrations and in at the rate that that is continuing will be over 18,000 before the end of the year so it's it's exciting and we continue to just try to figure out how can we serve the needs of people all over the world that are you know wrestling with the issues around the security of these sorts of systems and if it's ubiquitous problem no matter what country you're in and obviously in some places there are less resources than others ready to you know to try to tackle this this particular problem so it is our mission to try to help everybody a rising tide will lift all boats and we've got the opportunity to do that and one of the ways we can do that are these amazing virtual educational series that we that we now do and we've got an amazing brain trust of individuals involved on the global advisory board and as chapter presidents and as speakers and as si PS which I'll introduce you know one of those folks right now a veteran of the space so how can we take all this knowledge gained by people who have been working on this problem longer than anyone and translate that to value for everybody walk away learnings and today is one of those one of those examples we have another one coming up at the end of the month with another long-standing hard-working well-known person in the space Steve mustard who have worked in and continues to work in some of the largest automated automation environments gas and oil specifically and but I think others as well and he'll share some of his share some critical information about the mission critical operation professional certification so I hope you can attend that and during the webcast please definitely input questions into the question Bank you'll notice in GoToWebinar there is a pre-made form over in the tool for inputting questions and we will try to get to those questions at the end of Andrews presentation but go ahead and put it then along the way that gives us a chance to review those and kind of be thinking about them prior to Andrew finishing the formal part of his presentation and then we can queue those up and and get get into the specifics that you want to get into and you've got a great person to do that with if you don't know Andrew and I'm some I'm assuming many of you do this is another one of these veterans who you know there aren't that many people who've been working on this problem when you start measuring in terms of decades it's it's a small group of people and in Andrew is also the author of a couple of books his latest one is this security technology book you can see in the right hand corner and you can get it on Amazon but also as a strategic partner for Sesay he will make it available to our members and to people participating in our events so you can reach out to him actually he'll share it at the end of his presentation a way for you to get your hands on his second book that has come out and so I I recommend that you definitely take it and take advantage of that so without any further ado what I would like to do is introduce Andrew Ginter VP of industrial security and wonderful security solutions hello Derek and thank you for that very kind introduction and hello to everyone and you know my thanks for joining us give me a moment here mechanically to switch presenters can you see that where is my go to leading in the way there we go so my topic is secure operations technology this is the the topic of my mining book let's just launch right into it earlier lots of people talk about iqt integrations in reality though there are not two kinds of networks in industrial enterprises that we need to worry about there's three there's IT there's au team and there's engineering and credit where credit is being you know this this third network here is not my insight I was introduced to this way of looking at the problem very recently in an interview with Jill Weiss that interview is on the waterfall industrial security podcast and I hope it's gonna be published Monday I've got more information on the podcast on the very end of this so hang on if you're interested but let's talk about the three networks the big difference between these networks is physical risk IT networks have have business risk as in a sense a worst-case consequence ot networks the big consequence people worry about is downtime plant downtime tripped the plant and now who knows how long it takes to to come back up and occasionally you know there's this concerns about IP theft as well engineering networks were concerned about lost production yes but more importantly we're concerned about damage to very costly equipment we're concerned about worker casualties at the site we're concerned about public safety and you know preventing environmental disasters so the scale of consequence is increasing here and the nature of consequence is changing between the IT ot and engineering the IQ consequences are typically business consequences the OT and the engineering that work consequences are increasingly severe physical consequences what's the difference well you know if the bad guys get into our enterprise networks in the NIST framework terminology we detect we respond we recover respondent recover looks like identify the affected machines isolate them erase them restore from backups and repeat the problem with moti in engineering networks is this if a refinery or a power plant goes down because of a cyberattack we can't restore lost production we can't restore damaged physical equipment or human casualties from backups the unex and the attacks unacceptable physical consequences here means that we need to be very reliable on these ot and especially the engineering networks change is the enemy of reliability every change risks causing a malfunction complexity is the enemy of reliability systems that are too complex to you know for the human mind to understand and it doesn't take much to get that big we start losing our ability to confidently predict the safe and you know physically reliable operation of those systems what does that mean for security well antivirus signatures change constantly well that's that's change that's a threat security updates are even more extensive changes so that's a problem encryption is complexity it makes everything harder to understand and again the deeper we go from you know IT to ot into engineering the more that becomes a liability in terms of keeping everybody safe and so what it means is that you know be the of you know some aspects of the enterprise security program meaning constant aggressive change to stay ahead of the bad guys we cannot apply that to the OTN especially the engineering networks and so if an enemy gets into those OTN engineering networks well they are soft targets they are soft interiors this is why we see opposition from operations this disconnect between the enterprise security and engineering needs you know the operations people will resist applying the enterprise security program because it's a threat this confuses a lot of people a lot has been talked about here it's you know it's not that anybody is getting it wrong it's there's a disconnect that we need to understand you and we need to do something about increasingly we're you know at waterfall we see IT teams being becoming truly responsible for ot security and this resistance results in paralysis things just aren't happening that urgently need to happen so what's the solution well in terms of the you know the the modern parlance it's called micro segmentation what is microsegmentation well to an enterprise network architect the enterprise wide area network looks like one large and as much as we can make it homogeneous network you know I'm sorry IT teams are chronically underfunded the only hope we have of meeting our mandates is standardization reduce the inventory of technologies we have to learn reduce the number of spares that we have to maintain reduce the number of vendors we have to negotiate agreements with simplify by standardization inside this corporate Wang there may be you know there's sites inside the sites there may be different types of networks you know we can - firewall everything on that on the other program we can to connect everything to a homogeneous set of Active Directory controllers we standardized as much as possible and I said all this so I'm going to open it what we're neck recognizing though is it nothing is quite that simple even in the enterprise space forget the industrial space there are exceptions the the set of virtual machines that implements the sa P server is enormous ly important to the business it tends to be micro segmented and protected more thoroughly than the average Enterprise Asset the set of virtual machines that is serving web applications out to the Internet he is exposed to attack in ways that the rest of the network is not and so it also tends to have a more robust microsecond tation strategy and you know a set of special security rules applied to it to make it more or less so this precedent for some deviation from the enterprise standard generally in the direction of becoming more robust more robust because certain networks are more important so what does this mean little networks of safety instrumented systems are enormous ly important they're part of the safety system they're designed to protect human life to prevent casualties at the site to prevent disasters and so micro segmenting them in a robust way in a more robust way than the average enterprise asset especially because the interior the safety systems is intrinsically a soft target make sense in a lot of enterprises protective relays are the same thing these are small computers that look vaguely physically like the safe to computers but they're designed to protect large assets you know 300 million dollar turbines or you know 10 million dollar high voltage transformers and so again they're managed for physical risk engineers manage these things it makes sense generally to say these are the most important physical consequences Micra segment them and you know improve the security as much as we can given that there's a soft interior and in fact downtime for a large planet if we have a hundred million dollar physical plant physical asset and an intruder gets in and trips the plant it can take days to come back to full production sometimes it takes weeks this is a huge cost and so often what we'll see is micro segmentation of entire control systems the most important control systems do they safety systems protective relays or outside control systems for important physical assets we see being Chris Eggman and managed as engineering assets not as Enterprise assets how do we figure all this out successful enterprise security teams sit down with their operations counterparts and figure out where to draw the line which assets are important enough to protect as engineering assets using the engineering change control discipline and which of them are enterprise assets that are to be you know managed and secured as pretty much every other asset in the enterprise technology that we see the most thoroughly secured industrial sites use to manage engineering chain control networks is this the male is new you know I invented the name but what I did was I when I wrote the book here I tried to give a name a common set of names a common set of terminology to be perspectives the practices the methodologies that I observed in thoroughly secured sites that have figured out this enterprise and engineering and ot difference so I call it secure operations technology the fundamental difference in perspectives is that on enterprise networks we seek to protect the information the CIA the AIC there's something of information on oth engineering networks what I observe is that we seek to protect physical operations to protect the engineering assets from information because after all all information it is a potential attack all cyber attacks or information are a piece of information can be an attack we focus on protection from information in these engineering assets now the black book has been called controversial but really all I do in it you had document the practices of the high end of the bell curve i document what i see these secure sites actually do to me that is not controversial this is good reporting to me what I think should be controversial is that I don't see anybody else talking about these practices I don't see anyone else documenting what the world's most secure sites do and what to do is really quite different from what the average site so the bulbs in the bell curve here this the thing is that cyberattacks are only becoming more sophisticated cyberattack tools are only becoming more powerful the physical consequences that we observe as a result of these attacks on control systems are only becoming more severe these consequences and so all of us are strengthening our security posture on the bell curve of security posture versus you know number of sites the entire bell curve is shifting to the right this is how we respond to this increasing threat in the environment the entire bell curve is shifting in the direction of the world's most secure sites and there's not enough people talking about what these sites do hence you know my desire to write this book a big part of the discipline for securing engineering and OT networks the important control networks the ones with unacceptable physical consequences that compromise a big part of it is perimeters now the the IT gurus will tell us the perimeter is that you know where's the perimeter around our cell phones you know where's the firewall where's where's the guards gates and guns there is not how much important business informations on their cell phones well an enormous amount typically and they're right the perimeter is dead on enterprise type networks but if you think about every important industrial site any one of us has ever visited there's a fence around it isn't there those guys are cases guns as locks you might ask you know how what what is an important size how do you define important if it's important enough to build a fence around important enough to have a cyber perimeter as well a physical perimeter and a cybercrime to go together there's always physical parameters around important sites you so once and find their their important sites defined the assets within those sites that have unacceptable physical consequences we call those assets those groups of assets even groups of control systems groups of networks we group them all into what's called control critical networks once we define the control critical networks what we do is we inventory information flows again all cyberattacks are information so a complete inventory of information flows into control systems is nothing more or less than a complete inventory of all possible attack vectors with a list of all possible men taking home secure sites they go about blocking or disciplining those attack information close secure sites not only control a
d discipline whenever possible they use physical protection from information they don't trust software I mean software has a role software security systems have a role but fundamentally all software has bugs I mean I worked on software for 25 years I didn't try to put bugs into myself for but in spite of the best efforts of me and all of my colleagues in all of my career everything we produce had bugs in it some bugs are security vulnerabilities discovered and undiscovered and so in practice all software can be hacked even security software you know the people that we see working at the high end of the bell curve the most thoroughly secured sites they say you know we're supposed to use security software using using vulnerable security software to protect vulnerable control system that works it smells a lot like bailing a basement with a bottomless bucket you know it's fun to watch but it's really frustrating if you do see progress we want to get rid of frustration they use physical protection as much as they can they say you then tional enterprise security programs as much of them as they can as well now there's a couple of exceptions I talked about antivirus and such they use as much of those programs as they can and they layer Seco team on top of that to produce an even more robust program now there's only two ways for attack information a perimeter any attack information any information from another at the move online or to move offline offline means it's carried on a cell phone on the USB key you know it's it's physically carried in the head of an attacker chapter 4 under book is all about protection from offline information and attacks those you know for example removable media wherever practically shut your removable media ports use an anti-virus scan kiosk for all inbound media is something like you know the Diop SWAT or the Honeywell security exchange system scan any incoming drive you the ploidy system at the physical perimeter you know the security guard on the way and says you have any drives to scan the drive and files that pass the scan that you need to bring into the system you copied to another medium you pull a known good USB key or CD drive out of a stack beside the kiosk you copy the good files and you scan these file typically with between 4 and 8 antivirus engines but you you scan them you caught me the good stuff to a known good media you carry it 3 feet to a file server you load this stuff on a file server and as much as possible use the file server to distribute that within the control critical network this is an example of controlling controlling offline information flows disciplining offline information flows complex phones like antivirus signatures are software updates we do not take them straight into the control system thank you we take him on to a testament the test that is instrumented for threats to safe operation threats to reliable operation and for security fits testbed is not just to check Wilma software operate correctly it's in a sense a big sandbox that we're using to see if anyone has buried a nasty inside of complex information artifacts like code coming in so that's chapter four you example of something me a lot of a lot of these these protections here in Chapter four are gonna seem reasonably familiar to enterprise practitioners the it's a cyber near and miss protocol in a lot of physical processes we have safety near-miss protocols if someone observes I don't know you know a three-ton object being winched into the air and a person with a hard hat on walks under the object walks through it and you know ten seconds later the things falls to the ground that's a safety nearness if circumstances had been just a little different if timing had been just a little different we'd have a casualty at the site you write these things up they get analyzed at the end of a they get aggregated summarized analyzed at the end of the month and we decide on we prioritize remediation same thing with cyber you know every alert that goes to the sent from the the industrial system gets written up as a cyber near miss at the end of the month we discover that 39 percent of the cyber near misses were because Andrew kept using an USB key someone needs to go and give Andrew a remedial training so now this is something where we're seeing emerge at industrial sites you line controls when it you know so the offline controls seemed reasonably familiar we might have applied them more intensely than we see them applied on enterprise networks to control incoming information flows with offline controls the nature of the offline controls is fairly dramatically different from the nature of sort of online controls I'm getting my online Sinatra eyes mixed up online wireless wired firewall this kind of continuous communication flow is very different in psycho you Sekou t forbids firewalls between control critical networks engineering or OT networks that are managed as control critical forbids firewalls between them and non-critical networks the only online communication that's permitted at the sites we observe at the sites on document use unidirectional gateways they replace at least one firewall in the layers of firewalls in a defense architecture the place at least one of those layers with a unidirectional gateway what is that for anyone not familiar with it this is the mist definition mist 882 the definition of a unidirectional gateway it's hardware in the center here hardware that's physically able to send information in only one direction there's a fiber optic laser on this circuit board there's a receiver on the circuit board there's a short piece of fiber you can send from one to the other from the industrial network to the enterprise network there's no laser on the receive circuit board it's not physically possible to send any signal back into the industrial network all cyber attacks or information no information gets back no attacks get back it's not fundamental but it's a combination of hardware and software the hardware is physically able to send in one direction the software makes copies of servers like databases or OPC servers or emulates devices and everyone on the enterprise network who needs the industrial data interacts by dimensionally normally with the replica servers and they have all the data they need in the replica servers nothing ever touches physical operations chaos can consume ransomware can consume the enterprise network the operations Network is blind to whatever's happening out here it can take days for the chaos to be subdued on the enterprise network the power plant the lights stay on gasoline keeps coming out of the refinery the railway system keeps moving you know trains do not run into each other this is the nature of the the one-way connection but you might ask how does this work I mean a lot of people find this very confusing the the ancient will come back the you know the HS the HMI network needs information from the PLC network the historian network needs information from the PLC network the H I network needs information from a historian network how can this work a lot of these these communications seems fundamentally bi-directional the key is that the control critical network needs to be defined very carefully we define it so that the control critical assets and even industrial control system subnetworks are completely contained inside the control network they might use firewalls intimately we see a lot of firewalls used in control critical networks for it's the internal segmentation but at the edge of the control critical network when we connect to the non-critical networks or the non control critical networks that's where we see the integration of communications now that's fine theory in practice there's always something that has to get back in to control critical networks what do we do they look at you know the sort of the leading edge the bleeding edge of industrial control systems it is the industrial internet the industrial internet of things well I am one of the co-authors of the industrial internet consortium security framework the framework is based on the IIC reference architecture the reference architecture is illustrated here this is not my diagram this is cut and pasted from the IIC reference architecture document this is how they think of the world at the bottom here I'm going to stop trying to use my pointer is advancing my screen I'll just talk at the bottom here we see the control network it does control sense actuate physical systems all of that is an industrial control system above it we start having seeing layers of other kinds of applications and the arrows are information flows the information flows pretty freely inside the control network but once we get up into the the higher levels we see three kinds of arrows green arrows and white arrows our information that's leaving lower levels that's moving the higher levels or that's moving around moving inside levels the red arrows are control anything that moves into the control network control every message that enters the control network causes a CPU inside the control critical network to execute instructions that that CPU would not otherwise have executed every single message that comes in is controlling that CPU to a degree and who knows what the consequences of that CPU executing those instructions are that control may propagate through the entire thing this is how attacks work so reference architecture Retton recognizes that control is different from monitoring do about this well if we you know if if all we have is a firewall between the layers what can we do open another port to a man with a hammer all the world a man to a man with a firewall all problems are solved by opening another TCP port modern practice demands and this is what's documented to be in the is a framework by the way modern practice demands discipline control when not if when we need to send control information between to a more critical network we need to use the host feature safest the safest way that meets the business need not just whack open another TCP port no matter what kind of information no matter what the business needs and if I make all of the offline mechanisms that I talked about earlier they're all about control of well the auntie testbed is a very important kind of discipline control it's offline it's very slow but it's as safe as we know how to make it for complex information artifacts coming but we're talking about online so let's come back to online shows how can we discipline those here's a classic design a control network has a lot of equipment in it including an OPC server on the left in the center a historian sits in a DMZ on the right we have clients on the enterprise network the historian sends requests into the OPC server the OPC server responds query response clear response all of these communications query response you know between the client and the historian between the historian and they'll be keeping all bidirectional how can we do this unidirectionally well we put a unidirectional gateway in and you see that the the OPC server in the control system in the dashed line has been added to the DMZ gateway emulates the OPC server to the DMZ the software in the game again the gate wizard hardware and software the hardware is one way the software in this case emulates a server the software in the Gateway sends a request to the OPC system on the left and says please give me all your tags all of your audio tags and all your data all your bodies send that snapshot out on the outside the software is a standard OPC server the historian queries the server on the on the DMZ and gets the same answers from the emulated OPC server as the live server will get all unidirectionally what we've done is we've defined the controls as the control critical network we've unidirectionally connected it to the DMZ we have disciplined the incoming flow we used to send queries in the discipline says you don't need to send queries in if all the data you need is already on the DMZ emulating the same system as in the ICS everything that used to work still works there's no need to send the queries in the best discipline is eliminate the inbound flow entirely and it's possible to do that right here so II you know I think that you know some of us have found this concept to be new others of us have heard about this before it means maybe on one of my webinars before you know you may have you may have looked at it a bit you may have looked at it and looked at your network and concluded it can't possibly well what's new in the black book is a catalogue of 20 different network architectures 20 architects is documenting how different kinds of istria lights with different kinds of you funny example networks there you know the the huge variety of ways we could use universal technology these knowledge used to be walking around in the heads of the road nine people inside a waterfall somebody else move this and I thought this is silly the world needs this knowledge so I let it down the first time this stuff has been document look at that the OPC example and said you know you're cheating you managed to get rid of the gum flow entirely good for you let's look at a more complex example even if we cannot use antivirus on some of the very sensitive engineering or ot systems control systems we still use antivirus everywhere else you know one of the things we learn as as ot practitioners is that you know some of our systems are special but most of them are not the ones that are not special we put antivirus on we're gonna need antivirus updates aren't we they've got a coming somehow and in batch processes you know refineries even mining batch processes we need production orders from the ASAP system to tell us what to produce next what the quality requirements are and so on these things have to come in usually a few times a day how do we do that we do it in the red in the center with a reversible unidirectional gateway classic unidirectional gateways are one way out nothing back no questions that's it a reversible gateway can flip over so it's you know physically looks like a unidirectional gateway it has only one transmit board one receive board it can only send one way but there's a button on the front if we press the button meetings as if the system picks up flips over and sets down that can be one way out for one waiting but never both when it's one way out we're replicating OPC servers and process historian and such when it's one way in the software I mean the software cannot control the flip the flip is a hardware function but the software can sense the flip and the software can say oh look each time it's 2:00 in the morning you know the thing flips for 10 minutes and then flips back this author says it's time the software is a client of the antivirus server logs into the antivirus server fetches latest updates checks the crypto to make sure they're authentic sends them through an emulated antivirus server the industrial control system same thing ASAP server pushes you know the production order once we've checked all the crypto pushes it into the control system and ten minutes later it flips back that's it there's no TCP port open leave it's an opportunity for attackers to test for zero days the the hardware's foot back there's nothing touches the control system until the next update and when that update occurs it is clients on the IT network on the enterprise network fetching data it's not a router sitting there you know trying to filter package trying to figure out the difference between good and bad packets good luck because no algorithm that can do that so here's an example the bottom line is again we've defined the control system as a control critical network and we've deployed a reversible unidirectional gateway at the boundary there are we lost track of myself okay here is my last example something that we've seen in about the last 18 months is this pattern of of communications there's a you know as you know anyone's been watching the industrial security space knows that in last 18 24 months there's been a lot of venture money dropped on ot intrusion detection startups there's some real progress being made in recognizing industrial protocols in analyzing them in you know developing an
maly detection for what's normal learning algorithm especially you know artificial intelligence all this stuff all this innovation is being applied to the job of producing a sensor that will watch the packets on an industrial network and diagnose potential attacks the problem is that if we connect that sensor so it noticed the problem is that that we need to connect that sensor to a mirror port and have two choices we can put the sensor on me and true on the industrial network or we can put it on the IP network if we put the sensor the physical machine that is in running the software or the virtual machine on the industrial network the probability census is that from time to time they have false alarms this is the nature of intrusion detection centers this is why people in the security operations center need to log into these sensors from time to time to tune them or to update them or to put you know new signatures into them if we have the intrusion sensor on the industrial network all of those people need to be able to log into all of the operations networks in all of our plants can you imagine every one of your plants going there and trying to explain I have 73 people in my enterprise sock all of whom needs a log into your control network they're going to be asking who are these people what are they doing on my network what are they doing it to on my network what are the consequences of giving 73 people remote access to my control critical network was truly unacceptable physical consequences of Mis operation much less compromised they're going to resist the place for that sensor is on the NIT network where the operations people are there the security operations people can get to it easily the problem is that now we connected me reports on control system switches into essential on the IT Network these mirror ports are notoriously bi-directional the vendors the switch vendors will tell you they're unidirectional and then of contradict themselves a paragraph later people who test these things will say another not unidirectional or if they are the in a directional they're softly an aggression or you know export of a zero-day or worse just steal a password you can reconfigure them and now they're not bi-directional an eye for the path back into the industrial network throw a unidirectional gateway in there emulate the mirror ports to the intrusion sensor on the IT Network and you've got the benefits of monitoring the OT traffic from the IT Network perfectly safely in a way that the security operations people can reaching and manage those assets easily and securely in fact you know this is such an important application there's so much attention in the last 24 months being given to bringing finally bringing operations networks into the enterprise security monitoring hold they wanna hold evil calmness it's on the website if you go to waterfall - security icon slash gold - standard a new gold standard for how to do safe ot security monitoring will find the e-book I'm coming up on the end here a word about waterfall if you'll indulge me we are the open security company we've been doing this for 12 years we enable secure operations we prevent remote attacks online attacks we protect industrial networks we protect Enterprise engineering networks we protect ot networks we protect physically mission-critical environments we see our products used all over the world in ot environments to do safe integration of ocean networks with external networks usually with enterprise networks but occasionally see people go from the LT networks straight out to the Internet why because when you put in aggression gateway in there it's safe it's physically impossible for any attack no matter how sophisticated no matter how militarily sophisticated to come through the internet and compromise the physical protection of the Gateway discipline control is the third principle here we do not bang open another TCP port when we are presented with a network with a set of business needs and communications needs we design we develop the strongest solution that meets the need a strong solution that that gives us the basic business benefit and the most specific solution to you know provide that strength we hope that we are defining a high end of IT security of operations security by documenting these practices of Thoroughly security side and applying these practices and developing the technology to support these practices routinely that's what I had for you in short summary tack capabilities only increases only become more severe all the time attack tools become more capable all of us respond by increasing the strength of our security postures the entire doctor of security strengths needs to move to the right the problem is we see too many organizations stalled on their ot security initiatives because of businesses from operations the time has come to start making progress we need to recognize that physical engineering risks are different from informational business risks that enterprise programs address we need to negotiate with operations with the engineers we need to sit down and figure out which assets to micro segment which assets to model as engineering assets and we need the engineering assets to be thoroughly protected using a robust disciplined you know Seco T approach we need to bring everything into the enterprise security fold with as little deviation from corporate standards as possible engineering safety and engineering protection needs addressed we can start seeing progress we can start seeing progress instead of conflict and and paralysis the book here is available on Amazon but waterfall as a public service is making free copies of the book available for a period of time go to the URL that you see on the bottom here waterfall - security columns flash sec - OT b but your shipping address and we will try very hard we occasionally have trouble with customs but we will try very hard to get a book into your hands no charge um and if you want to give me feedback on this I'm very much open to feedback as I said you know the the people have mixed reactions to this I can only get better at documenting you know what people are doing and you know the right way forward if I get feedback from the people who are using the knowledge who are reading the knowledge tell me what you think good bad or ugly you know and I will try to get better next time one last thought for you we've been running the Industrial Security podcast for six months now we have a new episode every two weeks we have guests from all over the industrial space we have vendors we have government agencies we have owners and operators and we have others we have recruiters we have board members from power companies talking about governance issues the podcast is not about waterfall Waterfall is a sponsored we produce it as a public service the podcast is all about our expert guests if you like it you know so major review spread the word you can see it at waterfall their security comm / podcasts you can go on your favorite podcast apps on your phone subscribe to you know search for industrial security you'll find it see the logo sign up and you'll get notifications when when new episodes come up that's what I had thank you so much for listening Derek you have questions back up here we do in fact so if you want to advance it to the the next slide oh there we go I'm on the end of mine okay wait I mean you want to take over the presenter again yes hold on everyone okay and I assume you can see Oh yep is your podcast okay so you keep sending questions in if you have them so yeah I'll just switch back for now to podcast page that shared thank you Andrew we've got some feedback by the way besides questions that people found the useful the information very useful I'm thanking you for for sharing it first question does the unidirectional gateway work with Ethernet communications bi-directional requirements the Gateway is a hardware device it's got no CPU it's got no MAC address it has no IP address it it forwards Ethernet frames but those frames again inside of a you know in the in the NIST definition a gateway is both hardware and software the hardware component the CPU less component is connected to a host it's not connected to a network and that host is sending information into the hardware on the other side the host is receiving information this software in the host is being the client and replicating the servers and so no Ethernet frame from a network makes its way through to the other network the clients are are managing communications with with servers on each side the one exception is the airport when a mere port comes in we do emulate that mirror ports actually meaning the package that come out the other side you look just like the packets that come in but again they're wired directly into a intrusion detection sensor that's consuming the packets I'm not sending anything and even if they did it'd be pointless nothing gets back so I think the answer is yes we forward Ethernet stuff but the longer answer is the software does the interface of the networks and no nothing ever gets back from the outside you know back to the Gateway to the inside I hope that I just pledged and let me know Dennis if that doesn't your question what's to prevent hackers from waiting for the Gateway to reverse and penetrate the ICS what's the advantage or what okay so your question again slowly what is to prevent hackers from waiting for the Gateway to reverse and then penetrating the ICS that is possible in theory but first you would have to take over the host on the outside again because if you have a presence on the network on the outside on the enterprise network none of those packets are forwarded through to the other side the host is the host of the client the host is like a spreadsheet you send a packet to a spreadsheet that it doesn't expect you so you send a connect request to hackers or s comm port 80 what happens the spreadsheet says I am NOT a web server I'm not hackers or Escom I'm not a router I have no idea what to do with this packet you send a packet like that to a firewall and it's gonna apply the rules and as you can find a way to get that package you could sue the rules or you're attacking a system runs the firewall you send that to a spreadsheet it's gonna throw the packet out because it truly has no idea what to do with this packet the same is true of the Gateway software so you know it you got a multi-step process if you want to get through you got to take over the the device on the inside now you've got to find one of the weird waterfall packets it's going to make it through because our protocol is not the same as you know the Internet Protocol we don't use Internet Protocol through our device and on the other side even if you manage through some heroic effort to find zero day after zero day and work your way through and get some kind of foothold on the inside Network well now you're flying blind because nothing's coming back is it your one way in nothing comes out and then the device flips over and you can't send command anymore and you're stuck so the the message here is that the slip is much stronger than a firewall nothing you know first loss of scalar security nothing is secure I'm not saying buy a flip or buy a gateway and put your feet up and you're done I'm saying we have a solution that is much stronger than firewalls and so thoroughly secured sites use that solution in preference to firewalls when they need to send antivirus or other disciplined scheduled updates into a system I hope that I hope that works Xavier you mentioned there is no algorithm to recognize good versus bad packets however in other industries have experienced successful software based micro segmentation strategies aimed at reducing lateral movement of bad actors through fine-grained security policies do you see the need for OT to have both a hardware based unidirectional gateway as well as software based micro segmentation solution what are the potential pros and cons of either/or and could they complement each other the short answer is that they generally complement each other you know we have to be careful about using you know the new buzzword is is zero trust which means a lot of crypto you gotta be careful about using crypto on some of the most sensitive boaty networks but beyond that use it wherever it makes sense you use all of the enterprise security knowledge and experience and practices wherever they make sense we make exceptions where we are forced to because of the physical consequences because of the nature of the engineering and the the control networks we make exceptions where we need to we weaken the enterprise security posture where we must in order to protect difficult safety and and physical operations and physical equipment and then we add psycho T as a layer around it so yes yes absolutely we use everything that makes sense these robust sites they're the most secure sites they don't put you know a gateway in and put their feet up as I said they apply all of the best practices they make the exceptions that they're forced to and then they add seco t as a robust extra layer that a addresses the residual vulnerabilities that you know were introduced by the exceptions that had to be made that they were forced to make and be dramatically increases the strength of the perimeter to further protect from again what are truly unacceptable physical consequences running from downtime for you know a hundred million dollar or a billion dollar process to as I said human casualties and worse and convener used to the ticking that ITT key responsibilities for cybersecurity and ot environments is this objection you recommend or just the way things are going and I'm particularly interesting this I get drawn into this conversation on panels and in various companies and see a lot of different things but it's interesting if you could share what you're seeing if any other macro level you know is there a trending it's clearly being done in individual cases or places in different ways but we have what are you seeing for IT taking responsibility in ot environments so let me give you a medium long answer to that experts disagree in my first book the red book I documented what I thought people ought to do and the reaction I had and this is the reason I asked for feedback I really do want feedback the feedback I got for the red book varied from Andrew I disagree so fundamentally I could not finish reading this to the other end of the spectrum where people told me experts on both sides told me and with what you've written is so obviously true I don't know why you bothered to write it down there is enormous disagreement in this space so I took a position with the red book with the black book what I've done instead is say you know debate doesn't seem to be helping here I'm gonna document what I see successful thoroughly secured sites do first they do this then they do that then they do the next there's no controversy there you can decide for yourself if you want to apply these practices but there's no arguing with what these practices are this is what the world's most secure sites do if you want to be like them this is what they do you choose now what I observe is that you know in the last I mean we sell to people in this space what we've observed in the last 18 24 months is that historically IT has been sitting at the table but have not been calling the shots the last 18 to 24 months we've observed that in the engagements we'd be we've been in increasingly dramatically increasingly I t's is calling the shots I don't know why I'm not you know I'm not an industry analyst you might want to ask Gartner or a RC or one of these industry analysts what's going on this is what we observe this is the reality you can debate whether it's good or bad it is what we see happening you thank you yep that is a that is a super fascinating topic we may have to organize a panel just around that topic alone you said that a tax on operation technology are growing in frequency and impact where can we find out more about these attacks on i.t or off the news but ot not so much yeah I mean when I say the the impact increasing I'm referring to the news we've all very about you know Stuxnet was
he big news you know in the day and then things kind of quiet it down but you know lately we've seen I don't know there was the steel mill incident there's the the attack on safety systems where the consequence wasn't realized but there was a real threat to human life at the plant we've seen you know ransomware takedown you know a number of classes I think were like six plants at a time at North Cairo we've seen manufacturing sites I think there was a loser in the news that a honda planet went down they lost a day's production they were behind for their quarter a thousand vehicles why because that plant was running flat out you can't recover the thousand vehicles it would've produce so this is all just in the news I don't I don't have I don't have secret sources that that I'm referring to this is this is public knowledge Thank You ander and what about wayans wide area networks and how does the inner directional gateway technology work within the way in environment so why when I assume you're reading stuff like the brand that's reaching out to pumping stations on pipelines or that's reaching out to substations in the electric grid where we have sensors actuators devices and physical equipment that is physically distant and you know that's a unique problem the the the when is intrinsically part of a control system yet it's outside of our our control in terms of physical perimeter you can't you can't put a fence around the United States well maybe you can't you can't put a fence around the electric grid you can put a fence around the substation but not around the entire grid it makes no sense and so I do actually have a network diagram in the book that describes that it's a little complicated let me give you a simpler answer the what we see happening sort of as a trend increasing fairly dramatically is that power utilities electric utilities with their substations they're not doing the you know the complex diagram and I forget which network architecture in Chapter six for full unidirectional control of the substation what they're doing increasingly this is the trend is putting unidirectional gateways onto the little the small networks in the substations that contain the protective relays because they've said look if the lights go out well that's a business consequence it's a physical consequence but you know we can turn them on we're you know will restore the equipment come back up or will drive out to the substation and physically turn the power back on if there's a you know our Ukraine style compromise if the lights go out we can turn them on in a matter of minutes or hours we can do this but if the Transformers burn out because someone is tampered with the relays it's going to be weeks or months before those things were placed there is no worldwide inventory at high voltage transformers and so what we see them doing is deploying their defining that the relay networks as control critical they're saying the other ones aren't are not yet important in our firm you know maybe what they're doing maybe the strategy you start with the most important networks protected unidirectional and get some experience with the technology and maybe in the future expand but what we see them doing definitely as a trend is deploying unidirectional gateway technology to protect the 10 2015 relays in high-voltage substations so that if the lights go out if you do to a compromise they will come on again a couple hours later because all of the equipment has been protected so that's that's the the trend we see there but you know there's more complicated scenarios in the in the black book if you want to read it there's a reason to order a copy of the black book if you want a detailed answer to that question you well thank you Andrew Ginter again from waterfall a one of the very first and most reliable supporters for the CCA organization and we thank you on behalf of all the members I'd like to say thanks again thank you for sharing all the information today and this webcast will be available in the CCA portal where we put all the all the virtual meetings and webcasts that we do for access over time so please feel free to refer back that there's something in andrew's presentation that you would like to to utilize or take a look at again it'll be there for you in in short time premier again we have our next session coming on October 31st and we hope that you can attend that I've left that slide up for a little while and you can find registration again on si si si s to AI org with that we will conclude our october third webcast with and again thank you very much and thank you to all of our listeners
