FIREWALL DEPLOYMENT FOR SCADA/PCN How closed need your network needs - PowerPoint PPT Presentation

FIREWALL DEPLOYMENT FOR SCADA/PCN

 How closed need your network needs to be?  How open can you afford your network to be?  Where from the vulnerability is coming?  How to mitigate the vulnerability?  How to detect that anyone un-authorized is trying to jeopardize the network services?  How the Business Continuity can be maintained in the long run with the steps taken?  How to envisage future requirements? Network Security

1. Denial of Service Types of 2. Unauthorized Access: Attempt to access Attacks command shell 3. Illicit command execution: Hacking  Administrator’s password Changing IP Address  Putting a Start-up  Script 4. Confidentiality Breach 5. Destructive Attacks Data Diddling  Data destruction 

Balancing act between:  Keeping equipment and processes protected.  Allowing them to touch larger computing realms via Ethernet protocols and the internet to gain new connections and capabilities. Solution:  Multiple Zone Network with Subzone. Network Security

Generic IT security goals versus ICS security goals

Assessment process flow chart

OSI Model – 7 Layers

Network Security Tools  Intelligent Network Switches and Routers  Firewalls  Hardware and Software Devices for managing network connections  User Authentication  Encrypting Data  DMZ Network Security

Firewall Firewall is a mechanism used to control and monitor traffic to and from a network for the purpose of protecting devices on a network.  Compares traffic passing through it to a pre- defined security criteria  Can be a hardware device (CISCO PIX or Semantic Security Gateway)  Can be a hardware/Software unit with OS based firewall capabilities (“ iptables ” running on a Linux Server)  Host based software solution installed on the workstation directly (Norton Personal Firewall or Sygate Personal Firewall) FIREWALL

Internet facing firewall protecting PC & PLC

Network Traffic Network traffic is sent in discrete group of bits, called a packet which includes  Sender’s Identity (Source Address)  Recipient’s Identity (Destination Address)  Service to which the packet pertains (Port Number)  Network Operation and Status Flags  Actual payload of data to be delivered to service A firewall analyzes these characteristics and decides what to do with the packet based on a series of rules, known as Access Control Lists (ACL). Content of Network Traffic

Host Based Firewalls  Available on Windows or Unix based platforms  Primary function is Workstation or Server Tasks like Database Access or Web Services  Can do little to regulate traffic destined for Embedded Control Devices Classes of Firewall

Packet Filter Firewall  Simplest class of Firewall following a set of static rules  Only the IP Addresses and the port number of the packet is examined  No intelligence to identify spoofed (Forged source IP Address) packages Classes of Firewall

Packet Filter Firewall

Application Proxy Firewalls  Open Packets at Application Layer  Process them based on specific application rules  Reassemble and forward to target devices  No direct connection to external server  Possible to configure internal clients to redirect traffic without the knowledge of the sender  Possible to apply access control lists against the application protocol Classes of Firewall

 Acting as Intrusion Detection System ; Logging denied packets, Recognizing network packages specifically designed to cause problems, Reporting unusual traffic patterns  Blocking infected traffic by deploying Front-line Anti-Virus Software on firewall  Authentication services through passwords or Public Key Encryption  Virtual Private Network (VPN) gateway services by setting up an encrypted tunnel between firewall and remote Host devices  Network Address Translation (NAT) where a set of IP addresses used on one side of a firewall are mapped to a different set on the other side. Other Firewall Services

 No direct connection from the Internet to the PCN/SCADA Network and vice versa  Restricted access from the enterprise network to the control network  Unrestricted (but only authorized) access from the enterprise network to shared PCN/Enterprise servers  Secured methods for authorized remote support of control system  Secure connectivity for wireless devices  Well defined rules outlining the type of traffic permitted  Monitoring the traffic attempting to enter PCN  Secure connectivity for management of firewall Overall Security Goals of PCN/SCADA Firewalls

Security: The likely effectiveness of the architecture to prevent possible attacks. Manageability: Ability of the architecture to be easily managed (both locally as well as from remote). Scalability: Ability of the architecture to be effectively deployed in both large and small systems or in large numbers. Firewall Selection Criteria

Dual-Homed Computers Common SCADA/PCN Segregation Architecture

Dual Homed Server with Personal Firewall Software Common SCADA/PCN Segregation Architecture

Packet Filtering Router/Layer-3 Switch between PCN & EN Common SCADA/PCN Segregation Architecture

Two Port Firewall between PCN & EN Common SCADA/PCN Segregation Architecture

Router/Firewall combination between PCN & EN Common SCADA/PCN Segregation Architecture

DMZ is a critical part of a firewall.  Neither part of un-trusted Network, nor part of trusted network  Puts additional layer of security to DDCMIS LAN  Physical or Logical sub-network that provides services to users outside LAN DMZ

Firewall with DMZ between PCN & EN Common SCADA/PCN Segregation Architecture

Paired Firewalls with DMZ between PCN & EN Common SCADA/PCN Segregation Architecture

Firewall with DMZ and SCADA/PCN VLAN Common SCADA/PCN Segregation Architecture

Comparison Chart for PCN/SCADA segregation Architecture

DDCMIS NETWORK SECURITY MEASURES TAKEN AT NTPC/TALCHER-KANIHA

PI Server Port 5450 10.0.120.202 Office Network Firewall Firewall Firewall ABT OPC Gateway PC Gateway PC Server + PI Honeywell + + OPC Server OPC PI OPC PI OPC Interface Interface Interface Stage I Plant Network Stage II Plant Network ABT Network Unit 2 Unit 6 Unit 1 Unit 3 Keltron Honeywell Keltron Honeywell OPC Experion OPC Experion Server System Server System Network T opology

Network Topology PI Server Port 545 PI Client 0 10.0.120.202 Office Network (NTPC LAN) Firewall Firewall-2 Firewall- -3 1 ABT OPC Gateway Server PC Honeywel OPC OPC (Redundant) l WAN + PI OPC Server Server Server Interface Main Standby ABT Network L-3 Switch L-3 Switch Unit 3 Unit 6 Unit 2 Unit 1 Honeywell Honeywell DDCMS DDCMS Experion Experion System System Stage II Plant Network

HEADS OF PLC COOLING CHP-1 CHP-2 DM PLANT PT PLANT COOLING PC - O&M TOWER-1 PLC PLC PLC PLC TOWER2 HEAD - OPER -C&I SHIFT M/C PLC OF - BOILER/TURBINE M/C ENGR PROJ etc -C&I M/C ENGR PT PLANT SWITCH SERVICE BLDG SWITCH Ash handling fire proof AC CPU PLC PLC PLC PLC PC1 … .. P C n SERVER PR SWITCH IT SWAS C&I shift PC Incharge PC FIREWALL BPOS system LA U#3,4,5 &6 N ESP GATEWAY PCs PC # MOR STN LAN STATION LAN SWITCH 3,4,5,6 PC SERVER OWS OWS / OWS UNIT-3 UNIT UNIT UNIT Unit 1 Unit 2 in PR LVS in PR -4 -5 -6 & CER in CCR & CER UNIT HMI LAN U#3 SWITCH Station LAN of Talcher-II UNIT HMI SERVERS Typical before PI connectivity CONTROL SYSTEM

HEADS OF PLC COOLING CHP-1 CHP-2 DM PLANT PT PLANT COOLING PC - O&M TOWER-1 PLC PLC PLC PLC TOWER2 HEAD - OPER -C&I SHIFT M/C PLC OF - BOILER/TURBINE M/C ENGR PROJ etc -C&I M/C ENGR PT PLANT SWITCH SERVICE BLDG SWITCH Ash handling fire proof AC CPU PI- PLC PLC PLC PLC SERVER PC1 … .. P C n PR SWITCH IT FIREWALL LA SWAS C&I shift PI- GATEWAY PC Incharge PC N BPOS system PC Interface U#3,4,5 &6 ESP PCs DMZ # 3,4,5,6 MOR STN LAN STATION LAN SWITCH PC SERVER OWS OWS OWS in PR UNIT-3 UNIT UNIT UNIT / LVS in PR Unit 1 Unit 2 & -4 -5 -6 in & CER UNIT CCR CER HMI LAN U#3 SWITCH Station LAN of Talcher-II UNIT HMI SERVERS after PI connectivity Typical CONTROL SYSTEM

PI- Server NTPC Office LAN PI- Interface - - - PI system connectivity at Talcher-II

Steps: 1. Review the existing LAN of NTPC/Talcher Kaniha 2. Perform a Bandwidth Assessment Test 3. Perform a Vulnerability Test 4. Conduct a Penetration Test 5. Conduct a Security Audit 6. Conduct a CCTV Demo between Talcher Kaniha & EOC-NOIDA 7. Recommendation and Suggested Up- Gradation Network Testing Methodology