hi my name is and i'm going to tell you
a bit more about fortifying ics
environments by applying harding and by
performing security testing
on those environments on those hardened
environments
um first little bit things about me i'm
active within uh
information security since 1998 and
within ics security since
uh almost uh 2008 so
mainly i'm doing uh or challenging ics
vendor solutions
to verify cyber security settings and
i'm also assisting in performing
security effort and start testing
for those vendors or for more and
customers
i'm also assisting end customers by
applying harming to those environments
or applying
harnett to the vendor solutions they
bought or they have
now a little bit more about fortifying
ics system systems so
it's also known as harding of course is
actually the process in which the
balance between usability and security
of a system is researched and enforced
so why would you think of doing harming
on ics systems first of all well
the more the systems are interconnected
the more
there are potentially attack factors of
those systems so
hardening is the process in which we can
try to reduce the attack factors of
those systems
uh we can try to reinforce the exposed
systems if there are any
and also securing our mode axis or
limiting
user access or verifying or
making operator jail protections more
foolproof
so that i cannot escape from the
operator gels
in question um when would you do harming
well
during projects of course when there's
new systems applied
or when there's refurbished systems um
into the environment
or when you're upgrading or applying or
installing
a new software component or hardware
component to the environment
most of the times if you cannot do it
during projects you can
try to do it at the next maintenance
stop but then you'll probably
have to have done some hardening
verification before that
as most of the times the next
maintenance stops are
sometimes too limited to perform the
proper hardening and testing of the
harmed environment
another reason why would you or when you
do harning is to close identified
security weaknesses
so if you perform security testing
within your environment
you often almost always you often find
security weaknesses
to close those identified security
weaknesses sometimes patching
can be insufficient or not possible and
that's the time when you would
apply harding to those systems as well
how would you do harming of course while
performing hardening can
can be done in three big different ways
so manually first applying
every single setting by manually so
changing register keys
removing software applying other
settings to your
system or you can create scripts to do
so
to assist you in doing your harding or
you can use group policies that can be
either local group policies or
uh central uh control group policies if
you have for example an active directory
so that's the the main difference
between domain join systems and
non-domain join systems
but in both occasions you can use group
policies either locally or
centrally um and a big question now is
how not to perform learning well
actually
harming is not a click and play
configuration so
you cannot just take a script run it
and hope that everything still will work
that's something that some of the
vendors i've been working with during
hiring processes
are doing it wrong they just take the
scripts that
were published for a certain hardening
guideline
but they didn't look at any setting
within the harming guidelines so they
failed to understand
what settings were applied or going to
be applied by using the script
so an example here is that a hardening
guideline i created for one of my
customers
was for a completely isolated system and
the vendor
was applied to that harding guideline
and the accompanying script
but that was for a connected system so
he applied the
completely isolated harming script to
the connected system
resulting in a loss of connection of
that system so that's why i mentioned
harming is certainly not a click and
play configuration
type approach that's sometimes works but
in most cases you'll
run into problems um before we continue
further you should
ask yourself your question so what is
your actual hardening strategy
so what systems or environments will you
harm
what systems or environments will you
harm first
so those are questions that need to be
answered before you
dig into the further harming process
there's also a list of potential
problems that you can run into
during the harning a lot of things can
go wrong for example
and the whole list here is no more
access to user interfaces no more access
to file shares printers so
no more access to file shares is
actually one of the most
um occurring issues
that that run into during harning
because well
they want to have file shares of course
hmi applications can stop working or
your system application can crash
even sometimes you can run it to domain
wide
problems so the domain can get down or
something like that
um another thing that to keep in mind is
that time difference with
time differences between systems uh need
to be sorted out properly as well
uh certainly if you if you're using ics
applications or hmi applications
the time need to be almost you know
completely the same actually
to prevent information and data loss
you can lose touchscreen functionality
if you disable the
use the touchscreen functions in the
operating system of course
and operators can lose access um so
the whole list of things that come wrong
is the key is here
that you should solve that problem that
particular ident isolated problem
or you should revert to a known good
state before
you start applying the harding
sometimes you have to live with some
settings that
are not as strong as they
should be for a particular environment
so sometimes you just
can't do anything else by accepting
those settings
so what's less likely to be hardened
well more and more black box systems
because
because those are often used as
guarantee buy-ins or lock-ins so the
vendor lock-in here
is uh can cause guarantee issues if
you try to touch or even change settings
on a black box system so
that's uh something to keep in mind so
the
the best thing to do then is try to
mitigate the
potential issues of that black box
systems in another way but we'll come to
that later on
other systems that are less likely to be
harmed as um office clients
because they need to be able to do
anything right
um by using legacy systems um it's often
the case that
people are really reluctant in touching
legacy stem systems because they do not
know the system
they cannot predict uh
what's going to happen if they don't if
they confront something on the legacy
system
here's the little flow chart that i
created um
for potential problems during hiring so
what
if you cannot perform the harding well
you have
at that stage an insecure system you
cannot do the harming so
then first thing to check is can you do
an upgrade of the system
if you can do well fine you'll end up
with a secure control system
if you cannot upgrade you might want to
look at if you can replace it or not
if he cannot replace it well then you
have to investigate if you can isolate
the system
but if you cannot do anything of those
so no hardening no upgrading no
replacing
no isolation well the thing is then uh
what
could go wrong well a lot of things can
go wrong of course
so what things would you harm uh you
have identified
that you want to do horny you have
identified the systems that you want to
do hardening
when you will do the harming and why you
will do the harding but now
the things that you want to do hardening
for so what
you have to define those as well so
actually
all things that could pose a risk to a
system are candidates for potential
harming meaning software
all installed software packages not only
the operating system software
but also additional packages services so
it's not only enough to
stop the service but it's also key to
investigate when uh it or if you can
disable services so that they cannot
start up again
after you have launched something else
so account policies user rights and
permission onto the operating system
network interface settings that is very
often forgotten about
that a lot of network interfaces keep
their default
bindings that's more on windows systems
of course there are default interface
bindings enabled
even if they do other style harning
those bindings are
left left present
remote administration solutions if there
is um
not fdp that's used often you have
erratman
you have teamviewer or other solutions
out there
teamviewer might not have been the best
example i gave but let's say cannot been
well it's often the case that
default erroratment installation it
might change already
but default uh configuration is not
always the best uh
configuration for your environment also
not to forget as peripheral port access
so usb ports serial ports
whatever ports there are there that are
not used
should be disabled of course
if you don't need for example usb data
storage you should disable usb desktop
data storage if you do not need
to install additional usb drivers for
keyboard mouse or
ethernet dongles or whatever disable
that possibility
just to prevent people from attaching
other usb devices that get
recognized on the system that you can
get access to the system by using those
um operating system access by using
operator gels
gave a talk on that a few years ago in
stockholm
but operated jail escaping is always
almost always possible but it depends on
the service account or user account the
application is running with
that will determine your access to the
further operating system
below so that's why applications should
first of all never run as administrator
access for example we insisted used to
need administrator level access so that
was a problem
already but by further protecting the
operator jail so by limiting
what the operator can do onto the
operating system
will further limit possible attack paths
into the system now
the learning process first of all you
begin with choosing
the right operating system for job
yeah normally you would have been able
to
select a good operating system based on
what the functionality needs
for the system but very often you are
forced into certain operating systems
based on what the vendor solution
requires
so today this is unfortunately very
often windows based operating systems
although the last versions are getting
more secure
which is good of course um
using custom operating systems
well that's problem when those systems
have a lot of functionality embedded
which are not always uh disabled by
default
so that's why we do the hard right and
of course sometimes you have to
sometimes you have to live with
using obsolete operating systems and
software
so sometimes you cannot do anything else
besides just putting the system onto
another environment
and making sure that nothing else can
happen to that system
one thing that you should not forget
before doing the harning is
taking backups and of course testing
those backups
to make sure that if you have done the
harding and something else wrong during
hardening you can revert to a known good
state
as i showed a few slides before
after you chose your training system
it's a good thing to analyze the
necessary functionality and the current
security of the system
if you have an up-to-date operating
system the current security of the
system without the application installed
should be pretty much okay
but still might need some additional
hardening so additional security
settings depending on
the location and the criticality of the
system but as you will introduce pro
potential applications uh hmi
applications dcs applications whatever
application is required for the
functionality of the system
you will have to recheck the
functionality and recheck the current
security of the system
recheck the operating system
applications what data flows are
required what sources are needed
and then of course you can try to
determine what can on
or should be hard so this
of course depends on the identified
security issues if there are any
identify on what's needed for the system
um
if there's software that's installed you
should check
if that software needs to be removed or
upgraded before you do any harding to
make sure that
you have a on software aspect and the
pre-system aspects
the last updated environment
for uh your your software set
then of course do the hardening it's
often in a trial and error
style approach because in most
or in a lot of occasions you will not be
able to determine
uh what things or the vendor might not
be able to determine exactly what's
needed for
the horning and how for the environment
and what not
i've been in that situation when i
helped harning
for a solution vendor it was done
through gpos and we had to change gpus i
think five or six times because the
vendor even didn't know
his environment properly um
after you do the hardening after
everything is running
first thing is of course verifying the
functionality of the system making sure
that everything
is running properly is working properly
but then it's also
key to verify residual risks of the
systems after you have applied the
harning
to making sure that after harming the
system is good
is secure or as secure as possible
and try to identify what you can do
with those remaining risks after the
harming
a big thing to understand is that
whenever there's major system changes
to the harm system you have to verify if
you
do not have to reapply hardening after
that
because in a lot of occasions installing
patches
installing operating system patches or
application upgrades
some settings might have to be reapplied
or
might have to be added to the hardening
set to make sure that the
known secure state stays as secure as
possible
sometimes of course it's necessary to
revert changes
if the hmi or the dcs or the hardened
systems run into problems or something
doesn't work and you cannot solve it
by just changing one single setting in
the harning
you might have to restore or revert
changes
so there's a few options there first
restoring the image well that's full
recovery so there's no more hardening
present on the system the second choice
is restoring a snapshot
this will only do a full or partial
recovery depending on the
applications that are installed and as
also depends on when the snapshot was
taken of course for the image
restoring the image it also depends when
their image was taken
and you can as a third option uh choose
to restore only
some saved settings that's only a
partial recovery and a partial hardening
remains of course
in this case if you need to restore or
revert changes it's
important to verify the or re-verify the
analysis phase to make sure
that you haven't missed anything to so
to be able to restart a hardening
if you're allowed to from your customer
or
vendor position line
this slide shows you some uh indicators
in the iec six two four four three
and where harning as mentioned first of
all in the dash 2-1
of course in the dash 2-4 because that
talks about
requirements for iacs suppliers and of
course during system and component
there's also
mentioning of hardening um for having a
secured installation
now uh this was the hardening part um
we can also fortify ics systems by
performing security testing by
knowing your weaknesses and then of
course depending that we can do
hardening
after knowing those weaknesses or not
fortifying by testing is first of all
verification of what needs to be
hardened
before doing a harding verify
verification of what has been harmed
after hardening of course and
identification of
any other security issues and residual
risks
so you can do that by doing regular
cybersecurity testing if you are allowed
within your environment of course
or by doing cyber security fat and
self-testing in
projects actually cyber security fat
testing is
one of the few times in the in an ics
environment where you can do
when you can go all the way with your
skip testing because it's an
isolated test environment and then you
can
do full-blown cyber security testing at
will
so cyber security fatsar testing is the
cybersecurity validation of new
upgraded systems new or upgraded systems
and solutions within your environment
why do we would you ever do cyber
security testing within
with an ics environment first of all as
i said already verifying cybersecurity
second one is verifying compliance to
cybersecurity
or project or user requirements but you
should not stop there
because by doing testing you also at the
same time create awareness
with your vendors operators with inc
people
and you are making sure that most
cybersecurity issues
are known um and are candidates to be
solved before you go into commissioning
so cyber2 testing together with harning
to together with fatal sat site testing
will gradually increase your security
within your environment
when would you do cyber security testing
well for every new system or solution
for every updated system or solution of
course during project fossil testing
cycles in which
you have certainly new systems or
ability systems
certainly or during regular cyber
security evaluations
if you're allowed within your
environment
so this is a timeline in which the
requirements
for testing and residual risk
determination is shown
hopefully within projects at your
organization
or your customers they said cyber
security requirement
cyber security requirements upfront with
the during procurement
together with the doing a risk
assessment to identify
potential risks to your environment
before running into cyber security fat
and self-testing
i put cybersecurity fat subtesting on
the construction phase because actually
that's
at the vendor side during construction
during test environment
um you can choose to do that before
during or after functional uh cyber
functional fat testing
and the same with the subtesting
cybersecurity subtesting that's during
commissioning and you can choose to do
so
before during or after functional start
testing
um it is sometimes very interesting to
do functional
testing and cyber security testing
during fat or sat at the same time
because then operators i see people even
a vendor will
see how the system reacts
on the cyber security testing events
during a real scenario
what should you test and verify well
first of all everything on the network
everything on the system everything on
the physical site and everything on the
application side
that's in a nutshell but on the network
you have the ports network
vulnerabilities
traffic encryption is firewalls used on
the system you have system
vulnerabilities configuration issues
not only in the operating system but
also for additionally installed
applications
you also have system physical security
and so on as well
so you have the list complete list there
the main thing is that harmon harding
bass lines or harlem guidelines
if there are any should be used to
verify against
uh super used to test against but you
should not stop
there you should verify if those
hardening guidelines and security
testing checklists should not be updated
with specific test requirements
specific project information or vendor
specifications
so your standard checklist should be
updated regularly
and you should not forget that you
should verify logical physical and human
aspects
of the to be tested environment
do note that testing of hardened systems
might require temporarily reverting
certain settings
if you for example do harding on windows
systems
some things that you will certainly do
is disabling the remote registry service
if you disable the bindings on the on
the interfaces
and you enable the firewall and so on
and so on those are all things typical
things that you might
have to temporarily disable or
deactivate before being able to do some
authenticated
vulnerability scanning on systems
depending on the vulnerability scanner
that is used of course
another thing that's important next to
the hardening strategy is creating
security testing strategy so cyber
security testing should be embedded
embedded within quality assurance
processes
cyber security's testing should also be
embedded within
project processes so regular testing
uh fat cell testing um those are all
things that
uh that's as important to keep in mind
but also having some
own testing equipment or adversary
emulation
solutions at hand to be sure that
you are able to test everything if you
don't have that capability you can
always outsource that capability to
trusted parties of course
but you should always include logical
human and physical elements within cyber
security testing
and play the what if game so what
happens if i
plug in my usb to ethernet download for
example
what happens when i click on this button
when you do operator jail protection
checks and all that kind of what if
questions
can pop in your into your mind when
doing testing on or when
trying to define uh harding's and
testing strategies
and last but not least is a cyber
security fatsat reporting
so security assessments is nothing with
it
without a decent cybersecurity test
result report
but here in this story and then
fortifying ics
so you should use the cybersecurity test
results
to adapt your hardening strategy and in
the end also your testing strategy
to make sure that you are able to cover
everything
so thank you for your interest and
should you have other questions on this
topic you can always reach me out
reach out to me on the the mentioned
information on this slide
thank you talk to you later