Detecting Problems in Industrial Networks Through Continuous Monitoring, Level 301 Marcelo Ayres Branquinho
•Als PPT, PDF herunterladen•
0 gefällt mir•1,490 views
This document discusses continuous monitoring of industrial networks to detect problems. It describes what aspects of the network should be monitored, including servers, operating systems, processes, protocols, and controllers. It outlines how a test monitoring environment was prepared with a PLC, simulator, monitoring server, and traffic sniffer. Several attacks were performed, like DoS, ARP poisoning, malware infection. The results of monitoring detected these attacks by observing unusual traffic and system behaviors. The conclusion is that establishing a baseline and configuring triggers can help detect anomalies indicating network compromise.
Empfohlen
Empfohlen
Weitere ähnliche Inhalte
Was ist angesagt?
Was ist angesagt? (20)
Andere mochten auch
Andere mochten auch (13)
Ähnlich wie Detecting Problems in Industrial Networks Through Continuous Monitoring, Level 301 Marcelo Ayres Branquinho
Ähnlich wie Detecting Problems in Industrial Networks Through Continuous Monitoring, Level 301 Marcelo Ayres Branquinho (20)
Mehr von Digital Bond
Mehr von Digital Bond (15)
Kürzlich hochgeladen
Kürzlich hochgeladen (20)
Detecting Problems in Industrial Networks Through Continuous Monitoring, Level 301 Marcelo Ayres Branquinho
- 1. Detecting problems in industrial networks through continuous monitoring Marcelo Branquinho & Jan Seidl www.tisafe.com TI Safe Segurança da Informação LTDA, 2007-2008.Todos os direitos reservados.
- 2. Presentors Marcelo Branquinho Jan Seidl marcelo.branquinho@tisafe.com jan.seidl@tisafe.com • CEO at TI Safe. • Technical Coordinator at TI Safe. • Senior member of ISA and committee • Expert in risk analysis in member of ANSI/ISA-99. • Researcher in security technologies to protect critical infrastructure. www.tisafe.com automation systems. • Researcher in the field of malware engineering. TI Safe Segurança da Informação LTDA, 2007-2008.Todos os direitos reservados.
- 3. Follow us! • Twitter: @tisafe • SlideShare: www.slideshare.net/tisafe • Facebook: www.facebook.com/tisafe • Flickr: http://www.flickr.com/photos/tisafe www.tisafe.com TI Safe Segurança da Informação LTDA, 2007-2008.Todos os direitos reservados.
- 4. You don’t have to copy... http://www.slideshare.net/tisafe www.tisafe.com TI Safe Segurança da Informação LTDA, 2007-2008.Todos os direitos reservados.
- 5. Agenda • What should be monitored in an automation network? • Preparation of the monitoring environment. • The attacks performed. • Results of monitored attacks. • Conclusion. www.tisafe.com TI Safe Segurança da Informação LTDA, 2007-2008.Todos os direitos reservados.
- 6. What should be monitored in an automation network? www.tisafe.com TI Safe Segurança da Informação LTDA, 2007-2008.Todos os direitos reservados.
- 7. What to monitor in an automation network? • The “Health" of critical servers • Runtime errors in operating systems • Processes • High Availability • Data traffic on industrial protocols • Controllers (PLCs) • SNMP traps • ICMP Packets (Ping) www.tisafe.com TI Safe Segurança da Informação LTDA, 2007-2008.Todos os direitos reservados.
- 8. The “Health” of critical servers • Critical servers need to have stability and continuity of operations ensured. • Monitor the health allows the prevention of certain failures, as well as some malicious compromise, according to certain symptoms. • The main technical features that can be monitored in critical servers are: • Free disk space. • CPU and Memory. • Unsuccessful login attempts. • Input and Output packets rate. www.tisafe.com TI Safe Segurança da Informação LTDA, 2007-2008.Todos os direitos reservados.
- 9. O.S. runtime erros • Useful in anticipating hardware failures. • The anticipation of failures, in turn, protects the automation technical team from unscheduled stop for components replacement. • The main runtime errors in operating systems that can be monitored are : • Memory allocation. • Disk read/write. • CPU temperature. • Fan speed. www.tisafe.com TI Safe Segurança da Informação LTDA, 2007-2008.Todos os direitos reservados.
- 10. Processes • The monitoring of process stability can contribute in two situations : • Alerting the responsible team in case of failures in the execution of critical processes. • • Restart the process automatically, when possible. It is also recommended to monitor known exploited process names and ports, such as : • RDP • HTTP/HTTPS • TeamViewer • Cmd.exe • Windows PowerShell www.tisafe.com TI Safe Segurança da Informação LTDA, 2007-2008.Todos os direitos reservados.
- 11. High Availability • Aims to minimize the downtime of the monitored resource, anticipating potential failures. • Link states can be checked to see if the plant’s network enters into contingency state. • The monitoring agent can perform automated tasks when necessary. www.tisafe.com TI Safe Segurança da Informação LTDA, 2007-2008.Todos os direitos reservados.
- 12. Data traffic in industrial protocols • Is recommended to do a port mirroring to monitor data traffic on industrial protocols. • In the case of Modbus, for example, a network sniffer can be used to monitor several parameters. • The main parameter to be monitored are: • Disallowed function codes. • Tag values. • Command origin. • Sent and received commands. www.tisafe.com TI Safe Segurança da Informação LTDA, 2007-2008.Todos os direitos reservados.
- 13. Controllers (PLCs) • SNMP monitoring • Monitors network I/O, droped packets, network errors, etc. • Has higher reliability and, according to the errors, diagnose something wrong that might be happening. • ICMP Monitoring (Ping) • Alternatively if SNMP is not supported by the controller. • Used to check connectivity and response time. • Limited information therefore lower accuracy and less reliability. www.tisafe.com TI Safe Segurança da Informação LTDA, 2007-2008.Todos os direitos reservados.
- 14. Preparation of the monitoring environment www.tisafe.com TI Safe Segurança da Informação LTDA, 2007-2008.Todos os direitos reservados.
- 15. The Test Environment The sandbox mounted inside TI Safe’s Laboratory includes: • A Wago 741-800 PLC • A simulator of a natural gas plant (Tofino Scada Security Simulator) • A Windows 7 Station (physical) to the supervisory system • A virtual machine acting as the monitoring server (Debian Linux 6 with Zabbix) • A virtual machine acting as Modbus traffic sniffer server (Debian Linux 6 with script in python + scapy) www.tisafe.com TI Safe Segurança da Informação LTDA, 2007-2008.Todos os direitos reservados.
- 16. The Monitoring Environment • The monitoring server is a virtual machine running Debian Linux operating system. • This server has been downloaded and installed by running the open source monitoring solution Zabbix 2.0.6 using MySQL 5.1 as the data backend. Figure: The network Sniffer and its structure www.tisafe.com TI Safe Segurança da Informação LTDA, 2007-2008.Todos os direitos reservados.
- 17. Checking Frequency • Depending on the load that the machine performs, items can be configured to be polled in a defined interval. • • • Servers with lighter load can have shorter checks (each 15 to 30 seconds). Servers with hogher load can have more delayed checks (1 minute or more). The main idea is to preserve the machine computational power and the network bandwidth. www.tisafe.com TI Safe Segurança da Informação LTDA, 2007-2008.Todos os direitos reservados.
- 18. Alerting • Designed to alert the response team. • Best used when launched from a set of probes and reducing the possibility of false positive. • Can generate sound alerts and display visual signaling on a panel, as a blinking server . • The recommended alerts are: • SMS • Jabber • E-mail www.tisafe.com TI Safe Segurança da Informação LTDA, 2007-2008.Todos os direitos reservados.
- 19. The attacks performed www.tisafe.com TI Safe Segurança da Informação LTDA, 2007-2008.Todos os direitos reservados.
- 20. The Attacker Machine • The attacker machine is a HP laptop directly connected at the plant switch, running Kali Linux 1.0 from a Live-CD. Below is a list of software used on tests: Software / Tool Description Attack Author Hping3 ICMP flood tool Network Layer 3 denial of service http://www.hping.org/ T50 Flood tool Network Layer 3 denial of service https://github.com/merces/t50 Meterpreter Remote access shell Remote compromise, http://www.metasploit.com/ malware infection Arpspoof ARP poison/spoofing tool ARP poison Pymodbus Modbus python library Unauthorized modbus traffic www.tisafe.com http://arpspoof.sourceforge.net/ https://github.com/bashwork/pym odbus TI Safe Segurança da Informação LTDA, 2007-2008.Todos os direitos reservados.
- 21. Attacks performed Attack Attack Vector PLC Denial of Service Communications interception ARP poison PLC, Supervisory Stations PLC Denial of Service Layer 3 network flood, 0day PLC Supervisory station malware infection Modbus malware, Meterpreter shell backdoor Supervisory Stations, Network Supervisory station compromise Meterpreter shell backdoor Supervisory Station Unauthorized remote logon Enabling remote desktop on machine, accessing machine from other machine on network Supervisory Station Unauthorized modbus traffic Sending commands from attacker machine PLC www.tisafe.com TI Safe Segurança da Informação LTDA, 2007-2008.Todos os direitos reservados.
- 22. Results of monitored attacks www.tisafe.com TI Safe Segurança da Informação LTDA, 2007-2008.Todos os direitos reservados.
- 23. Results of monitored attacks • $ nmap –sV 192.168.1.1 • Communications interception www.tisafe.com TI Safe Segurança da Informação LTDA, 2007-2008.Todos os direitos reservados.
- 24. Results of monitored attacks • Denial of Service • Malware infection www.tisafe.com TI Safe Segurança da Informação LTDA, 2007-2008.Todos os direitos reservados.
- 25. Results of monitored attacks • Unauthorized Modbus traffic www.tisafe.com TI Safe Segurança da Informação LTDA, 2007-2008.Todos os direitos reservados.
- 26. Conclusion www.tisafe.com TI Safe Segurança da Informação LTDA, 2007-2008.Todos os direitos reservados.
- 27. Conclusion • The homogeneity of the cyclical behavior in industrial networks and servers allows us to establish the 'healthy' network parameters. • Network and servers analysis and applications monitoring are critical for the detection of unusual network traffic. • More tangible results can be achieved through behavior monitoring than through the monitoring of known keywords, the 'signatures'. • The establishment of a baseline traffic in the network control system is necessary for the detection of anomalous traffic through the analysis of differences. • Triggers can be configured to indicate parameters outside the usual data ranges that can mean a compromise of the assets being monitored. • Alarms (including sounds) can be configured based on triggers. • Only a few commercial tools for IACS monitoring are available for purchase, and we recommend the customization of an open source tool for your own monitoring needs. www.tisafe.com TI Safe Segurança da Informação LTDA, 2007-2008.Todos os direitos reservados.
- 28. Audience Q&A www.tisafe.com TI Safe Segurança da Informação LTDA, 2007-2008.Todos os direitos reservados.
- 29. We can help you! Marcelo.branquinho@tisafe.com Jan.seidl@tisafe.com Rio de Janeiro: +55 (21) 2173-1159 São Paulo: +55 (11) 3040-8656 Twitter: @tisafe Skype: ti-safe www.tisafe.com TI Safe Segurança da Informação LTDA, 2007-2008.Todos os direitos reservados.