Palestra realizada no segundo dia do CLASS 2018.

1. Protecting OT from IT risks
Shad Harris
Senior Subject Matter Expert, Security Analytics & SSL Visibility Appliance.

2. Who am I?
• Shad Harris
– Currently a Senior Subject Matter Expert for the Security Analytics and SSL –Visibility platforms
• Been doing this about 7 years
• Prior to Symantec I worked with the United States Department of Energy
– Was a cyber security analyst
– 3500 mixed classification users
– Nuclear, Chemical, Energy and Defense research facility
• Worked along side Department of Homeland Security and DOD
contractors/researchers
• Was shown the dangers of SCADA and Operational Technologies
2
Copyright © 2015 Symantec Corporation

3. Why do I care about OT
• I have a couple examples – later
• When you blend OT and IT a special situation is created, in which only one of two was
designed with security in mind.
• OT/SCADA vulnerabilities can have devastating real-world implications and possibly
loss of life.
• The expertise to use OT/SCADA is hard to find
• The expertise to secure OT/SCADA is even HARDER to find
• The implications are drastic.
3
Copyright © 2015 Symantec Corporation

4. IT Compromising OT
Simplified View
5
Copyright © 2015 Symantec Corporation
PLC
SCADA/OTSERVER
HUMANMACHINEINTERFACECorporate
LAN
DMZ Control
Network
Internet

5. Example 1 – The Aurora Vulnerability - 2007
6
Copyright © 2015 Symantec Corporation
Idaho National Laboratory ran the Aurora
Generator Test in 2007 to demonstrate how a
cyberattack could destroy physical components
of the electric grid
Nuclear Power Generator
Smoke Billowing from
Generator after failure
The experiment used a computer
program to rapidly open and close a
diesel generator's circuit breakers out of
phase from the rest of the grid and cause
it to explode!!

6. Example 2 – “The Ukraine Event” - 2015
7
Copyright © 2015 Symantec Corporation
Hackers remotely took control of 3 Electric Power control centers and cut the power to
over 225,000 residential customers located in Ukraine.
The “hack” was incredibly well orchestrated,
but ultimately deemed a fairly “normal”
cybersecurity breach. The attackers used
common methods in conjunction with
knowledge of the OT in use at the target site
to compromise a large electrical grid
management solution
https://www.nerc.com/pa/CI/ESISAC/Documents/E-ISAC_SANS_Ukraine_DUC_18Mar2016.pdf

7. Symantec SCADA Protection
• Delivering real-time comprehensive visibility into threats targeting
SCADA and ICS/OT environments.
8
Copyright © 2015 Symantec Corporation
• Network forensics and network malware detection
– Network based malware detection for Windows
systems – plant, control, HMI, ICS stations.
– Full packet capture, forensics, and anomaly detection
• SCADA networks
– Modbus, DNP3, and Ethernet packet capture,
forensics, and SCADA protocol anomaly detection
• Windows ICS USB malware protection
– USB malware protection for HMI and ICS workstations

8. Symantec SCADA Protection
• Solution information
9
Copyright © 2015 Symantec Corporation
• Security Analytics
– Full-Fidelity Packet capture solution
– SCADA Protocol visibility – Record and monitor MODBUS and DNP3 control network information
– Custom Protocol Detection Capabilities – Custom parsing for protocols
– Anomaly Detection – Looking for the non-compliance
– Data Enrichment – Cross reference enriched Metadata and SCADA information in the same view
• Malware Analysis
– Coupled with SA, perform detection and alerting for pedestrian & targeted malware as it enters the plant & office network
and hits the Windows control systems.
• Symantec Intelligence Services
– The most comprehensive Intelligence information resource available to multiple Symantec Products.
– Additional insight into known threats for both IT and OT risks.

9. Symantec SCADA Protection
• Security Analytics and Malware Analysis – BETTER TOGETHER!!
10
Copyright © 2015 Symantec Corporation
• SA - monitor the Windows systems for malicious files and network activity
• SA - monitor the MODBUS & DNP3 for malicious network activity & forensic reporting
• SA + MA - Monitor the network and automatically perform sandbox analysis,
determining the validity/maliciousness of the sample and reporting back to SA.
Global Intelligence
Network
Internal
Network
Web
Server
ProxyS
G
Content
Analysis
Malware
Analysis
Security
Analytic
s
SSL Visibility

10. SCADA: ModBus & DNP3 Indexed Attribute visibility
11
Copyright © 2015 Symantec Corporation
Reports
Tab
SCADA
Some of the many
SCADA Attributes
available in
Security Analytics

11. Malware Targeting Windows SCADA Control Stations
Havex – a RAT designed for targeted ICS attacks, disguised as a legit SCADA application
Symantec SCADA Protection

12. Symantec SCADA Protection
ICS Protection Scanning Station
• Scans all removable media
• Can enforce more stringent USB
policies in ICS environments
• Prevent non-scanned removable
devices from being inserted with
the “Non-interuptable Kernel
Driver” endpoint agent

13. Symantec SCADA Protection
• GLOBAL INTELLIGENCE SERVICES
14
Copyright © 2015 Symantec Corporation
• Blocking 99.99% of Emerging Threats with Advanced Threat
Defense Solutions and Up-To-The-Minute Global Threat
Intelligence
• Trusted by 150,000 corporations globally
– 70% of the fortune global 500
• 200 threat analytics engines
• 55 Supported Languages
• Identifies 99.99% of known and emerging threats

14. Focusing on the Future
• The Bad 
–Ransomware will inevitably focus on control systems
• Symantec is positioned as a leader in ransomware protection
–The Internet of Things movement is pressuring vendors to accelerate
automation in order to boost operational efficiency.
–Lack of skilled cyber pro’s is deepening
• The GOOD ☺
–Conferences like this are helping raise awareness
–SCADA Security Frameworks are being developed and implemented
–SCADA/OT vendors implementing security measures in their tools
15
Copyright © 2015 Symantec Corporation

15. Q&A
16Copyright © 2015 Symantec Corporation

16. Thank you!
SYMANTEC PROPRIETARY/CONFIDENTIAL – INTERNAL USE ONLY
Copyright © 2015 Symantec Corporation. All rights reserved.
Shad Harris
Shad_harris@symantec.com