t24 - rockwell automation · pdf filenew tools: emergence of global standards – iso, iec...

PUBLIC

Copyright © 2018 Rockwell Automation, Inc. All Rights Reserved. 1

T24 - Safe and SecureHelp Mitigate Your Risk through Services and Technology

PUBLIC Copyright © 2018 Rockwell Automation, Inc. All Rights Reserved. 2

Agenda

Risk Reduction Strategies

People Safety Risk Reduction Methods

Cyber Security Approach

Risk Landscape

The Problem


What Is Risk?

Vulnerability = Attack Vector * Difficulty to Exploit

Threat = Intent * Opportunity * Capabilities

Consequence = Criticality or Impact to People Safety, Environment etc.


What Is Risk?



IT/OT Convergence

Lack of comprehensive asset inventory

Integration of new technologies

Integrate: customer demand, supply chain and industrial processes

Inflexibility

Low adoption of risk management processes

Shadow/stealth IT Lack of tools to manage

infrastructure Too much data, lack of

actionable information

Skills Gap Assets

Security is an afterthought Aging industrial control

systems and protocols Lack of proper policies and

procedures Evolving industrial security

standards

Dearth of qualified personnel 1

Achieving productivity goals

Lack of staffing to expand operations 2

(1) ARC Supplier Provided Automation Services(2) Aberdeen Group

VULNERABILITIES


ICS ATTACK VECTORS

DMZ

Email, Intranet, Business Planning & Logistics Network

IT Network

OT Network

ICS Supply Chain

wwwSIEM/SOC Servers

Remote Maintenance

SCADAServer HistorianHMI

PLC

Pump

EngineeringStation

OperatorWorkstation

Insider Threat

PLC

Actuator

PLC

Valve

PLC

Sensor

On-site Maintenance

Direct Attackon Plant Network

Direct Attack viaIT Network

USBIndirect Attack

(Compromised VPN) (Compromised Device)

VPN Device

ExternalAdversaries


What Is Risk?



Insiders Cyber CriminalsHacktivistsNation States Terrorists

THREAT LANDSCAPE


20172010 2011 2012 2013 2014

STUXNETWorm Targeting

SCADA and Modifying PLCs

OPERATION AURORA

APT Cyber Attack on 20+ High Tech,

Security & Defense Companies

NIGHT DRAGON

Advanced Persistent Threat Targeting Global Energy

SHAMOONVirus Targeting Energy

Sector LargestWipe Attack

RED OCTOBERCyber-Espionage Malware Targeting Government and

Research Organizations

FLAMEVirus use for

Targeted Cyber Espionage in the

Middle East

DUQUWorm Targeting ICS

Information Gathering

and StealingGAUSS

Information Stealer Malware

HAVEXIndustrial Control System Remote Access Trojan &

Information Stealer

HEARTBLEEDSecurity Bug and

Vulnerability Exploited

by Attackers

2015 2016

BLACKENERGYMalware Injected into

Ukrainian Power Company Network, Cut Power to the Affected Region

OP GHOULSpear-phishing

Campaign Targeting Middle East Industrial

Organizations

140197

257 245295

BLACKENERGYMalware Injected into

Power Company Network, Attackers Cut Power to the Affected

Region

290

ICS CERT INCIDENT COUNT**Only Reported Incidents in U.S.

NOTPETYARansomware Malware

BasedOn Stolen NSA

Exploits that Impacted ICS Systems

290TBD

WANNACRY

THREAT LANDSCAPE

Ransomware Malware Based

On Stolen NSAExploits that Impacted

ICS Systems


What Is Risk?



Consequences

Robert M. Lee and Michael Assante, SANS Institute, The Industrial Control System Cyber Kill Chain

Results In


Out of date, unpatchedinfrastructure

INDUSTRIAL CYBER RISK EQUATION

Impact to:Achieving Business Objectives

Unplanned Production LossEnvironmental Impact

Human Health & Safety

Countermeasures

Threats

Spillover from Nation State CampaignsWiper/Ransomware

Unknown asset inventory

Vulnerabilities Consequences

Basic Industrial Cyber Hygiene Advanced Countermeasures

Lack of skilled resources


Changes in Current and Future Risk

Implementation Progress Changes in Assets, Vulnerability and Threat Target Profile

Implementation

Priorities, Risk Toleranceand Budgets

Risk Management

Notional Information and Decision Flow within an Organization: NIST Cybersecurity Framework

Business/Process LevelFocus: Critical Infrastructure Risk ManagementActions: Selects Profile, Allocates Budget

Executive LevelFocus: Business RisksActions: Risk Decisions and Priorities

Focus: Securing InfrastructureActions: Implement Profile

Implementation/Operations Level


Strategic

ICS Security Methodology:Strategic vs. Tactical

Securing your operations networks with a risk-based approach

Tactical

Understand Risk Tolerance and Business

Impact

Assess Security Posture,

Threats, VulnerabilitiesDevelop / Iterate Security Profile

Implement Prioritized Action Plan

Manage, Monitor, and Respond


Strategic Help develop an OT cyber security

program Adopt an industry framework Understand customer business

drivers and risk tolerances to drive target profiles

Conduct assessments to develop an understanding of gaps

Create an improvement plan to drive the tactical approach

Tactical Execute on filling gaps as defined and

prioritized in the strategic approach Use validated designs and

architectures Implement pre-engineered

infrastructure and software solutions to achieve targets


DURINGBEFORE AFTER

Attack Continuum







Countermeasures

Threats


Unknown asset inventory





ASSET INVENTORY SERVICES:How Does It Work?

A Rockwell Automation®

Installed Base Evaluation™ (IBE) collects

both connected and non-routable, isolated, or disconnected assets

through a manual walkthrough approach.

With context built from other inventory methods, a

disciplined Active Approach can be used to fill gaps in

attributes collected.

A continuous Passive Approach collects asset inventory by using Deep

Packet Inspection technology that understands both IT and OT protocols to enumerate asset identifiers,

including communication flow maps.

A Rockwell AutomationSoftware Inventory Evaluation acquires

Windows-based attributes to understand vulnerability footprint and remediation

steps required.


Microsoft Rockwell Automation

Release Patch Rollups:• Security fix• Quality fix

PatchQual Lab Tests Patch Rollups:• Qualification levels

(fully, partially, etc)

Remote Support Services

Stage Patches in an Azure-based WSUS:• Fully qualified patches to

match customer’s OS/applications revision

Your Infrastructure

Remote Support Services

Managed: Using vSphere HA and WSUS, we work with your team to remotely test, verify and apply patches based on standard/best practice procedures that meet your production workflows.

Customer

Fully Patched and secure ICS infrastructure

Self Service: You have the patches you need specifically for your environment and may update them as you see fit.

or

How Does It Work?


Out of Date, unpatchedInfrastructure





Countermeasures

Threats


Unknown Asset Inventory





Plan, Design, and Implement

Individually Managed Site ApplianceOT Assets

IT AssetsDeep Packet

Inspection (DPI) on IT and OT Data Streams

Alerts & Events

Managed Service Provider with OT Knowledge

Centralized Self Management (IT SOC)

And / Or

Respond, Recover

- Review infrastructure and documentation - Appliance implementation- Definition of asset criticality- Review and sterilization of baseline results for immediate remediation

Manage, Monitor and Detect

- Response and recovery plan development and review- Containment, eradication and recovery workflows- Characterize and scope potential impact- Set course of action and incident reporting


ROCKWELL AUTOMATION MANAGED SERVICES

INDIVIDUALLY MANAGED

SITE APPLIANCE

OT ASSETS IT ASSEST

CAPABILITIES BENEFITS Continuous passive and

vendor agnostic asset discovery and identification

Automated detection of operational and security anomalies

Self managed or managed by Rockwell Automation

Improve visibility of ALL connected plant floor assets

Improve cyber defense capabilities for the OT environment across the cyber attack continuum

THREAT DETECTION SERVICES

Powered by

INDUSTRIAL CONTROL SYSTEMS




Impact to:


Countermeasures

Threats


Unknown Asset Inventory





Focus on Consequence to Improve People Safety





How Do We Define Impact to People Safety?

Industry Standards: OSHA, ISO, IEC, ANSI, NFPA Common Industry Practice is to follow Hazard Risk Number (HRN)

Degree of Possible Harm (DPH) Likelihood of Occurrence (LO) Frequency of Exposure (FE) Number of People at Risk (NP)


Target Ways to Reduce the Impact Degree of Possible Harm (DPH)

Frequency of Exposure (FE)

Likelihood of Occurrence (LO)

Number of People at Risk (NP)


27

Analogy: Bicycle Helmet Safety

27

perf

orm

ance

Functionally Safe! Comfortable Light Cool

pres

ent Functionally Safe! Comfortable (pads) Light (foam or

composite) Cool (ventilation)

past

Functionally Safe! Uncomfortable Heavy Hot


perf

orm

ance

pres

ent

past

Technological Safety Components

28

Functionally Safe!

Easy to apply Safety Rated

Products Local Diagnostics

Functionally Safe!

Cumbersome Difficult to apply Difficult to use Often Bypassed

Functionally Safe!

Flexible Task Oriented


Go from Risk to Results

Evaluate Hazards. Prioritize Improvements.

SAFETY LIFECYCLESAFETY FUNCTIONAL REQUIREMENTS SPECIFICATION (SFRS)

1 ASSESSMENT

2DESIGN & VERIFICATION3INSTALLATION & VALIDATION4MAINTAIN & IMPROVE5

Comply with Standards

Optimize Production

Reduce Risk


Solution

Task

Team

Hazard

Task and Team Based Risk Assessment


Technology to Help Reduce Risk Software for Task Based Design

QR Code Instant Access to Safety

Safety Lifecycle Progression Tools

Machine Interaction Tracking

Facility Location

Machine Group

IdentifierMachine Assessment

Functional Design

DesignCircuit/Design

ReviewInstallation Validation SOPs ADP LOTO

Confined Space

Annual Procedure Validation

% Complete 100% 78% 39% 35% 30% 26% 57% 78% 78% 13% 0%

Main Line 2 Air Cleaner YES YES NEEDED NEEDED NEEDED NEEDED NEEDED NEEDED NEEDED N/A In ScanESCMain Line 2 Bottle Div ider YES YES YES YES NEEDED NEEDED NEEDED NEEDED NEEDED N/A In ScanESCMain Line 2 Bottle Line Conv ey or YES YES NEEDED NEEDED NEEDED NEEDED NEEDED NEEDED NEEDED N/A In ScanESCMain Line 2 Cap Elev ator YES YES YES YES YES YES YES YES YES N/A In ScanESCMain Line 2 Capper YES YES YES YES YES YES YES YES YES N/A In ScanESCMain Line 2 Case Packer YES YES YES YES YES YES YES YES YES N/A In ScanESCMain Line 2 Case X-Ray YES N/A N/A N/A N/A N/A YES YES YES N/A In ScanESCMain Line 2 Decaser YES YES YES NEEDED NEEDED NEEDED YES YES YES N/A In ScanESCMain Line 2 Depalletizer YES YES YES NEEDED NEEDED NEEDED YES YES YES N/A In ScanESCMain Line 2 Filler YES YES YES NEEDED NEEDED NEEDED YES YES YES YES In ScanESCMain Line 2 Full Case Conv ey or YES N/A N/A N/A N/A N/A YES YES YES N/A In ScanESCMain Line 2 Heat Tunnel #1 YES YES NEEDED YES YES YES YES YES YES YES In ScanESCMain Line 2 Heat Tunnel #2 YES YES NEEDED YES YES YES YES YES YES YES In ScanESCMain Line 2 Hot Melt #1 YES YES NEEDED YES YES YES YES YES YES N/A In ScanESCMain Line 2 Hot Melt #2 YES N/A N/A N/A N/A N/A YES YES YES N/A In ScanESCMain Line 2 Labeler YES NEEDED NEEDED NEEDED NEEDED NEEDED NEEDED YES YES N/A In ScanESCMain Line 2 M.T. Bottle Conv ey or YES NEEDED NEEDED NEEDED NEEDED NEEDED NEEDED YES YES N/A In ScanESCMain Line 2 Neckbander YES YES YES YES YES NEEDED YES YES YES N/A In ScanESCMain Line 2 Ov erhead Case Conv ey or YES YES NEEDED NEEDED NEEDED NEEDED NEEDED NEEDED NEEDED N/A In ScanESCMain Line 2 Palletizer YES YES YES NEEDED NEEDED NEEDED NEEDED NEEDED NEEDED N/A In ScanESCMain Line 2 Sealer YES YES NEEDED NEEDED NEEDED NEEDED NEEDED YES YES N/A In ScanESCMain Line 2 Spiral Conv ey or YES YES NEEDED NEEDED NEEDED NEEDED NEEDED YES YES N/A In ScanESCMain Line 2 Unscrambler YES YES NEEDED NEEDED NEEDED NEEDED NEEDED YES YES N/A In ScanESC

58%

Machine Safety Lifecycle Progress


Services to Help Reduce Risk Risk Assessments with Production Focus

Safety Program Development & Management

Site Safety Prioritization Planning

t24 - rockwell automation · pdf filenew tools: emergence of global standards – iso, iec...

Documents