Cyber Security - a New Challenge for Production (Management) Heiko Wolf, Manager R&D Program PSImetals FutureLab

Transcription

1 Cyber Security - a New Challenge for Production (Management) Heiko Wolf, Manager R&D Program PSImetals FutureLab

2 The Challenge Complexity of IT-Systems is rising Landing on the moon with lines of code Today: Boeing 787: 6,5 million Mercedes S: 20 million Chevrolet Volt: 100 million Systems are becoming more interconnected Internet-of-Things, Industry 4.0, M2M, V2X, etc. Virtual infrastructures (Cloud, etc.) Dependency on IT is growing Smart Grid, Smart Home, Smart City, Smart Phone ecommerce, Digital Production, etc PSI - Software Excellence in Metals

3 Cybercrime Ransomware Source: Symantec Internet Security Threat Report PSI - Software Excellence in Metals

4 Motivation for Attacks Is Changing Cracker / Script Kiddies Cybercrime State-sponsored Attacks PSI - Software Excellence in Metals

5 Yes, It Happens PSI - Software Excellence in Metals

6 There s No Alternative to Digital Transformation Already today, the steel industry is automated to a degree. A complex and quality-focused production would be impossible without integrated IT systems PSI - Software Excellence in Metals

7 Industry 4.0 Turbo-Charging Digital Transformation PSI - Software Excellence in Metals

8 Getting Rid of the Pyramid From traditional integration layers To business driven connectivity Level 4 Level 3 Sensors / IoT HMI Level 2 unicast broadcast Service Bus synchronous asynchronous Process Control ERP / CRM Level PSI - Software Excellence in Metals

9 How Do These Attacks Work? Remote control, data exfiltration IT (Office/Enterprise Network) OT (Industrial Control Systems) Attacker Initial attack by phishing mail or drive-by download Office Users Lateral movement Distributed Control System (PLC s, etc.) Disrupting operations Firewall Firewall Internet Administrators Accessing the Process Control Network SCADA Systems PSI - Software Excellence in Metals

10 Social Engineering Effort to attack a system vs. reaching a goal If technical attacks are hard Social engineering Source: XKCD - Source: Microsoft Security Intelligence Report PSI - Software Excellence in Metals

11 Security Has Costs Setup effort Reduced comfort Reduced performance Money Level of security Pareto principle Effort PSI - Software Excellence in Metals

12 Good enough Security Economics A perfect security system is not necessary! Also not feasible/possible/affordable Too strong focus on one area risks neglecting others weakest link There are no secure systems, only degrees of insecurity (Adi Shamir) It s all about risk first thing should be a risk analysis A absolutely secure system that s not usable any more has the same business value as a system without any security Security Comfort Functionality Performance Find the balance that s right for you! PSI - Software Excellence in Metals

13 IT Security Definition of Risk According to ISO 73:2002: Risk: combination of the probability [ ] of an event [ ] and its consequence Threat Probability of occurrence Risk = Vulnerability Impact PSI - Software Excellence in Metals

14 Difference Between IACS / Office IT Industrial automation & control system General purpose information technology (IT) systems Availability Integrity Priority Confidentiality Integrity Confidentiality Availability PSI - Software Excellence in Metals

15 PSImetals Integrated Modules & Integrative Solution PSI - Software Excellence in Metals

16 PSImetals Comprehensive Support of End-To-End Processes Commercial Processes Sales Order Entry Pricing Purchasing Plant Maintenance Costing Billing Order Dressing Demand & Sales Planning Product Configuration Sales Order Dressing Production Order Elaboration Demand Management Sales & Operations Planning Due Date Quoting Scheduling Production Planning Delivery Order Scheduling & Material Allocation Flow & Order Planning Capacity & Campaign Management Transport Management (outbound) Caster & Melt Shop Scheduling Hot Mill Scheduling Cold Mill & Finishing Scheduling Net Demand Calculation Plate & Coil Combination Shipping Planning Production Execution & Material Logistic Production Order Life Cycle Material & Stock Management Schedule Execution Management Production Tracking Quality Control & Exception Management Warehouse & Transport Management Shipping Execution PSI - Software Excellence in Metals

17 Customer Risks from a Production Management System Confidentially Product configuration / steel grades Process know-how Algorithms / optimizations Availability Disruption of production due to no or limited availability of PMS Integrity Disruption of production due to corrupt data Production of sub standard quality metals Inaccurate reporting PSI - Software Excellence in Metals

18 Security by Design with PSImetals Organization Information Security Management System ISO27k certified Encryption Use latest standard to secure sensible data Authentication Use safe & up-to-date standard protocols xxxx Create Awareness Safe Data Transmission Updates & Recovery PSI - Software Excellence in Metals

19 Security by Design: Key Areas We Are Working On Processes within PSI Metals IT Technology and SW Development Process Project Implementation Methodology PSI - Software Excellence in Metals

20 Security by Design: Key Areas We Are Working On Processes within PSI Metals IT Technology and SW Development Process Project Implementation Methodology PSI - Software Excellence in Metals

21 Information Security Management Terms poses exploits Threat Create awareness leads to Improve processes and take measures Vulnerability addresses Manage and respond to incidents Asset may corrupt Risk Assess Safety Measure can be countered by Damage causes Classify and evaluate PSI - Software Excellence in Metals

22 Security by Design: Key Areas We Are Working On Processes within PSI Metals IT Technology and SW Development Process Project Implementation Methodology PSI - Software Excellence in Metals

23 Secure Software Development Lifecycle Core Security Training Establish Security Requirements Create Quality Gates / Bug Bars Security & Privacy Risk Assessment Establish Design Requirements Analyze Attack Surface Threat Modeling Use Approved Tools Deprecate Unsafe Functions Static Analysis Dynamic Analysis Fuzz Testing Attack Surface Review Incident Response Plan Final Security Review Release Archive Execute Incident Response Plan Training Requirements Design Implementation Verification Release Response Source: Microsoft SDL PSI - Software Excellence in Metals

24 Data Flow Diagram Steel Grade Maintenance Rich Client Java PSImetals GUI Login Screen DB- Session Order Dressing/ Edit Grade Data Third Party Systems e. g. Level 2 Application Server Java Database Server Oracle Client User/ Password Web Service DB Server-User/ Password Establish DB-Connection JDBC PSIauth Authentication/ Authorization Service Oracle Access Management PSIauth Database Scheme Permissions DB Client User/ Password Permissions DB Client User/ Password Establish DB-Connection JDBC Oracle Access Management Transactions Grade Data DB Server-User/ Password PSIintegration Communication Adapter Establish DB-Connection JDBC Oracle Access Management Business Logic PL/SQL PSImetals Factory Model Scheme Send Grade Data TCP/IP, Web Services, Grade Data PSI - Software Excellence in Metals

25 STRIDE Model Attack Target Example of an attack Examples of countermeasures Spoofing Person, Account, Application Impersonation, account take over, manin-the-middle attack Authentication with passwords, LDAP/AD, Oracle Wallet, encrypted communications Tampering Client application, database, configuration Usage of modified client, manipulation of Data in Database (e.g. grade data) Access control, digital signatures, integrity check (hashing, etc.), etc. Repudiation Application, Logs/History Query/manipulate data, manipulate logs Authentication, log access and actions, undo logs, timestamps, validation of data Information disclosure Network, Application, Database, Files Eavesdropping of data (e.g. passwords), access to sensitive data Encryption incl. key mgmt., access control (client/server/database) Denial of service Database, Application, Service Overload with complex queries, manipulate configuration Check input data / query parameters, integrity checks, quotas Elevation of privilege Database, Application, Network SQL-Injection, manipulated authentication information Input validation, programming style, integrity validation of authentication data PSI - Software Excellence in Metals

26 Security by Design: Key Areas We Are Working On Processes within PSI Metals IT Technology and SW Development Process Project Implementation Methodology PSI - Software Excellence in Metals

27 Product-based Project Methodology Come Together Meetings Get to know each other Project Methodology Next Steps Early Trainings On PSImetals Standard System Upgrades On PSImetals Release Pre-Project Project Maintenance Prime Analysis Checklists Project Schedule <-> Release Plan Proposal Scope of Supply Commercial Figures Timeline Terms & Conditions + Workshops Use Cases Fit-Gap-Analysis Specification Detailed Analysis Basic Configuration Faster ROI Robust System Highly Configurable Reduced Risks Shorter Project Duration Reduced TCO

28 Product-based Project Methodology Come Together Meetings Get to know each other Involve customer security experts Project Methodology Next Steps Early Trainings On PSImetals Standard System Install latest security fixes Upgrades On PSImetals Release Pre-Project Prime Analysis Proposal Checklists Project Schedule <-> Release Plan Scope of Supply Commercial Figures Timeline Terms & Conditions Offer different security options (tradeoffs) + Project Workshops Use Cases Fit-Gap-Analysis Security fit-gap-analysis and mapping to customer security guidelines Specification Detailed Analysis Setup security Basic measures Configuration Maintenance Faster ROI Robust System Highly Configurable Reduced Risks Shorter Project Duration Reduced TCO

29 Takeaways Importance of IT infrastructure is increasing but so are systems complexity and security threats! PMS is a part of critical infrastructure but technologies and security measures already available to ensure secure operation! Assess your risks and choose the right level of security (and availability, comfort, functionality )! Security should not be an afterthought but essential part of project methodology and corporate awareness! PSI - Software Excellence in Metals

30 Suddenly everything s that simple PSI - Software Excellence in Metals