Quantitatively Assessing and Visualising Industrial System Attack Surfaces

CHAPTER 2. METHODOLOGY 19
4. Combining other sources of information such as exploit databases and Google’s
Geoquery we derive further information.
To comply with our own rule 3, in order to discover devices we don’t scan any systems
directly; instead, we query Shodan [12], a specialised search engine that scans the Internet
for HTTP, FTP, SSH and Telnet connectivity.
2.3 Device and System classification
During the course of this study we have identified systems and devices in Shodan’s data
primarily through domain expertise. This requires knowledge of the products, both soft-
ware and hardware running in industrial control systems. In practice this can be done
by anyone spending time reading product manuals, but previous experience from these
industries expedites such efforts. However, we specifically reject the use of such knowledge
to obfuscate issues from the reader, therefore an attempt to build a loose taxonomy has
been made. This should explain the general purpose of each ‘type’ of system or device
to the reader. This taxonomy is not an official one, but rather an informal aggregation
of the results into broad categories. Since these products are necessarily as diverse as the
industries they serve, all of our results do not neatly fit into the boxes below. However, the
lists below serve sufficiently to open the debate on the general connectedness of Industrial
Control Systems.
2.3.1 Devices
1. RTU – Remote Terminal Unit or sometimes Remote Telemetry Unit. This is a
microprocessor used to transmit telemetry back from the field and to control de-
vices in the field. They are often widely geographically dispersed, and use diverse
wireless communications accordingly. They can run simple safety logic programs
for redundancy and to reduce control delays.
2. PLC – Programmable Logic Controller. These are similar to RTUs, but are more
often deployed without their own power supply and using wired communications.
They are more often found on a plant floor or factory, where controllers are close to
the centre of control.
3. PAC – Programmable Automation Controller. These provide very similar functions
to PLCs, but are programmed differently, and use an open, modular, architecture.
They typically differ in how they do things from PLCs, but still serve the same
purpose of acquiring data and performing process control.