Quantitatively Assessing and Visualising Industrial System Attack Surfaces

Quantitatively Assessing and Visualising Industrial System
Attack Surfaces
Éireann P. Leverett
Supervisors: Dr. Frank Stajano & Prof. Jon Crowcroft
Summary
Any industrial control systems connected to the Internet are naturally exposed to online
threats such as viruses, Denial of Service and targeted application or machine compromise.
These threats may come from those seeking to inflict mischievous damage, make money, or
sabotage national infrastructure remotely. Best practice, and indeed national regulatory
standards such as NERC-CIP, mandates a strict electronic security perimeter, particularly
since few devices used in control systems support default authentication 1 . Despite that,
even though many utilities claim to comply with NERC-CIP, we have located on the
Internet many industrial control devices available for connection.
Examining results over a two year time window through the specialised historical search
engine Shodan, we located, identified and categorised more than 7500 such devices—
HVAC systems, building management systems, meters, and other industrial control de-
vices or SCADA servers (supervisory control and data acquisition). In conjunction with
information from exploit databases, this could be used to carry out remote attacks on se-
lected devices or identify networks for further reconnaissance and exploitation. Malicious
actors might already be doing this.
To level the playing field for utility security professionals intent on re-perimeterisation,
we built a visualisation tool that finds exposed systems on the Internet, visualises them
on a time-dependent world map based on their city geolocation and presents details of
potentially applicable remote exploits. This allows defenders to assess their attack surface
and prioritise the required interventions in a timely manner. We expect it will also be
useful to auditors called upon to evaluate whether a utility complies with the required
security standards.
1 Evidence supporting this claim can be found within the dissertation.