Electricity for Free? The Dirty Underbelly of SCADA and Smart Meters

Methodology Used for SCADA AssessmentsRed Tiger Security’s Assessment Approach for SCADAOver the past nine years of conducting security assessments of SCADA systems andperforming research in the field of SCADA security, we have found that unless you use adefense-in-depth approach of assessing all components of the system, then small vulnerabilitiescan be used as threat vectors into the system.Since we have been involved in the development and bench marking of several control systemssecurity regulations and standards, we developed our assessment methodology in compliancewith NERC CIP, ISA S99, and NIST 800-53 requirements for SCADA and Process ControlSystems. We start with a review of the physical controls in place that restrict physical access tothe systems used for monitoring and control. Then we use a “Follow-the-Wire” approach toanalyze all of the digital components in the path from outside connections, through the networkinfrastructure, computing systems, applications, protocols, and lastly the field devices.The diagram below shows how our six layer approach maps to the physical control systemsnetwork infrastructure, hardware, applications, protocols and field equipment.pg [ 10 ]