syssec_red_book

6. Critical Infrastructure Security6.1 What Is the Problem?From the above premises, it is clear that well-known challenging threats such asmalware, botnets, or denial of service attacks, which have been compromisingthe security of Internet-connected devices, are likely to become threats for CIsas well. In contrast to traditional Internet-connected devices, CIs can take tangibleactions in the physical environment, thus posing serious safety risks, alongwith the possibility of production loss, equipment damage and informationtheft. The first incident on a SCADA system dates back to 1982, when a trojansupposedly infected the ICS that controlled the so-called “Siberian Pipeline”and caused an explosion equivalent to 3 kilotons of TNT [278]. Further exacerbatingthis scenario, today’s SCADA-controlled systems are widespread,given the market traction of smart grids and smart buildings, and thus moreappealing to offenders [361, 392, 395]. Although SCADA implementations canvary from vendor to vendor, the specifications of the control protocols (e.g.,PLC) are publicly available [32] and the devices can be acquired by anyonewho has sufficient funding. In addition, the control software runs on generalpurpose OSs (e.g., Windows), and devices were originally deployed in isolatedenvironments where network connectivity was not considered. Needless tosay, SCADA software comes with several serious vulnerabilities [47], most ofthem caused by buffer overflow and input validation bugs, which culminatedin experts describing SCADA security as “laughable” [51]. Unfortunately,these vulnerable ICS are publicly accessible over the Internet. One such centerof exploits is called SHODAN [49], a search engine tailored at finding andexposing online embedded devices such as webcams, routers, power plantsor even wind turbines. Unsurprisingly, “scada” is the most searched term onSHODAN. How well these exploits perform in real-world scenarios, however,is hard to estimate.According to the information that CERTS and governments collected, offendersincreasingly targeted critical infrastructures of countries: The IndustrialControl Systems-Cyber Emergency Response Team (ICS-CERT) responded to198 incidents against CIs in 2012, 52% more than the previous year. The twomost impacted sectors in 2012 are energy (41% of reported incidents) andwater (15%) [45]. There are debates within the research community aboutthe accuracy of the answers collected in a recent survey conducted by SANSamong industries and organizations that adopt SCADA and process-controlsystems [74]. Despite such debates, the survey corroborates the anecdotalbelief that SCADA and ICS adopters are aware of the security risks. Roughly50% of the participants reported that they were taking countermeasures thatincluded patching, access control and log analysis. Unfortunately, the PLClayer appears to be a weak spot, where it is often difficult to deploy propermonitoring mechanisms.42