Download

246 Chapter 6 • Protecting Critical Infrastructure: Process Control and SCADArefinery and knows how to cause considerable damage. Because John worked at Petrol123for 20 years, he is familiar with the processing network, where RTUs and flow computersare located, as well as the geographic locations of remote substations. He devises a plan tocause general chaos within the refinery, and at this point doesn’t have much regard for thecompany or his ex-coworkers. His plan to disrupt the oil refinement processes comprisesspoofing commands to the MTU and some of the PLCs which will allow him to controlthe flow of crude oil into the plant.Let’s start by looking at the process control network at Petrol123 and some of the differentsecurity devices that are deployed (see Figure 6.16). John is not aware of the securitydevices that have been put in place, as he was never involved in IT operations.Starting at the top, we have a standard corporate network consisting of a wireless connectionfor the employees with laptops, and we have the standard corporate servers such ase-mail, databases, file servers, and financial systems.The corporate network, as we have foundin most cases, in connected to the process control network via a firewall.The firewall doeshave some access control rules in place to try to prevent the spread of worms and viruses,but they are minimal and there are many exceptions for remote access.Figure 6.16 Petrol123 Process Control Network (Source: Visio)Corporate ServersWirelessPetrol123 Corporate NetworkInternetIDS Concentrator ArcSight ESMSecurity Management NetworkIDSFirewall WithAccess ControlHistorianSCADA ConsoleSCADA Process Control NetworkOMNI FlowIDSPLCMaster Terminal UnitRemote SubstationRTUFlow SensorOIL PIPELINE