Download

250 Chapter 6 • Protecting Critical Infrastructure: Process Control and SCADAFigure 6.18 Holistic Security Posture Petrol123 (Source: ArcSight ESM v4.0)The analysts can quickly see from where the alerts are originating and what parts of thenetwork are being targeted.The analysts can drill down on any part of the display to get tothe underlying events, and they discover that 10.0.1.191, the address that John assigned himself,has not only been detected as a rogue host, but also has been the source of several portscans.John starts getting nervous because he has launched the scan, but he has discovered severalsystems that appear to be RTUs and PLCs. He decides to start sending Modbus commandsto these systems. John is not an experienced programmer by any means, and heknows just enough about networks to get himself in trouble. He uses a packet crafting toolto send what he thinks look like valid commands to the different systems telling them toopen their associated valves 100 percent.The systems keep replying with errors, so John getsfrustrated and decides that if he can’t dazzle them with his brilliant attack plan, he will justlaunch a DoS attack on the MTU. He uses a User Datagram Protocol (UDP) port flood