SCADA – Are we self- sufficient? Presented by Jack McIntyre 15/05/2015Jack McIntyre2

SCADA – Are we self-sufficient? What is SCADA? Where is SCADA implemented? Is SCADA secure? How can SCADA be attacked? Has SCADA already been attacked? What can be done to prevent attacks? Is the UK self-sufficient in preventing attacks? 15/05/2015Jack McIntyre3

What does it stand for? Supervisory Control And Data Acquisition What does that mean? 15/05/2015Jack McIntyre4

Where is SCADA? Waking up Getting ready Going to work Being at work 15/05/2015Jack McIntyre5

Where is SCADA? Residential / Commercial Properties National Grid Water & Gas Networks Manufacturing 15/05/2015Jack McIntyre6

What is SCADA? Monitors and connects logical processes Physical Devices PLC RTU HMI 15/05/2015Jack McIntyre7

SCADA system requirements Windows 2000 Windows XP Windows Vista 300 Mhz processor 128mb RAM 1.5gb storage 800x600 resolution display CD-ROM/DVD drive USB port Ethernet port Not very “State-of-the-art” 15/05/2015Jack McIntyre8 “State-of-the-art”

SCADA communications Satellite Telephone Wire Radio Wave Microwave Power-line 15/05/2015Jack McIntyre9

SCADA connectivity 15/05/2015Jack McIntyre10

Is SCADA protected? Insecure devices Design based around speed, reliability, connectivity Little or no security concerns 15/05/2015Jack McIntyre11

How is SCADA protected? Strong perimeter defence IDS IPS Firewalls 15/05/2015Jack McIntyre12

How can SCADA be attacked? Denial of Service Man-in-the-middle (MITM) Web Application Weaknesses Vulnerability exploitation Poor configuration 15/05/2015Jack McIntyre13

Denial of Service Extremely effective Time critical systems Target enumeration is difficult 15/05/2015Jack McIntyre14

Man-in-the-Middle Radio wave interception Power-line modulation detection Satellite interception Expensive and often dangerous 15/05/2015Jack McIntyre15

Web application weaknesses SQL Injection XSS Authentication bypass Brute force attacks Rare, relatively easy to protect against 15/05/2015Jack McIntyre16

Poor configuration Default passwords Open ports No authentication 15/05/2015Jack McIntyre17

Vulnerability exploitation Zero-day threats Specialist equipment needed Requires in-depth engineering knowledge Targeted attacks requiring key intelligence Stuxnet 15/05/2015Jack McIntyre18

Stuxnet Targeted Iranian nuclear centrifuges Introduced physically Designed to spread Only targets specific controllers 15/05/2015Jack McIntyre19

Stuxnet Manipulated system operation over time Sophisticated Stealthy Wasn’t detected until it was too late 15/05/2015Jack McIntyre20

What can be done? New systems New standards Secure by design OR Continue to add perimeter defence 15/05/2015Jack McIntyre21

Issues with upgrading equipment Cost Downtime Backwards-compatibility 15/05/2015Jack McIntyre22

When will it happen? When a major incident occurs 15/05/2015Jack McIntyre23

Are we self-sufficient? The UK Shares One power connection Two gas connections So far we have survived But for how long? 15/05/2015Jack McIntyre24

15/05/2015Jack McIntyre25 Questions ? Contact: