CERN Computing and Network Infrastructure for Controls (CNIC) Status Report on the Implementation Dr. Stefan Lüders (CERN IT/CO) (CS) 2 /HEP Workshop,

Slides:

Advertisements

Similar presentations

Information Security 1 Information Security: Security Tools Jeffy Mwakalinga.

Advertisements

© 2005, QEI Inc. all characteristics subject to change. For clarity purposes, some displays may be simulated. Any trademarks mentioned remain the exclusive.

Building Your Own Firewall Chapter 10. Learning Objectives List and define the two categories of firewalls Explain why desktop firewalls are used Explain.

Security+ Guide to Network Security Fundamentals

1 Emulab Security. 2 Current Security Model Threat model: No malicious authenticated users, Bad Guys are all “outside” –Protect against accidents on the.

Lesson 11-Virtual Private Networks. Overview Define Virtual Private Networks (VPNs). Deploy User VPNs. Deploy Site VPNs. Understand standard VPN techniques.

ITS Offsite Workshop 2002 PolyU IT Security Policy PolyU IT/Computer Systems Security Policy (SSP) By Ken Chung Senior Computing Officer Information Technology.

SIRT Contact Orientation Security Incident Response Team Departmental Security Contacts April 16, 2004.

Contact Center Security Strategies Grant Sainsbury Practice Director, Dimension Data.

Lesson 9-Securing a Network. Overview Identifying threats to the network security. Planning a secure network.

Computer Security: Principles and Practice

Security Overview. 2 Objectives Understand network security Understand security threat trends and their ramifications Understand the goals of network.

Firewall 2 * Essential Network Security Book Slides. IT352 | Network Security |Najwa AlGhamdi 1.

Payment Card Industry (PCI) Data Security Standard

Installing and Maintaining ISA Server. Planning an ISA Server Deployment Understand the current network infrastructure Review company security policies.

Network Security. Trust Relationships (Trust Zones) High trust (internal) = f c (once you gain access); g p Low trust ( ) = more controls; fewer privileges.

Developing a Security Policy Chapter 2. Learning Objectives Understand why a security policy is an important part of a firewall implementation Determine.

CS426Fall 2010/Lecture 361 Computer Security CS 426 Lecture 36 Perimeter Defense and Firewalls.

© 2007 Cisco Systems, Inc. All rights reserved.Cisco Public 1 Version 4.1 ISP Responsibility Working at a Small-to-Medium Business or ISP – Chapter 8.

Internet Service Provisioning Phase - I August 29, 2003 TSPT Web:

1 Network Admission Control to WLAN at WIT Presented by: Aidan McGrath B.Sc. M.A.

Lesson 8-Information Security Process. Overview Introducing information security process. Conducting an assessment. Developing a policy. Implementing.

Security Baseline. Definition A preliminary assessment of a newly implemented system Serves as a starting point to measure changes in configurations and.

IMPLEMENTING F-SECURE POLICY MANAGER. Page 2 Agenda Main topics Pre-deployment phase Is the implementation possible? Implementation scenarios and examples.

CERN’s Computer Security Challenge

Chapter 6 of the Executive Guide manual Technology.

Control System Cyber-Security Workshop A Summary of Yesterday’s Meeting Dr. Stefan Lüders (CERN IT/CO) with slides from P. Chochula (ALICE), S. Gysin (FNAL),

Safeguarding OECD Information Assets Frédéric CHALLAL Head, Systems Engineering Team OECD.

IT Security for the LHCb experiment 3rd Control System Cyber-Security Workshop (CS)2/HEP ICALEPCS – Grenoble Enrico Bonaccorsi, (CERN)

Peter Chochula ALICE DCS Workshop, October 6,2005 DCS Computing policies and rules.

Unit 6b System Security Procedures and Standards Component 8 Installation and Maintenance of Health IT Systems This material was developed by Duke University,

Control Systems Under Attack !? …about the Cyber-Security of modern Control Systems Dr. Stefan Lüders (CERN IT/CO) (CS) 2 /HEP Workshop, Knoxville (U.S.)

Network and Perimeter Security Paula Kiernan Senior Consultant Ward Solutions.

Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond,

1 CERN’s Computer Security Challenges Denise Heagerty CERN Computer Security Officer Openlab Security Workshop, 27 Apr 2004.

Lesson 9-Information Security Best Practices. Overview Understanding administrative security. Security project plans. Understanding technical security.

André Augustinus 10 October 2005 ALICE Detector Control Status Report A. Augustinus, P. Chochula, G. De Cataldo, L. Jirdén, S. Popescu the DCS team, ALICE.

Ali Pabrai, CISSP, CSCS ecfirst, chairman & ceo Preparing for a HIPAA Security Audit.

Office of Campus Information Security Driving a Security Architecture by Assessing Risk Stefan Wahe Sr. Information Security Analyst.

Note1 (Admi1) Overview of administering security.

Module 14: Securing Windows Server Overview Introduction to Securing Servers Implementing Core Server Security Hardening Servers Microsoft Baseline.

Securing the Network Infrastructure. Firewalls Typically used to filter packets Designed to prevent malicious packets from entering the network or its.

Use of CERN’s Computing Facilities Why is security important? What are the rules? HR Induction Programme.

Terri Lahey Control System Cyber-Security Workshop October 14, SLAC Controls Security Overview Introduction SLAC has multiple.

Chapter 2 Securing Network Server and User Workstations.

Small Business Security Keith Slagle April 24, 2007.

Lesson 19-E-Commerce Security Needs. Overview Understand e-commerce services. Understand the importance of availability. Implement client-side security.

Computer Security Risks for Control Systems at CERN Denise Heagerty, CERN Computer Security Officer, 12 Feb 2003.

Computing and Network Infrastructure for Controls CNIC Context? Why CNIC? What is CNIC? CNIC Phases and Definitions CNIC Status and Manpower Conclusion.

Problems to Overcome Implementation Issues at CERN Dr. Stefan Lüders (CERN Computer Security Officer) (CS) 2 /HEP Workshop, Kobe (Japan) October 11th 2009.

UPDATE ON THE CERN COMPUTING AND NETWORK INFRASTRUCTURE FOR CONTROLS (CNIC) ABSTRACT Over the last few years modern accelerator and experiment control.

Network and Computer Security in the Fermilab Accelerator Control System Timothy E. Zingelman Control System Cyber-Security Workshop (CS)2/HEP Knoxville,

Ed Tech Audit Case Study Pete Reilly. Process Meetings with the Superintendent Extended meetings with the technology coordinator Meeting with each administrator.

IPv6 security for WLCG sites (preparing for ISGC2016 talk) David Kelsey (STFC-RAL) HEPiX IPv6 WG, CERN 22 Jan 2016.

Proposed UW Minimum Computer Security Standards From C&C 28 Jan 2005 Draft.

Control System Cyber-Security Workshop A Summary of Yesterday’s Meeting Dr. Stefan Lüders (CERN Computer Security Officer) with slides from B. Copy (CERN),

“Lines of Defense” against Malware.. Prevention: Keep Malware off your computer. Limit Damage: Stop Malware that gets onto your computer from doing any.

R. Krempaska, October, 2013 Wir schaffen Wissen – heute für morgen Controls Security at PSI Current Status R. Krempaska, A. Bertrand, C. Higgs, R. Kapeller,

TS workshop 2004U. Epting, M.C. Morodo Testa - TS department1 Improving Industrial Process Control Systems Security Uwe Epting (TS/CSE) Maria Carmen Morodo.

3 rd Control System Cyber-Security Workshop Exchanging ideas on HEP security Dr. Stefan Lüders (CERN Computer Security Officer) 3 rd (CS) 2 /HEP Workshop,

Control System Cyber-Security Workshop Exchanging ideas on HEP security Dr. Stefan Lüders (CERN Computer Security Officer) (CS) 2 /HEP Workshop, Kobe (Japan)

SemiCorp Inc. Presented by Danu Hunskunatai GGU ID #

Firewalls. Overview of Firewalls As the name implies, a firewall acts to provide secured access between two networks A firewall may be implemented as.

Critical Security Controls

Control system network security issues and recommendations

Designing IIS Security (IIS – Internet Information Service)

Presentation transcript:

CERN Computing and Network Infrastructure for Controls (CNIC) Status Report on the Implementation Dr. Stefan Lüders (CERN IT/CO) (CS) 2 /HEP Workshop, Knoxville (U.S.) October 14th 2007

“CNIC Status Report” — Dr. Stefan Lüders — (CS)2/HEP Workshop ― October 14th 2007 Overview

“CNIC Status Report” — Dr. Stefan Lüders — (CS)2/HEP Workshop ― October 14th 2007 Control Systems at CERN Experiment: ALICE, ATLAS, CMS, LHCb, … …. Accelerator Infrastructure: Beam Position Monitoring, Beam Dump, Vacuum, Cryogenics, … …. Accelerators: ISOLDE, LHC, … …. Safety: Access Control, Radiation Protection, Equipment Protection, …. Infrastructure: Cooling & Ventilation, Electricity, Facility Management, ….

“CNIC Status Report” — Dr. Stefan Lüders — (CS)2/HEP Workshop ― October 14th 2007 Standards, if possible ! standard desktop PCs

“CNIC Status Report” — Dr. Stefan Lüders — (CS)2/HEP Workshop ― October 14th 2007 Equipment being affected or even destroyed ► Some very expensive, esp. in experiments & accelerators ► Sometimes impossible to repair / replace Processes being disturbed ► High interconnectivity, thus very sensitive to disturbances  A cooling process PLC failure can stop the accelerator  A power controller failure can stop a (sub-)detector ► Difficult to configure Time being wasted ► Downtime reduces efficiency (esp. data loss in experiments) ► Time needed to re-install, re-configure, test and/or re-start ► Requires many people working, possibly outside working hours Consequences are significant ! CERN Assets at Risk

“CNIC Status Report” — Dr. Stefan Lüders — (CS)2/HEP Workshop ― October 14th 2007

Attacks performed by… ► Trojans, viruses, worms, … ► Disgruntled (ex-)employees or saboteurs ► Attackers and terrorists Lack of robustness & lots of stupidity ► Mal-configured or broken devices flood the network ► Developer / operator “Finger trouble” Lack of procedures ► Flawed updates or patches provided by third parties ► Inappropriate test rules and procedures Who is the threat ?

“CNIC Status Report” — Dr. Stefan Lüders — (CS)2/HEP Workshop ― October 14th 2007

Vulnerabilities ARE fact ! 2004: IT intervention, hardware failure and use of ISO protocol stopped LHC magnet test stand for 24h. 2005: DoS (70”) stopped manual control 220- == ==<>>>>>> 220- ¸,ø¤º°^°º¤ø,¸¸,ø¤º°^°º¤ø,¸¸,ø¤º°^°º¤ø,¸¸,ø¤º°^°º¤ø,¸ 220-/ 220-| Welcome to this fine str0 220-| Today is: Thursday 12 January, | 220-| Current througput: Kb/sec 220-| Space For Rent: Mb 220-| 220-| Running: 0 days, 10 hours, 31 min. and 31 sec. 220-| Users Connected : 1 Total : | 220^°º¤ø,¸¸,ø¤º°^°º¤ø,¸¸,ø¤º°^°º¤ø,¸¸,ø¤º°^°º¤ø,¸¸,ø¤º°^ 2006: Hacked oscilloscope at CERN (running Windows XP SP2)

“CNIC Status Report” — Dr. Stefan Lüders — (CS)2/HEP Workshop ― October 14th 2007

“Defense-in-Depth” means security on each layer ! ► …of the security of the device itself, ► …of the firmware and operating system, ► …of the network connections & protocols, ► …of the software applications (for PLC programming, SCADA, etc.), ► …of third party software, and ► …together with users, developers & operators “Defense-in-Depth” Manufacturers and vendors are part of the solution ! ► Security demands must be included into orders and call for tenders

“CNIC Status Report” — Dr. Stefan Lüders — (CS)2/HEP Workshop ― October 14th 2007 CNIC: Computing & Network Infrastructure for Controls 9/2004: Development of a security policy for controls ► Major stakeholders from experiments, accelerator, infrastructure, and IT ► Management buy-in & support 4/2005: CNIC Security Policy & implementation proposals ► Approved by all parties involved ► See ICALEPCS /2005: Implementation of major security measures ► Technical implementation done by IT: Network, Windows, and Linux experts ► Controls expert became part in CERN’s Computer Security Team ► Huge effort in getting buy-in from developers, operators, and users 7/2007: Review of security policy & re-assessment of goals

“CNIC Status Report” — Dr. Stefan Lüders — (CS)2/HEP Workshop ― October 14th 2007 Use centrally managed systems wherever possible ► Ensure prompt security updates: applications, anti-virus, OS, etc. Ground Rules for Cyber-Security Deploy proper access control ► Use strong authentication and sufficient logging ► Ensure traceability of access (who, when, and from where) ► Passwords must be kept secret: beware of “Google Hacking” Make security an objective ► Security training ► Management buy-in ► Bring together IT and Controls experts Separate controls and campus networks ► Reduce and control inter-communication ► Deploy IDS ► Apply policy for remote access

“CNIC Status Report” — Dr. Stefan Lüders — (CS)2/HEP Workshop ― October 14th 2007 Network Segregation “Networks Domains” for Controls ► Domain Manager with technical responsibility ► Authorization procedure for new connections ► MAC address authentication ► Only operational devices, but neither laptops nor wireless access points ► Additional protection for PLCs, etc. Campus network for desktop computing Network monitoring ► Statistics & intrusion detection ► Disconnection if threat for others Restricted cross-communication ► Traffic filtering (ACL-based plus firewall) ► Application gateways plus DMZ

“CNIC Status Report” — Dr. Stefan Lüders — (CS)2/HEP Workshop ― October 14th 2007 Restricted Inter-Communication Essential services are “trusted” ► DNS, NTP, Oracle, data storage, … Remote interactive access from “outside” ► “outside” means “office”, “home”, “wireless” ► Using (Windows) Terminal Servers ► Methods to access controls applications ► Methods to access local control PCs Interactive access to the “outside” ► Rules for web-browsing, automatic s, file transfer, etc. “Fat-Pipe” data transfer to “the GRID”

“CNIC Status Report” — Dr. Stefan Lüders — (CS)2/HEP Workshop ― October 14th 2007 Central Installation Schemes (1) User-driven PC management ► Pass flexibility and responsibility to the User ► HE decides WHEN to install WHAT on WHICH control PCs (instead of the IT department) ► IT will send out notifications of new patches to be installed ► HE has to ensure security ► However, PCs might be blocked if threat for others Implementations for ► Windows XP, Windows Server (web-based interface) ► CERN Scientific Linux 3/4 (terminal-based) using 220- == ==<>>>>>> 220- ¸,ø¤º°^°º¤ø,¸¸,ø¤º°^°º¤ø,¸¸,ø¤º°^°º¤ø,¸¸,ø¤º°^°º¤ø,¸ 220-/ 220-| Welcome to this fine str0 220-| Today is: Thursday 12 January, | 220-| Current througput: Kb/sec 220-| Space For Rent: Mb 220-| 220-| Running: 0 days, 10 hours, 31 min. and 31 sec. 220-| Users Connected : 1 Total : | 220^°º¤ø,¸¸,ø¤º°^°º¤ø,¸¸,ø¤º°^°º¤ø,¸¸,ø¤º°^°º¤ø,¸¸,ø¤º°^

“CNIC Status Report” — Dr. Stefan Lüders — (CS)2/HEP Workshop ― October 14th 2007 Central Installation Schemes (2) Full remote control of… ► Configuring ► Installation ► Patching ► Rebooting ► Automatically & network-based ► On many PCs in parallel Configure… ► Look & Feel ► Access rights & restrictions … this works even for oscilloscopes !!! Install… ► Centrally managed OS & SW ► User applications

“CNIC Status Report” — Dr. Stefan Lüders — (CS)2/HEP Workshop ― October 14th 2007 Policies on Access Control However, still problematic areas ► Lack of access control in standard communication protocols ► Problem controlling user privileges in commercial controls applications ► Generalisation to one common central scheme at CERN Role Based Access Control ► User credentials for authentication ► Role assignment for authorization ► Strict rules for remote access ► See talks by S. Gysin & P. Chochula Restricted ing or web browsing on controls networks

“CNIC Status Report” — Dr. Stefan Lüders — (CS)2/HEP Workshop ― October 14th 2007 Incident Response & System Recovery Incident handling on a Domain ► Part of CERN’s general procedures ► Jointly by Domain Administrator & CERN’s Computer Security Team ► In emergencies, the acting CERN Security Officer has the right to take appropriate actions CERN’s Central Installation Schemes CMF and L4C allow for fast system recovery.

“CNIC Status Report” — Dr. Stefan Lüders — (CS)2/HEP Workshop ― October 14th 2007 Review & Re-assessment Recent review of the CNIC Security Policy: ► Review threat scenarios and priorities ► Review assumptions being made initially ► Take more realistic perspective ► Document and review the implementation ► Regular annual reviews of the CERN CNIC Security Policy and its implementation planned for the future Still some construction sites: ► Large DMZ & lots of exceptions (“We’re still in commissioning phase”) ► Some control systems still on campus network (e.g. some fixed-target experiments) ► Single sign-on and a coherent CERN-wide solution (still too many authentication & authorization schemes around)

“CNIC Status Report” — Dr. Stefan Lüders — (CS)2/HEP Workshop ― October 14th 2007 Summary

“CNIC Status Report” — Dr. Stefan Lüders — (CS)2/HEP Workshop ― October 14th 2007 Thanks a lot ! Special acknowledgements go to: ► The CNIC working group ► A. Bland, P. Charrue (AB), I. Deloose, N. Høimyr, M. Schröder (IT), M. Dobson (ATLAS), U. Epting, S. Poulsen (TS)