1. Akshay Awasthi James J. Fox IV
IoT & SCADA/ICS
Akshay Awasthi
James J. Fox IV 

2. Outline SCADA/ICS Example of SCADA SCADA Security Vulnerabilities
Stuxnet
IoT
IoT again?
Yep, IoT again
Resources

3. SCADA/ICS
Supervisory Control and Data Acquisition/Industrial Control Systems
Factories, power plants, rail yards, other key infrastructure
Uses computers, terminals, network communications and GUI for process management
Uses Programmable logic controllers (PLCs) and Proportional–integral–derivative (PID) controllers to control plant processes or machinery
Control the entire operation from a single or multiple points

5. SCADA Security (LOL) Originally deployed in factories with:
One control computer
No outside network connections
No physical access to intruders
Miles of Ethernet cables
Now deployed in factories with:
Multiple control stations (Even their phones!)
Everything connected to the internet
PLCs out in the field in unlocked sheds
Mostly unsecured wireless networks

6. Vulnerabilities
ICS-CERT (Industrial Control Systems Cyber Emergency Response Team), a branch of the DHS, monitors vulnerabilities
Inductive Automation Ignition
“information-disclosure vulnerability”
ip address]/main/system/backup/full.
Wonderware InBatch Client ActiveX control
buffer overflow vulnerability
“Security through obscurity”
Apparent lack of concern for basic security and authentication

7. Stuxnet Symantec Chief Architect Carey Nachenberg
Presentation to Faculty/Staff/Students and Stanford University

17. Sources
d4ae52e95e57/thumbnail/770x578/1c952b9dd6dbea139b94ec3415b09896/internet-of-things-poised-to-be-a-security-headache.png
Infographic.png?token=TbzL3Sc4T%2BCzrZHcupfemI%2BbPOo%3D
devices-to-creating-value-large.jpg
ICS-CERT. About the Industrial Control Systems Cyber Emergency Response Team. n.d. Web Page. 27 June < cert.gov/About-Industrial-Control-Systems-Cyber-Emergency-Response-Team>. Industrial Control Systems Cyber Emergency Response Team.
"Inductive Automation Ignition Information Disclosure Vulnerability." Advisory Online. 23 June < cert.gov/advisories/ICSA >. —.
"Wonderware InBatch Client ActiveX Buffer Overflow." Advisory
Fox, James J. SCADA SYSTEMS: SECURITY IN NUCLEAR POWER PLANTS. Final Paper. Norwich University. Northfield, VT, 2017.