CSIS Report: Securing Cyberspace

Collapse
X
 
  • Time
  • Show
Clear All
new posts
  • streaker69
    • Mar 2008
    • 1141

    #46
    Re: CSIS Report: Securing Cyberspace

    Originally posted by BackatchaBandit
    I see the 'economic' rationale for utilising public networks for infrastructure SCADA etc, but I never really understood why such traffic couldn't be routed through existing 'secure' channels, such as the UK Police TeTrRa system, or even utilise it's own dedicated network, as they did for the ANPR cameras. It's got to be easier and more effective than trying to lock down the entire net.
    Much of it is because each PU/Municipality is responsible for finding their own solutions for linking their assets together. In regards to Municipalities doing this (think water and sewer), many times they're stuck dealing with contractors whom they feel they have to trust because they themselves don't know any better. Many smaller Municipalities are struggling just to pay their staff, so many times they don't have the money to test their own systems for security.

    It would be great if there was another "internet" that public entities could use that was segregated from the rest of the world, but I don't see it happening anytime soon. Since the only real solution to this would be to run a completely second set of fiber/cable everywhere and then double up on attached equipment. Then managing this network and billing for all the thousands of groups that would need access to it would be an absolute nightmare.

    Other solutions that are not using the internet are either not cost effective or do not provide the bandwidth needed. Early last year I looked into an MPLS system to link my 40 sites (which are all local) together via 56K connections. They wanted $9000/month for this. Which 56K would have been enough for the most basic of service that I needed at these sites, it would have left no room for expanding those services down the road. I did have Leased lines in some sites, and for those I was paying around $350/month for a 56K connection that I was lucky if I could get 1200 baud out of it.

    I have since dropped those leased lines and I have established a VPN network using local ISP's as my backbone, because it was the most cost effective way to get connections plus the bandwidth I needed.
    A third party security audit is the IT equivalent of a colonoscopy. It's long, intrusive, very uncomfortable, and when it's done, you'll have seen things you really didn't want to see, and you'll never forget that you've had one.

    Comment

    • Deviant Ollam
      Semi-Professional Swearer
      • May 2003
      • 3417

      #47
      Re: CSIS Report: Securing Cyberspace

      Originally posted by streaker69
      It would be great if there was another "internet" that public entities could use that was segregated from the rest of the world, but I don't see it happening anytime soon. Since the only real solution to this would be to run a completely second set of fiber/cable everywhere and then double up on attached equipment. Then managing this network and billing for all the thousands of groups that would need access to it would be an absolute nightmare.
      and all it would take would be one simpleton at a remote facility to think "instead of using my AOL dial-up, i'll just hop on the office broadband to download my NetFlix nonsense when i'm at work"

      either an infected laptop or a rouge AP and that's almost game over right there, potentially... eventhough this person wouldn't actually be reaching the internet, i'm sure they would keep trying over and over. heh... think of users whose print jobs don't happen right away.
      "I'll admit I had an OiNK account and frequented it quite often… What made OiNK a great place was that it was like the world's greatest record store… iTunes kind of feels like Sam Goody to me. I don't feel cool when I go there. I'm tired of seeing John Mayer's face pop up. I feel like I'm being hustled when I visit there, and I don't think their product is that great. DRM, low bit rate, etc... OiNK it existed because it filled a void of what people want."
      - Trent Reznor

      Comment

      • streaker69
        • Mar 2008
        • 1141

        #48
        Re: CSIS Report: Securing Cyberspace

        Originally posted by Deviant Ollam
        and all it would take would be one simpleton at a remote facility to think "instead of using my AOL dial-up, i'll just hop on the office broadband to download my NetFlix nonsense when i'm at work"

        either an infected laptop or a rouge AP and that's almost game over right there, potentially... eventhough this person wouldn't actually be reaching the internet, i'm sure they would keep trying over and over. heh... think of users whose print jobs don't happen right away.
        Since there is no one at these remote facilities, that's not really a concern. All the extra ports on the router are disabled, the ports that are plugged in are monitored by the NMS which sends out alerts if something goes offline.

        I am budgeting this year to install remote IDS sensors at these sites as well. Plus, my users here are actually pretty good, I haven't had a real issue of someone doing something they're not supposed to in about 2.5 years. I've spent an extensive amount of time on training, so things have actually been pretty good in that respect.

        AP's aren't a concern because wireless is verboten.

        (Remind me to tell you about a contractor that got caught by my NMS at Shmoo)
        A third party security audit is the IT equivalent of a colonoscopy. It's long, intrusive, very uncomfortable, and when it's done, you'll have seen things you really didn't want to see, and you'll never forget that you've had one.

        Comment

        • BackatchaBandit
          This may be my last tr...
          • Dec 2003
          • 28

          #49
          Re: CSIS Report: Securing Cyberspace

          Originally posted by streaker69
          Much of it is because each PU/Municipality is responsible for finding their own solutions for linking their assets together.
          I suppose we (the UK) have a legacy of centralised, publicly owned utilities which probably cancels out that factor to an extent.

          Originally posted by streaker69
          Early last year I looked into an MPLS system to link my 40 sites (which are all local) together via 56K connections. They wanted $9000/month for this.
          Fixed line, or was that over GSM/GPRS or ISM band?

          I was wondering if the US has an equivalent of the UK's CPNI, or does that fall under the NSA?

          While I was noodling about I found a bunch of other documents, precursors to the one in the OP, that might be of interest: Here.

          I can't help thinking it's all a bit academic when you consider that last month some gonk was able to wander in to a turbine hall, crash a 500MW genny, leave a card and wander out again undetected.

          I await the 'Securing Meatspace' report with baited breath.

          Comment

          • streaker69
            • Mar 2008
            • 1141

            #50
            Re: CSIS Report: Securing Cyberspace

            Originally posted by BackatchaBandit
            I suppose we (the UK) have a legacy of centralised, publicly owned utilities which probably cancels out that factor to an extent.

            Fixed line, or was that over GSM/GPRS or ISM band?
            That was fixed line. It really wasn't worth my time even calling the guy back to tell him how annoyed I was at the price.


            I can't help thinking it's all a bit academic when you consider that last month some gonk was able to wander in to a turbine hall, crash a 500MW genny, leave a card and wander out again undetected.

            I await the 'Securing Meatspace' report with baited breath.
            I believe that Meatspace security is actually the bigger threat than attacks over the Internet. Most PU assets aren't guarded, have little security and whatever security they do have is easily breached. Of course, attacking a physical location has a greater risk associated with it than coming in across the wire.

            One could definitely do more damage at a site in person than across the wire.
            A third party security audit is the IT equivalent of a colonoscopy. It's long, intrusive, very uncomfortable, and when it's done, you'll have seen things you really didn't want to see, and you'll never forget that you've had one.

            Comment

            • streaker69
              • Mar 2008
              • 1141

              #51
              Re: CSIS Report: Securing Cyberspace

              I just attended a seminar put on by the company from which we purchased our SCADA software. It was pretty much a 'rah-rah' session regarding a new product release. I believe I was the only end user there everyone else was system integrators or sales people.

              You can tell that 'security' is the buzz word of 2009 in relation to security. He mentioned it about a billion times, but never actually defined what kind of security they employ.

              The funniest yet scariest part of the presentation was when he was talking about a new file format they use for their new release, which happens to be a derivative of XML. During his spiel he states "...and since it's a text file, it's secure".

              I about jumped out of my seat at that point, but held back as I wanted to hear more of the magical secure text file. The other part that I got from this is it seems as though automation engineers still see general IT as their enemy, and firewalls are something that needs to be bypassed because they interfere with SCADA communications.

              I think that automation engineers need to spend more time working closely with IT so that they understand why IT insists on having security measures in place.
              A third party security audit is the IT equivalent of a colonoscopy. It's long, intrusive, very uncomfortable, and when it's done, you'll have seen things you really didn't want to see, and you'll never forget that you've had one.

              Comment

              • streaker69
                • Mar 2008
                • 1141

                #52
                Re: CSIS Report: Securing Cyberspace

                If anyone is interested: I've compiled 252 pages of news articles related to SCADA hacking into one big PDF ordered by year of publication (2009 - 2001).

                I can post it somewhere if you want to read it.
                A third party security audit is the IT equivalent of a colonoscopy. It's long, intrusive, very uncomfortable, and when it's done, you'll have seen things you really didn't want to see, and you'll never forget that you've had one.

                Comment

                • Kelson
                  Member
                  • Jul 2008
                  • 6

                  #53
                  Re: CSIS Report: Securing Cyberspace

                  Originally posted by streaker69
                  If anyone is interested: I've compiled 252 pages of news articles related to SCADA hacking into one big PDF ordered by year of publication (2009 - 2001).
                  Depends on your filter; 252 articles about how someone might hack SCADA wouldn't be too interesting...

                  Comment

                  • streaker69
                    • Mar 2008
                    • 1141

                    #54
                    Re: CSIS Report: Securing Cyberspace

                    Originally posted by Kelson
                    Depends on your filter; 252 articles about how someone might hack SCADA wouldn't be too interesting...
                    There is no 'might' about it. It can and has been done, quite easily.

                    If you don't feel it's interesting, then chances are, you probably shouldn't have posted anything.
                    A third party security audit is the IT equivalent of a colonoscopy. It's long, intrusive, very uncomfortable, and when it's done, you'll have seen things you really didn't want to see, and you'll never forget that you've had one.

                    Comment

                    • Kelson
                      Member
                      • Jul 2008
                      • 6

                      #55
                      Re: CSIS Report: Securing Cyberspace

                      Originally posted by streaker69
                      There is no 'might' about it. It can and has been done, quite easily.
                      Sorry; I meant the typical new story about how someone might do it without going into ANY details. I'd love to read stories with some meat, but the average story has none. Given what some folks have sent in huge volumes of news stories... there's no telling. If they're talking about specifics, host that baby up!

                      Comment

                      • streaker69
                        • Mar 2008
                        • 1141

                        #56
                        Re: CSIS Report: Securing Cyberspace

                        Originally posted by Kelson
                        Sorry; I meant the typical new story about how someone might do it without going into ANY details. I'd love to read stories with some meat, but the average story has none. Given what some folks have sent in huge volumes of news stories... there's no telling. If they're talking about specifics, host that baby up!
                        It's actually a fairly good read. Most of the articles aren't typical blah blah news stuff. I've only made it about 1/4 of the way through so far.

                        I'll post it when I get back, I gotta go sniff some wires right now.
                        A third party security audit is the IT equivalent of a colonoscopy. It's long, intrusive, very uncomfortable, and when it's done, you'll have seen things you really didn't want to see, and you'll never forget that you've had one.

                        Comment

                        • valkyrie
                          Member
                          • Jan 2006
                          • 360

                          #57
                          Re: CSIS Report: Securing Cyberspace

                          Originally posted by streaker69
                          If anyone is interested: I've compiled 252 pages of news articles related to SCADA hacking into one big PDF ordered by year of publication (2009 - 2001).

                          I can post it somewhere if you want to read it.
                          Streaker69, please do so. I am interested in reading your compilation.

                          Regards,

                          valkyrie
                          __________________________________________________ ________
                          sapere aude

                          Comment

                          • streaker69
                            • Mar 2008
                            • 1141

                            #58
                            Re: CSIS Report: Securing Cyberspace

                            Originally posted by valkyrie
                            Streaker69, please do so. I am interested in reading your compilation.

                            Regards,

                            valkyrie
                            __________________________________________________ ________
                            sapere aude
                            I'll do it a little later today. I found a couple more articles to compile into it.
                            A third party security audit is the IT equivalent of a colonoscopy. It's long, intrusive, very uncomfortable, and when it's done, you'll have seen things you really didn't want to see, and you'll never forget that you've had one.

                            Comment

                            • HighWiz
                              Death
                              • Jun 2007
                              • 655

                              #59
                              Re: CSIS Report: Securing Cyberspace

                              Originally posted by streaker69
                              I'll do it a little later today. I found a couple more articles to compile into it.
                              Please do, I look forward to reading it as well.
                              And I heard a voice in the midst of the four beasts, And I looked and behold: a pale horse. And his name, that sat on him, was Death. And Hell followed with him.

                              Comment

                              • streaker69
                                • Mar 2008
                                • 1141

                                #60
                                Re: CSIS Report: Securing Cyberspace

                                Disclaimer: These are articles that I pulled from varying news sources over the past couple of years. Take them for what you will.

                                This has ballooned to 427 pages and about 14Mb. Happy reading.

                                http://members.netjunkies.net/streak...g_Articles.pdf

                                I am currently working on a presentation with all the information that I've compiled from all of this. I don't actually have a venue to present it at yet, so I'm kind of working on that too.

                                I'll have some more news about this about mid April too.
                                A third party security audit is the IT equivalent of a colonoscopy. It's long, intrusive, very uncomfortable, and when it's done, you'll have seen things you really didn't want to see, and you'll never forget that you've had one.

                                Comment

                                Working...