SCADA Security Analysis Service Product
The move from proprietary technologies to more standardized and open solutions, together with the increased number of connections between SCADA systems and office networks and the Internet, has made them more vulnerable to attacks - see references. 1 2 3
- SCADA Security Analysis Service Product
- Example workflow
- Clarified Tools for and Infrastructure SCADA security audits
- Clarified SCADA Related Experience
- Verify that your security policies are implemented in practice
- Eliminate potential vulnerabilities by removing unnecessary services
- Increase system performance by fixing or removing badly behaving services
- Achieve better results by analyzing the actual traffic of your network
- Discover interfaces that would have been missed with traditional scanning
- Discover Access Control deficiensies
- Discover, document, and eliminate workarounds bypassing the security policies
- Discover hosts and protocols which do not conform to your organisation policy
- Discover undocumented hosts and services
- Get systematic documentation and visualizations of the whole ecosystem that is related to your system.
- Vendors and their subcontractors
- The roles of your employees relevant to your system
- Understand your exposure to indirect and direct attacks
- Get comprehensive understanding of the risks that are related to your system
- Clarify and delegate the responsibility from the management to the relevant actors:
- Integrators and their subcontractors,
- and more
- Clarify, who has physical, social, and technical access to your systems.
- Gain HR-savings from well-documented role and system based responsibilities.
- Introduce new people to new roles quickly
- Ensure that your personnel is motivated to follow more personalized instructions
- We will familiriaze ourselves with your technical environment:
- We will incorporate your network documentation to the Collab environment
- We will design and implement the traffic measurements with your staff
- We will utilise Clarified Analyzer for understanding your network and its weak points.
- We will analyse and report found issues to the Collab environment
- We will debrief you on findings
- We will provide you an environment from where You can monitor the progress of repairs
- We will familiarize ourselves with your socio-technical setting:
- Brief interview(s) mapping your
- server hotel providers,
- and anyone who might have access to your systems
- Analysis using semantically assisted visualizations, clarifying the relationships of your systems, organizations, relevant people, and their roles.
- Identifying the responsibilities and access of third parties
- Brief interview(s) mapping your
Clarified Tools for and Infrastructure SCADA security audits
Due to the tools and infrastructure build by Clarified Networks, we can cost-efficiently map complex networks and their socio-technical relationships. This mapping helps us in providing you more valuable and accurate threat and risk assessment.
Clarified Analyzer has been successfully used in SCADA environments to:
- Map the network for services exposed to attacks (directly and indirectly)
- Discovering plaintext passwords
- Detecting portscans
- Detecting attack attempts
Clarified Collaboration environment has been successfully used in SCADA envrionments to:
- Synthesizing results from port scanners, vulnerability scanners and actual traffic
- Providing situational awareness to the customer throughout the service engagement
- For sharing the results between relevant stakeholders (Customer, Clarified Networks, Customer's contractors)
- For following repair progress.
Clarified SCADA Related Experience
- Modern SCADA networks are complex and often connect closed legacy systems to more open IP-based systems.
- Clarified Networks is a commercial spinn-off from a 4 year University Security Research project which focused on complex networks mixing of modern IP-based systems to legacy systems.
- 4 years of research on clarifying the risks and threats to complex system
- 3 years of commercial development on:
- Due to the critical nature of SCADA systems, they may be subject to reconnaissance by foreign nations and criminals.
SCADA engagements in practice
1. Interface Analysis
We will utilize Clarified Analyzer and other tools to map your system. Interface analysis combines passive measurements from the actual traffic of the system, active scanning and other means to extract interfaces that are 1) directly, 2) indirectly exposed to external attacks.
- Technical specifications (not applicable to blackbox testing unless COTS is used)
- Scanning and probing the system
- Passive monitoring of the system (Traffic Audit)
- Observing, or deducting the physical properties of the system
- Observing the configuration (not applicable to blackbox testing) or the user interfaces of the system
One or more of these approaches will be used in your SCADA security analysis.
2. Vulnerability Scanning (through partners)
- Vulnerability scanning of the relevant network interfaces
- Mapping of subcontractors, integrators, vendors, regulators that are relevant technically, physically or socially.
- Mapping of people that have access to different parts of the system
- In service engagements:
- Semantic visualizations clarifying the relationships of vulnerabilities, systems, stakeholders
- Report on
- directly exposed interfaces and their vulnerabilities,
- indirectly exposed interfaces and their vulnerabilities,
- identified subcontractors, integrators, vendors and regulators relevant to the system,
- role based mapping of responsibilities related to the system,
- risks and threats related to the systems,
- and more
- In active collaboration
- Near-real-time information on infections, provided by different Abuse Information feeders (public and sometimes non-public).
- Continuous traffic recording, alerting and visibility to the network events (Clarified Analyzer, Abuse Helper).