ICS Security - US CERT

ICS Security - US CERT

1. 100W - Operational Security(OPSEC) for Critical Systems

   • OPSEC Process
     • 1-Identify the Critical Information
       • Examples of critical information include  - network diagrams  - employee data such as email addresses  - work schedules, and lists of user names. 
     • 2-Analyze Potential Threats
       • To analyze a threat, you need to identify:   - - Who the potential adversaries are (competitors? insiders? terrorists?).  - What the adversary’s intent and capability are (for example, a disgruntled employee might have very different capabilities than a competitor).   - What the adversary already knows (for example, from information published on the internet or in trade journals).   - What the adversary needs to know to succeed (control system commands? how to gain remote or physical access?).   - Where the adversary is likely to look to obtain the information (always remembering that an adversary is apt to go to more than one source). 
     • 3-Analyze Vulnerabilities
       • One way to discover vulnerabilities to is to look for indicators. Indicators are observable or detectable activities or information that, when looked at by themselves or in conjunction with something else, point to a vulnerability regarding your organization's operations. For an adversary, indicators are clues that a vulnerability exists and can be exploited.  Although indicators are not vulnerabilities by themselves, they can point or reveal vulnerabilities.
     • 4-Assess Risk
       • Threat X Vulnerability X Consequence = RISK Threat: Any person, circumstance, or event with the potential to cause loss or damage. Vulnerability: Any weakness that can be exploited by an adversary or by accident. Consequence: The negative impact (loss or damage) your organization would incur if an attack were successful.
     • 5-Apply Countermeasures
       • Countermeasures are implemented in priority order to protect the weaknesses that represent the most significant consequences to your mission, operation, or activity.
       • Countermeasure Samples
         • Example   1-Changes in Procedure: If routine activities reveal critical information, you may need to change some procedures. For example, you may want to have the contractor who is hiring people for the shutdown eliminate the timeframe and your company name in employment ads.    2-Controlling Distribution:  Limiting sharing of information to those who need it, 3-Cyber Protection Tools: Implementing anti-virus software, firewalls, and intrusion detection systems can greatly reduce an adversary's ability to cause damage. 4-Speed of Execution: Accelerating the schedule can limit the Ability of adversary to act on the information he or she has obtained. 5-Awareness Training: Educating employees about all Aspects of OPSEC is one  of the most effective counter measurese.
     • Summary
       • OPSEC is a continuous process, not one that ends when you complete the fifth step. In all steps, view the situation from both friendly and adversarial points of view. Identify the critical information. One method for identifying critical information is to first determine what adversaries might want to do and then determine what information the adversaries need to accomplish their goal. Analyze potential threats. Identify potential adversaries, the adversary’s intent and capability, what the adversary already knows, what the adversary needs to know to succeed, and where the adversary is likely to look to obtain the information. Analyze vulnerabilities. Examples of vulnerabilities include inadequate employee training, publishing the control system manufacturer or vendor used, and poor system design. Assess risk. Risk assessment is a process in which you decide if one or more countermeasures need to be assigned to a vulnerability based on the level of risk this vulnerability poses to your organization. Apply countermeasures. A countermeasure can be anything that reduces an adversary’s ability to exploit vulnerabilities. 
   • Adversaries
     • 1- Social Engineering
       • Social engineering is a collection of techniques used to manipulate people into revealing sensitive or other critical information.  The most common type of social engineering is conducted by phone. The caller may pretend to be someone in a position of authority or a telephone or computer technician and gradually pulls information out of the targeted person. 
       • The first objective of an adversary attempting social engineering is to convince you that he or she is in fact a person that you can trust with critical information. Unfortunately, because of our tendency to trust others, this is not very difficult for adversaries to do. The following bullets highlight information from a recent BBC Co. study (from Social Engineering and Identity Theft, Financial Managers Society, 2006): More than 70% of people revealed their password in return for a chocolate bar. 34% of respondents revealed their password without being bribed. In another study, 79% of people when questioned unwittingly revealed personal information that could be used to steal their identity.
     • 2-Phishing
       • Phishing is the act of sending an email or web pop-up that falsely claims to be an established legitimate enterprise in an attempt to scam the user into surrendering private information, such as credit card numbers, bank account information, Social Security numbers, and passwords, which will be used for identity theft or other nefarious purposes.