By Kerri Hostetler
The Homeland Security Department has teamed with 13 organizations on a
12-month project to secure the process control systems of the nations
oil and gas industries against cybersecurity threats.
A cyberattack on the control and data systems of electric power plants,
or oil and gas refineries and pipelinestwo of 17 pieces of the nations
critical infrastructurecould potentially bring the country to a halt.
The problem is compounded because private companies control 85 percent
to 90 percent of the countrys critical infrastructureleaving the
government few avenues to ensure that IT systems are secure.
Linking the Oil and Gas Industry to Improve Cybersecurity (LOGIIC) was
born out of the Cyber Security Research and Development Center, which is
supported by DHS and run by SRI International of Menlo Park, Calif.
LOGIIC, for the first time, brought government, industry, research labs,
security vendors and process control technology vendors together to
recreate a real-life process control system test bed. They then attacked
the test bed, at Sandia National Laboratories in Albuquerque, N.M., with
viruses, worms and cyberterrorism techniques to see if they could fix
The goal was to come up with technology, then demonstrate the
technologies that could reduce vulnerabilities in infrastructure. Oil
and gas should be commended for doing just that, said Doug Maughan, DHS
program manager for cybersecurity research and development.
The potential costs of an infrastructure attack are significant. The
Northeast Blackout on April 14, 2003, left 50 million customers and
parts of eight states and Canada without power. The outage cost an
estimated $7 billion to $10 billion in financial losses, and shut down
parts of a 2 million barrel-per-day pipeline and airports in 13 cities,
according to a report by an electricity consumers research council.
Terrorism played no role in the power outages.
But DHS and the private sector created LOGIIC to safeguard against an
attack that could create the same result, as well as other scenarios,
such as disruptions of oil refineries or distribution operations.
The process control system simulated the two components of the oil and
gas industry: the distributed control system (DCS), which manages the
refining process (also known as the process control system, or PCS), and
the supervisory control and data acquisition systems (SCADA), which
manage oil and gas pipelines.
Control networks used to be run on proprietary networks with proprietary
protocols. But the industry has converted to standard operating systems
and protocols, which leaves them more vulnerable to attacks, said Paul
Granier of ArcSight of Cupertino, Calif., a security vendor for the
project, in a video released by DHS.
The consortium identified five vulnerabilities of the process control
system, but focused on two: securing the system against outside
attackers using the Internet, and securing the system from hackers using
remote sites to breach physical security, said Ben Cook, principal
member of research at Sandia.
We asked ourselves, How can this be exploited? What are cyberpaths
attackers can take to compromise critical components? Cook said.
According to the video, the consortium aimed the first attack at the
demilitarized zone that serves as a buffer between the business and
process control network systems. The second attack targeted flow meters
at physical sites.
Wiring the system
After the first pilot, industry members asked security and process
control vendors who supply critical technologies to the oil and gas
industry to be part of the second phase of the project. Then the lab
connected the technology to the test bed and ran the attacks again.
We wired the system together like real life. It was a simplified
representation of what you would see in the field, Cook said.
The new software created a correlation engine that let process control
operators look at one screen and determine which alerts were critical to
the security of the system, Cook said.
This was not possible before LOGIIC, said Raymond Parks, Sandias lab
technology staff member, on the video.
A team member connected an embedded firewall to a network interface card
in the test bed to determine the security systems ability to protect the
SCADA system, said Charlie Payne, a researcher for Adventium Labs of
The goal was to show you could detect and correlate suspicious events
and report it on a host-based network, said Payne.
The software from security and technology vendors proved its ability to
address the vulnerabilities the oil and gas industry were concerned
about, officials said.
It [the new system] provided high-level insight into which breaches were
critical. The system aggregates and correlates sensor feeds for
high-level awareness, Cook said.
Chevron contacted DHS in April 2004 to start an initiative to address
oil and gas vulnerabilities, which led to a workshop for industry
members in July. In February 2005, members of the LOGIIC team met to
decide what problems the group could address.
DHS and industry both spent about $600,000 on the project. Both hosted a
workshop in Houston on Sept. 11, 2006, to present the LOGIIC project to
Maughan stressed the importance of the partnership model used in LOGIIC
because he believes it is a model that can be used in other sectors. The
Energy Department has contacted DHS to learn about the LOGIIC model.
DHS is not planning on regulating any of the technologies used in
LOGIIC, which proved to protect process control networks from attacks.
Its up to oil and gas to bring in this technology and implement it. Our
mission is to do research, development, testing, integration, evaluation
and transition, Maughan said.
Subscribe to InfoSec News