http://www.gcn.com/print/25_34/42765-1.html 

By Kerri Hostetler
GCN Staff
12/11/06 issue

The Homeland Security Department has teamed with 13 organizations on a 
12-month project to secure the process control systems of the nations 
oil and gas industries against cybersecurity threats.

A cyberattack on the control and data systems of electric power plants, 
or oil and gas refineries and pipelinestwo of 17 pieces of the nations 
critical infrastructurecould potentially bring the country to a halt. 
The problem is compounded because private companies control 85 percent 
to 90 percent of the countrys critical infrastructureleaving the 
government few avenues to ensure that IT systems are secure.


Real-life process

Linking the Oil and Gas Industry to Improve Cybersecurity (LOGIIC) was 
born out of the Cyber Security Research and Development Center, which is 
supported by DHS and run by SRI International of Menlo Park, Calif.

LOGIIC, for the first time, brought government, industry, research labs, 
security vendors and process control technology vendors together to 
recreate a real-life process control system test bed. They then attacked 
the test bed, at Sandia National Laboratories in Albuquerque, N.M., with 
viruses, worms and cyberterrorism techniques to see if they could fix 
system vulnerabilities.

The goal was to come up with technology, then demonstrate the 
technologies that could reduce vulnerabilities in infrastructure. Oil 
and gas should be commended for doing just that, said Doug Maughan, DHS 
program manager for cybersecurity research and development.

The potential costs of an infrastructure attack are significant. The 
Northeast Blackout on April 14, 2003, left 50 million customers and 
parts of eight states and Canada without power. The outage cost an 
estimated $7 billion to $10 billion in financial losses, and shut down 
parts of a 2 million barrel-per-day pipeline and airports in 13 cities, 
according to a report by an electricity consumers research council. 
Terrorism played no role in the power outages.

But DHS and the private sector created LOGIIC to safeguard against an 
attack that could create the same result, as well as other scenarios, 
such as disruptions of oil refineries or distribution operations.

The process control system simulated the two components of the oil and 
gas industry: the distributed control system (DCS), which manages the 
refining process (also known as the process control system, or PCS), and 
the supervisory control and data acquisition systems (SCADA), which 
manage oil and gas pipelines.

Control networks used to be run on proprietary networks with proprietary 
protocols. But the industry has converted to standard operating systems 
and protocols, which leaves them more vulnerable to attacks, said Paul 
Granier of ArcSight of Cupertino, Calif., a security vendor for the 
project, in a video released by DHS.


System vulnerabilities

The consortium identified five vulnerabilities of the process control 
system, but focused on two: securing the system against outside 
attackers using the Internet, and securing the system from hackers using 
remote sites to breach physical security, said Ben Cook, principal 
member of research at Sandia.

We asked ourselves, How can this be exploited? What are cyberpaths 
attackers can take to compromise critical components?  Cook said.

According to the video, the consortium aimed the first attack at the 
demilitarized zone that serves as a buffer between the business and 
process control network systems. The second attack targeted flow meters 
at physical sites.


Wiring the system

After the first pilot, industry members asked security and process 
control vendors who supply critical technologies to the oil and gas 
industry to be part of the second phase of the project. Then the lab 
connected the technology to the test bed and ran the attacks again.

We wired the system together like real life. It was a simplified 
representation of what you would see in the field, Cook said.

The new software created a correlation engine that let process control 
operators look at one screen and determine which alerts were critical to 
the security of the system, Cook said.

This was not possible before LOGIIC, said Raymond Parks, Sandias lab 
technology staff member, on the video.

A team member connected an embedded firewall to a network interface card 
in the test bed to determine the security systems ability to protect the 
SCADA system, said Charlie Payne, a researcher for Adventium Labs of 
Minnesota.

The goal was to show you could detect and correlate suspicious events 
and report it on a host-based network, said Payne.

The software from security and technology vendors proved its ability to 
address the vulnerabilities the oil and gas industry were concerned 
about, officials said.

It [the new system] provided high-level insight into which breaches were 
critical. The system aggregates and correlates sensor feeds for 
high-level awareness, Cook said.

Chevron contacted DHS in April 2004 to start an initiative to address 
oil and gas vulnerabilities, which led to a workshop for industry 
members in July. In February 2005, members of the LOGIIC team met to 
decide what problems the group could address.

DHS and industry both spent about $600,000 on the project. Both hosted a 
workshop in Houston on Sept. 11, 2006, to present the LOGIIC project to 
industry members.

Maughan stressed the importance of the partnership model used in LOGIIC 
because he believes it is a model that can be used in other sectors. The 
Energy Department has contacted DHS to learn about the LOGIIC model.

DHS is not planning on regulating any of the technologies used in 
LOGIIC, which proved to protect process control networks from attacks.

Its up to oil and gas to bring in this technology and implement it. Our 
mission is to do research, development, testing, integration, evaluation 
and transition, Maughan said.


_____________________________
Subscribe to InfoSec News
http://www.infosecnews.org/mailman/listinfo/isn