In our increasingly connected world, networks of machines help critical infrastructure run more efficiently and prevent downtime. However, systems which were once isolated are now being exposed to digital security threats that operators never considered. Joseph Blankenship of Forrester Research and Gabe Authier of Tripwire discuss the evolving threat landscape and how we can protect these critical assets from cyber threats. Topics covered include: -Examples of some of the most recent cyber-attacks to critical infrastructure -Why traditional IT security approaches won't work -Recommended approaches for securing critical infrastructure

1. © 2018 FORRESTER. REPRODUCTION PROHIBITED.
Defending Critical Infrastructure Against Cyber Attacks
Joseph Blankenship, Senior Analyst
June 20, 2018

2. We work with business and
technology leaders to develop
customer-obsessed strategies
that drive growth.
2© 2018 FORRESTER. REPRODUCTION PROHIBITED.

3. 3© 2018 FORRESTER. REPRODUCTION PROHIBITED.
Analyst Bio Joseph (aka JB) supports Security & Risk
professionals, helping clients develop security
strategies and make informed decisions to
protect against risk. He covers security
infrastructure and operations, including tools for
the security operations center (SOC) such as
security information and event management
(SIEM), security analytics, and security
automation and orchestration (SAO).
He also covers security topics like artificial
intelligence (AI) for cybersecurity, email security,
distributed denial of service (DDoS), and
network security. His research focuses on
security monitoring, threat detection, insider
threat, phishing prevention, operations, and
management.
Joseph Blankenship, Senior Analyst
Forrester

4. 4© 2018 FORRESTER. REPRODUCTION PROHIBITED.
Agenda
› Target: Critical Infrastructure
› Critical Infrastructure Needs A Zero Trust Approach
› Wrap-Up

5. 5© 2018 FORRESTER. REPRODUCTION PROHIBITED.
Target: Critical Infrastructure

6. 6© 2018 FORRESTER. REPRODUCTION PROHIBITED.
Critical infrastructure can be defined as, “facilities, systems or functions, whose incapacity or
destruction would cause a debilitating impact on national security, governance, economy
and social well-being of a nation.”
ICS are used in nearly every industrial and critical infrastructure sector:
• Energy
• Transportation
• Primary Production
• Pharmaceuticals and medical equipment
• Manufacturing: chemical products, high-tech products, industrial products
• Oil & Gas
• Utilities
• Telecommunications
Industrial Control
Systems (ICS)
Supervisory Control and Data
Acquisition systems (SCADA)
Distributed Control Systems (DCS)

7. 7© 2018 FORRESTER. REPRODUCTION PROHIBITED.
Industrial Control Systems
DCSSCADA
Manufacturing, electric power
generation, chemical manufacturing,
oil refineries, and water and
wastewater treatment
Pipeline monitoring and control, water
treatment centers and distribution, and
electrical power transmission and
distribution

8. 8© 2018 FORRESTER. REPRODUCTION PROHIBITED.
IT Versus OT
Source: searchsecurity.techtarget.com/feature/Operational-challenges-as-cybersecurity-gets-sensored

9. 9© 2018 FORRESTER. REPRODUCTION PROHIBITED.
Vulnerabilities In ICS Devices
Source: ICS-CERT Annual Vulnerability Coordination Report, 2016

10. 10© 2018 FORRESTER. REPRODUCTION PROHIBITED.
ICS Attacks And Incidents On The Rise
Source: Forrester’s Protecting Industrial Control Systems And Critical Infrastructure From Attack Report

11. 11© 2018 FORRESTER. REPRODUCTION PROHIBITED.
Critical
Infrastructure
Continues To Be
Targeted
Source: Forrester’s Protecting Industrial Control Systems And Critical Infrastructure From Attack Report

12. 12© 2018 FORRESTER. REPRODUCTION PROHIBITED.
TRITON/TRISIS Malware
› Discovered in December 2017
› Leveraged a previously
unknown vulnerability in
Schneider Electer’s Triconex
firmare
› Intended to shut down safety-
instrumented systems (SIS)
Image Source: www.linkedin.com/pulse/triton-takeways-dale-peterson/

13. 13© 2018 FORRESTER. REPRODUCTION PROHIBITED.
ICS Devices Attached Directly To The Internet
Source: arstechnica.com/information-technology/2018/01/the-internet-of-omg-vulnerable-factory-and-power-grid-controls-on-internet

14. 14© 2018 FORRESTER. REPRODUCTION PROHIBITED.
Communications Access To Control Systems
Source: ICS CERT

15. 15© 2018 FORRESTER. REPRODUCTION PROHIBITED.
Infrastructure Attacks
› Attack vector can be physical or digital
› Attack consequences are both physical and digital
Image Source: www.scor.com/en/files/figure-1-triton-cyber-attackjpg

16. 16© 2018 FORRESTER. REPRODUCTION PROHIBITED.
Security Challenges For Critical Infrastructure
› Environment includes remote locations
› Vulnerability scanning and patching may be difficult, if not impossible
› ICS devices are exposed
› Infrastructure is a ripe target for nation-state actors
› Disgruntled insiders have easy access for sabotage
› Many environments have low visibility
› Company structure and distributed decision making can be an issue

17. 17© 2018 FORRESTER. REPRODUCTION PROHIBITED.
Critical Infrastructure Needs A Zero Trust
Approach

18. 18© 2018 FORRESTER. REPRODUCTION PROHIBITED.
Critical Infrastructure Needs A Zero Trust Approach
› Know your environment
• Map assets
• Understand network traffic
• Block unknown traffic
› Inspect and log all traffic
› Reduce your attack surface
› Limit and strictly enforce OT environment access
› Build intelligent alerting
Source: Forrester’s Protecting Industrial Control Systems And Critical Infrastructure From Attack Report
Forrester’s The Zero Trust eXtended (ZTX) Ecosystem report

19. 19© 2018 FORRESTER. REPRODUCTION PROHIBITED.
Recommendations
› Conduct a thorough risk assessment of your OT environment
› Build relationships with OT leadership
› Extend network awareness and visibility
› Patch systems, as appropriate
› Train and prepare for cybersecurity incidents

20. 20© 2018 FORRESTER. REPRODUCTION PROHIBITED.
Wrap-Up
› Critical infrastructure is a target for attacks
• Attacks can be carried out by physical or digital means
• Successful attacks have physical and digital consequences
› Critical infrastructure presents unique challenges
• OT environments are built for uptime, not security
› Critical infrastructure security requires a Zero Trust approach
• Know the environment
• Limit access
• Monitor activity

21. FORRESTER.COM
Thank you
© 2018 FORRESTER. REPRODUCTION PROHIBITED.
Joseph Blankenship
www.forrester.com/Joseph-Blankenship
@infosec_jb

22. Securing Critical Infrastructure
Gabe Authier, Tripwire
June 2018

23. 23
Difficulties Securing Critical Infrastructure
» Systems use purpose built hardware with legacy protocols
» Many of these systems are designed on flat networks
» ICS / OT systems meshing with IT
» IT / OT convergence

24. 24
Asset Discovery and Vulnerability Assessment
» Passive Asset Discovery techniques and ”no-touch”
approach
» Active Discovery
» Vulnerability assesment

25. 25
Tripwire Data Collector
» Industrial protocols support for Modbus TCP, Ethernet IP
CIP and SNMP
» Integrations with Rockwell AssetCentre, MDT AutoSave
and Kepware
» Vulnerability risk scoring

26. 26
Tripwire Reference Architecture

27. 27
Tripwire Industrial Suite
» Tripwire Enterprise with Whitelist Profiler
» SCM, Policy, and open ports and services
» Tripwire Enterprise Data Collector
» Industrial protocols and integrations
» Tripwire Log Center
» Industrial log aggregation, normalization and
correlation rules

28. tripwire.com | @TripwireInc
Thank You