Waterfall Top 20 Attacks Article d2 Article S508NC

The Top 20 Cyber Attacks ~ WATERfALL®
Against Stronger Than Firewalls

Industrial Control Systems
Andrew Ginter, VP Industrial Security
#4 Targeted Ransomware – Spear-phishing seeds a
Waterfall Security Solutions Remote Access Trojan (RAT) on an IT network, which is
December, 2017 used to deliberately spread ransomware through an ICS
#5 Zero-Day Ransomware – Ransomware incorporating
Introduction a zero-day Windows exploit spreads through IT/OT
No industrial operation is free of risk, and different firewalls.
industrial enterprises may legitimately have different #6 Ukraine Attack – The now well-known first-
“appetites” for certain types of risks. Evaluating cyber risk generation Ukraine attack using spear phishing and remote
in Industrial Control System (ICS) networks though, is access.
difficult - for example, such evaluations can result in
considering explicitly or implicitly up to hundreds of #7 Sophisticated Ukraine Attack – A variation of the
millions of branches of a complex attack tree modelling well-known Ukraine attack – the variation targets
the interaction of cyber attacks with cyber, physical, safety protective relays and causes physical damage to electric
and protection equipment and processes. Communicating substations and rotating equipment.
the results of such risk assessments to business decision-
#8 Market Manipulation – An organized-crime syndicate
makers who are not versed in cyber-physical risk-
uses known vulnerabilities in Internet-facing systems to
assessment techniques can be even more difficult.
seed RATs that are ultimately used to simulate random
One approach to communicating risk is a concept from equipment failures, triggering commodities markets
physical security – the Design Basis Threat (DBT). A fluctuations.
DBT document describes the most capable threat or attack #9 Sophisticated Market Manipulation – A similar
that a site is required to defeat reliably. A recent attack targeting an ICS site’s services suppliers as a means
whitepaper from Waterfall Security Solutions argues that of seeding peer-to-peer RAT malware into an ICS and
cyber DBT is best modelled as a line separating a set of simulating random failures.
example attacks into two sets: one that is reliably defeated
by an existing security posture, and the other that is not so #10 Cell-phone WIFI – A combination of spear-phishing
defeated. The reason for modelling DBT in this way is the and a trojan cell phone app provides attackers with access
experience of Waterfall’s customer-facing personnel that to ICS WIFI networks.
business decision-makers find it easier to work with attack #11 Hijacked Two-Factor – Sophisticated malware
scenarios than with more abstract risk metrics. allows attackers to hijack remote desktop / VPN sessions
after a remote user logs in with two-factor authentication.
Top 20 Attacks
To this end, the Waterfall paper proposes twenty ICS #12 IIoT Pivot – Hacktivists pivot into an ICS via a
cyber attacks across a wide range of attacker capabilities poorly-defended cloud vendor.
and attack sophistication. These attacks are proposed as a #13 Malicious Outsourcing – A disgruntled employee of
useful standard set of attacks that practitioners can use to a remote services vendor configures a simple time bomb
compare security postures across a wide range of types of on important ICS servers on the employee’s last day on
industrial sites. The attacks, in brief are: the job.
#1 ICS Insider – A disgruntled insider with access to ICS #14 Compromised Vendor Website – Hacktivists use a
equipment uses social engineering to steal passwords able compromised vendor’s website to insert malware into a
to trigger a partial plant shutdown. software update, malware that targets specific industrial
sites.
#2 IT Insider – A disgruntled insider with access to an IT
network uses social engineering to steal passwords able to #15 Compromised Remote Site – A physical breach of
give them remote control of a copy of the HMI system on remote substation or pumping station hides a laptop at the
an engineering workstation. remote site with a WIFI connection that is later used to
attack the central SCADA site.
#3 Common Ransomware – Accidentally downloaded to
an engineering workstation and spreads to rest of ICS. #16 Vendor Back Door – Hacktivist-class attackers
discover a vendor’s back door that provides the poorly-
Copyright © 2017 by Waterfall Security Solutions Ltd. All Rights Reserved.

2
defended vendor’s website with remote control of ICS a new malware strain however, no signatures exist yet.
components in the name of “remote support.” The anti-virus system, therefore, does not defeat common
malware essentially every time the system is presented
#17 Stuxnet – A Stuxnet-class attack targets a heavily- with a high-volume attack – the unlucky first few thousand
defended site by compromising a services vendor for the victims are not protected.
site and crafting autonomous, zero-day-exploiting
malware.
#18 Hardware Supply Chain – An intelligence-agency-
GG
grade attack intercepts new computers destined for an ICS 088
site and inserts wireless, remote-control equipment into
the computers. 0
#19 Nation-State Crypto Compromise – A nation-state-
grade attack compromises the Public Key Infrastructure by
stealing a certificate authority’s private key, or by
breaking a cryptographic algorithm, such as SHA-256,
allowing them to falsify security updates.
#20 Sophisticated, Credentialed ICS Insider – An ICS First-generation ICS protection
insider is aligned with the interests of a sophisticated cyber

attack organization, deliberately cooperating with the Figure (2) Risk assessment for first-gen system
organization to create sophisticated malware and seed it in The water treatment plan’s business decision makers,
the ICS. seeing Figure (2), express dissatisfaction with the state of
the security program. They may ask “what are these
Water Treatment Plant Example attacks that are not defeated reliably?” We as security
The Waterfall paper proceeds to evaluate an example practitioners need o explain why each attack is not
security posture against these twenty attacks. The worked defeated reliably. When we explain, we generally start
example is a water treatment plant protected with a “first with the simplest attacks not defeated, since attackers with
generation” security system reflecting ICS security best a range of attack techniques available to them will
practices published circa 2003-2013: firewalls, anti-virus generally choose the simplest, cheapest attacks that work.
systems, encryption, security updates, intrusion detection,
and so on. The network structure is illustrated in Figure Improved Security
(1). To address management’s concerns, the security team
might seek to improve their security posture by:
• Deploying Unidirectional Security Gateway

hardware and software to more thoroughly
control network information flows,
• Deploying strict removable media controls, to
control offline information flows, and
• Upgrade the ICS test bed to serve as a security
Figure (1) – Water treatment plant security system test bed / sandbox, as well as a software
reliability test bed.
This security posture is evaluated against the twenty attack
scenarios and is largely found wanting. The security The new system is illustrated in Figure (3).
system reliably defeats very few of the attacks, as
illustrated in Figure (2). The reason for the poor
performance is the definition of “reliably defeats.” To
defeat an attack reliably means to prevent the physical
consequence of the attack essentially every time this class
of attack is launched. First generation security measures
reliably defeat comparatively few attacks. Signature-based
anti-virus systems for example, reliably defeat malware
that matches their signatures, once those signatures are
published. In the first few hours or days of circulation for Figure (3) Modernized ICS security system
Copyright © 2017 Waterfall Security Solutions Ltd. All Rights Reserved.

3
The corresponding risk assessment results are illustrated in example, we see how a modest investment in modern ICS
Figure (4). protection with Unidirectional Gateways and removable
media controls produces a dramatic improvement in risk
posture.
080
- - - - - - - - - DBT
The full Waterfall paper, with more detailed attack
descriptions and evaluations of attacks against security
postures, is available at:
08088 https://waterfall-security.com/20-attacks
0008 About Waterfall Security Solutions
008 Waterfall Security Solutions is the global leader in
industrial cybersecurity technology. Waterfall’s products,
00 based on its innovative unidirectional security gateway
technology, represent an evolutionary alternative to
Figure (4) Risk assessment for upgraded system firewalls. The company's growing list of customers
includes national infrastructures, power plants, nuclear
The difference between the two security postures is easily plants, off and on shore oil and gas facilities, refineries,
visible. At this point we may be called upon to explain the manufacturing plants, railway switching systems, utility
residual risk – the attacks our security posture still does companies, and many more. Deployed throughout North
not defeat reliably. This is normal. The process may iterate America, Europe, the Middle East and Asia, Waterfall
another once or twice, with diminishing returns. products support the widest range of leading industrial
No security posture is infallible - there will always be remote monitoring platforms, applications, databases and
attacks above the DBT line that we need to explain. Any protocols in the market. For more information,
practitioner who sees no such attacks for their security visit www.waterfall-security.com
posture either needs to define more powerful attacks, or
needs to think hard about whether they have mis- For More Information
represented the effectiveness of their security posture. For additional information on this topic or on any topic
related to Waterfall products, please contact:
Summary Waterfall Security Solutions
A given security program/posture can only be evaluated if 14 Hamelacha St.
we have a clear understanding of the kinds of attacks that Rosh Ha’ayin, 48091 Israel
might target the protected industrial site. The Waterfall +972-3-900-3700
paper: www.waterfall-security.com
• Proposes a representative Top 20 list of ICS
cyber attacks, ###
• Illustrates how to evaluate those attacks against a
given defensive posture, and
• Illustrates how to communicate residual risk to
business decision-maker as a Design Basis Threat
line drawn through example attacks.
Nothing is ever completely secure - any DBT diagram
should illustrate attacks that will breach the defensive
posture under consideration. In any such set of not-
reliably-defeated attacks, there is always a least-
sophisticated or simplest attack or set of attacks with
serious consequences. It is this set that should be the focus
of communication with business decision-makers. Do such
attacks represent acceptable risks?
When the answer is “no” we can evaluate attacks above
the DBT line against proposed new security measures to
see whether the line moves. In the water treatment system
Copyright © 2017 Waterfall Security Solutions Ltd. All Rights Reserved.

Waterfall Top 20 Attacks Article d2 Article S508NC

Uploaded by

Copyright:

Available Formats

Waterfall Top 20 Attacks Article d2 Article S508NC

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Waterfall Top 20 Attacks Article d2 Article S508NC

Uploaded by

Copyright:

Available Formats

The Top 20 Cyber Attacks ~ WATERfALL®

Against Stronger Than Firewalls

Copyright © 2017 by Waterfall Security Solutions Ltd. All Rights Reserved.

insider is aligned with the interests of a sophisticated cyber

• Deploying Unidirectional Security Gateway

Copyright © 2017 Waterfall Security Solutions Ltd. All Rights Reserved.

Copyright © 2017 Waterfall Security Solutions Ltd. All Rights Reserved.

You might also like