Introduction to the 3rd Control System Cyber-Security Workshop

• Stefan Lueders (CERN)

Room: Kilimandjaro Nord

How things go wrong.

• Stefan Lueders (CERN)

Room: Kilimandjaro Nord An online demo of a few real security events, how they were possible, and how they were exploited.

Review of a cyber-security event at Jefferson Lab accelerator network

• Theo McGuckin (Jefferson Lab)

Room: Kilimandjaro Nord

Cybersecurity for the Control System Engineer

• Steven Hartman (Oak Ridge National Laboratory)

Room: Kilimandjaro Nord How does cybersecurity fit in to (or not fit in to) the requirements for designing and operating distributed control systems for large experimental physics projects?

Experiences with ISO/IEC 27001 Implementation at NSCL

• Vasu Vuppala (NSCL, MSU)

Room: Kilimandjaro Nord Recent incidents have emphasized the importance of security and operational continuity for achieving the quality objectives of an organization, and the safety of its personnel and machines. However, security and disaster recovery are either completely ignored or given a low priority during the design and development of an accelerator control system, the underlying technologies, and the overlaid applications. This leads to an operational facility that is easy to breach, and difficult to recover. Retrofitting security into the control system becomes much more difficult during operations. The Electronics Department at NSCL wanted to address security in a holistic manner, and decided to implement ISO/IEC 27001 Information Security standard. The ISO/IEC 27001 standard and the related code of practice (ISO 27002) cover a broad set of topics such as risk assessment, asset management, human resources, physical security, communication and operations, , application development and maintenance, access control, disaster recovery, security incident management, and legal and regulatory compliance. In this paper we describe our experiences in implementing the ISO 27001 standard (we are not certified yet). We describe our risk assessment methodology, the identified risks, the selected controls, and their implementation. We also describe our documentation structure for the various policies, procedures, guidelines, and standards. We illustrate problems faced with securing low-level controls, infrastructure, and applications. We also illustrate how we are using this experience in the design of FRIB's (Facility for Rare Isotope Beam) global database.

Inventory and Risk assessment of the CERN Technical Network

• Pierre Charrue (CERN)

Room: Kilimandjaro Nord

Can off-the-shelf control systems be compliant with CERN computer security policy?

• Timo Hakulinen (CERN)

Room: Kilimandjaro Nord A computer security policy enforced at CERN requires all network-connected equipment to be submitted to regular port scans. Security patches are also required to be applied to all Windows and Linux machines on a regular basis. From time to time these security measures cause problems with equipment and software, which for one reason or another were not equipped to handle them. We discuss cases, where existing CERN access and safety systems have suffered service disruptions, reasons behind these incidents, as well as some strategies on how to mitigate and how to prepare for them in future designs.

Cyber security from the ALICE user’s perspective

• Peter Chochula (CERN)

Room: Kilimandjaro Nord The Detector Control System (DCS) of ALICE, one of the LHC experiments at CERN in Geneva is distributed across 150 mainly Windows computers and 1200 network attached devices, most of them running some version of Linux. Cyber security has always been one of the key elements driving its design from the very beginning. The security principles and rules have been discussed and approved by the collaboration well ahead of putting the first systems into production. In the presentation we focus on the main architectural principles of the ALICE DCS and show how the security requirements comply with day-to-day operational needs. We discuss how the strict security rules affect the system development, operation and maintenance. We demonstrate with examples the typical problems which have to be addressed on a large system providing control of a delicate high energy physics experiment in an environment where several hundred people need worldwide access. We assess the impact of typical cyber security measures on system performance, stability and manageability. And finally, we demonstrate limitations posed by operating commercial software in a high energy physics environment.

IT security for the LHCb Experiment

• Enrico Bonaccorsi (CERN-CERN-CERN)

Room: Kilimandjaro Nord The LHCb Experiment is one of the four large particle physics detectors at CERN. The LHCb Online System comprises more than 2000 servers and embedded systems and more than 200 network devices. It has more than 200 active users. Operational independence and strong isolation from the internet as well as from central CERN resources have been an important design criteria. Like any large experimental IT infrastructure we are confronted with the sometimes conflicting requirements between ease and convenience of operation and security needs. This paper describes the IT security model adopted, its implementation and operational consequences. It presents the network structure, the authorization and authentication model, the hardening of the gateway servers, a three-tier redundant firewall implementations as well as the technical problems encountered and corresponding solutions.

Application and Virus Detecting Firewall on the SPring-8 Experimental User Network

• Takashi SUGIMOTO (Japan Synchrotron Radiation Research Institute)

Room: Kilimandjaro Nord SPring-8 experimental user network is aimed at controlling experimental instruments and data acquisition. For users' convenience such as web browsing, users can connect internet via the user network. Web browsers use HTTP(s) to access WWW servers. But nowadays, HTTP is used as many other protocol tunneling. On the user network, protocol tunnelings via HTTP are often found, and SPring-8 control system is threatened by tunneling applications: bandwidth exhaustion by media streaming such as YouTube, P2P file sharing, unauthorized instrumental control from outside of experimental area via VPN, and so on. Moreover, during web-browsing, many virus infections had been occurred on the user network. To prevent threats from the control system, we installed PaloAlto firewall system, which recently called "next generation firewall". The PaloAlto firewall can detect many applications and viruses including tunneling protocols. We report results of application/virus detection and prevention using the firewall.

Industrial Devices Robustness Assessment and Testing against Cyber Security Attacks

• Filippo Tilaro (None)

Room: Kilimandjaro Nord CERN (European Organization for Nuclear Research),like any organization, needs to achieve the conflicting objectives of connecting its operational network to Internet while at the same time keeping its industrial control systems secure from external and internal cyber attacks. With this in mind, the ISA-99* international cyber security standard has been adopted at CERN as a reference model to define a set of guidelines and security robustness criteria applicable to any network device. Devices robustness represents a key link in the defense-in-depth concept as some attacks will inevitably penetrate security boundaries and thus require further protection measures. When assessing the cyber security robustness of devices we have singled out control system-relevant attack patterns derived from the well-known CAPEC** classification. Once a vulnerability is identified, it needs to be documented, prioritized and reproduced at will in a dedicated test environment for debugging purposes. CERN - in collaboration with SIEMENS – has designed and implemented a dedicated working environment, the Test-bench for Robustness of Industrial Equipments***(“TRoIE”). Such tests attempt to detect possible anomalies by exploiting corrupt communication channels and manipulating the normal behavior of the communication protocols, in the same way as a cyber attacker would proceed. This document provides an inventory of security guidelines**** relevant to the CERN industrial environment and describes how we have automated the collection and classification of identified vulnerabilities into a test-bench. References: *http://www.isa.org **http://capec.mitre.org ***F.Tilaro,“Test-bench for Robustness...“, CERN, 2009 ****B.Copy,F.Tilaro“Standards based measurable security for embedded devices”,ICALEPCS 2009

Discussion

• Stefan Lueders (CERN)

Room: Kilimandjaro Nord