Applying Lessons from Cyber Attacks on Ukrainian Infrastructures to Secure Gateways onto the Industrial Internet of Things

摘要

Previous generations of safety-related industrial control systems were ‘air gapped.’ In other words, process control components including Programmable Logic Controllers (PLCs) and smart sensor/actuators were disconnected and isolated from local or wide area networks. This provided a degree of protection;; attackers needed physical access to compromise control systems components. Over time this ‘air gap’ has gradually been eroded. Switches and gateways have subsequently interfaced industrial protocols, including Profibus and Modbus, so that data can be drawn from safety-related Operational Technology into enterprise information systems using Transmission Control Protocol/Internet Protocol (TCP/IP). Senior management uses these links to monitor production processes and inform strategic planning. The Industrial Internet of Things represents another step in this evolution—enabling the coordination of physically distributed resources from a centralized location. The growing range and sophistication of these interconnections create additional security concerns for the operation and management of safety-critical systems. This paper uses lessons learned from recent attacks on Ukrainian critical infrastructures to guide a forensic analysis of an Industrial Internet of Things (IIoT) switch. The intention is to identify and mitigate vulnerabilities that would enable similar attacks to be replicated across Europe and North America.