Lessons Learned for a Behavior-Based IDS in the Energy Sector

14
LESSONS LEARNED FOR A BEHAVIOR-BASED IDS IN THE ENERGY SECTOR Jerry Crowley, PhD, Boeing Cliff Gregory, PhD, SecurityMatters Presentation to the 10th EnergySec Security Sumit 05/15/2022

TAGS:

description

This presentation will review lessons learned from a deployment of behavior-based intrusion detection system (IDS) on a SCADA network that was part of a large-scale energy management system. The IDS architecture, sensor features, and sensor placement within the target SCADA environment proved to be key for successful detection of malicious activity. Challenges included simultaneous monitoring of multiple SCADA protocols (DNP3 and ICCP) across multiple network segments; monitoring of both encrypted and unencrypted network traffic; adapting to slow environment changes to minimize false positive output; and integration of the behavior-based IDS output into an existing monitoring system/SIEM

Transcript of Lessons Learned for a Behavior-Based IDS in the Energy Sector

Page 1: Lessons Learned for a Behavior-Based IDS in the Energy Sector

LESSONS LEARNED FOR A BEHAVIOR-BASED IDS

IN THE ENERGY SECTOR

Jerry Crowley, PhD, BoeingCliff Gregory, PhD, SecurityMatters

Presentation to the 10th EnergySec Security Sumit 04/08/2023

Page 2: Lessons Learned for a Behavior-Based IDS in the Energy Sector

Background

Boeing and a Regional Transmission Operator cooperated under a DOE-1304 project to demonstrate advanced technology solutions focused on cybersecurity in an energy management environment on the US regional power grid

DOE Benefits: Increased grid reliability Greater grid security Baseline for national grid replication

Page 3: Lessons Learned for a Behavior-Based IDS in the Energy Sector

Background (cont)

As a result of a Boeing cyber risk-based assessment, it was determined to reduce uncovered risks by complementing an existing signature-based IDS with a behavior-based IDS

The SecurityMatters SilentDefense ICS product was selected as an advanced yet mature technology

Page 4: Lessons Learned for a Behavior-Based IDS in the Energy Sector

What was deployed

Private network

Page 5: Lessons Learned for a Behavior-Based IDS in the Energy Sector

Monitoring Objectives

Monitor communications from members to control centers IP addresses of the members (including public IPs) Who initiates the connection (datacenter or member) Only ICCP and DNP3 Unexpected behavior

Monitor communications within the control centers What non-SCADA services/protocols are in use (e.g., SSH, SMTP, etc.) Unexpected traffic patterns

Page 6: Lessons Learned for a Behavior-Based IDS in the Energy Sector

SilentDefense ArchitectureSilentDefense

Monitoring SensorsSilentDefense

Command CenterWeb Client

One to many relationship

Page 7: Lessons Learned for a Behavior-Based IDS in the Energy Sector

How it was deployed Phase 1: Initial learning

Capture traffic on site (PCAP files) Playback traffic in offline mode Use SilentDefense in learning mode Inspect the captured traffic Detect misconfigurations (e.g., non-compliant data) Evaluate learned traffic patterns

Phase 2: Detection model fine-tuning Capture more traffic on site Process with SilentDefense in detection mode; Analyze generated alerts Refine model

Phase 3: Live detection Deploy SilentDefense in detection mode to monitor live traffic.

Initial Learning

Fine-tuneDetection

Model

Live detection

Three-phase deployment minimized impact to operational system

Page 8: Lessons Learned for a Behavior-Based IDS in the Energy Sector

DNP3 in depth

SilentDefense ICS monitoring:

Assures only “well-formed” DNP3 messages are passed

Detects buffer overflow attacks Monitors health of remote RTUs - inspects internal indicators

Validates MTUs do only intended operations - inspects function codes & data point addresses

Detects suspicious datalink communications - scanning RTU destinations

Applies high-level access control - checking what data points are accessed

Detects anomalous traffic to the lowest level

Page 9: Lessons Learned for a Behavior-Based IDS in the Energy Sector

SilentDefense ICS monitoring:

Assures only well-formed ICCP messages are exchanged by control centers

Detects buffer overflow attacks Insures only intended messages are exchanged at all layers - no dangerous

COTP, session presentations, ACSE, MMS functionalities are used Applies “high-level” access controls - only allowed MMS domains, services and

domain name formats are used Detects malformed data structures - the structure of variables shared between

control centers changes

ICCP in depth

SilentDefense forwards alters to industry standard SIEMs

Page 10: Lessons Learned for a Behavior-Based IDS in the Energy Sector

Detection Lessons Learned an IPS must:

Be able to detect abnormal behavior Malicious and non-malicious

Be able to detect behavior in multiple dimensions Protocol parameters Session Information

Be able to detect across protocol stack layers (layers 3 thru 7)

Detection Model is automatically created for each SCADA environment

Page 11: Lessons Learned for a Behavior-Based IDS in the Energy Sector

Operator training is key to success General SilentDefense overview

For SCADA engineers and security analysts Presentation of the findings obtained with the tool so far

In depth SilentDefense training Security analysts only Configure/operate/maintain structure Hands-on using the live system

SCADA Engineer’s involvement was critical SilentDefense alerted to abnormal, non-malleolus behavior

e.g., obtain early warnings of when a device degradation or misconfiguration Allowed explanation to security analysts why they were observing certain events

Misconfigured devices Effects of devices restarting

Operational Lessons Learned

Detection Model is automatically created for each SCADA environment

Page 12: Lessons Learned for a Behavior-Based IDS in the Energy Sector

General Operational Lessons Learned

A sensor must contain features to accommodate slow changes in traffic behavior and Be able to aggregate alerts that are generated for the same

reason Be able to easily analyze alerts, including raw traffic PCAPs Be able to easily update detection model(s) with “trim”

mechanisms

SilentDefense provides a simple intuitive user interface for analysis and forensics

Page 13: Lessons Learned for a Behavior-Based IDS in the Energy Sector

Project demonstrated Energy Sector needs Easy Setup and Management

• Configuration with self-learning technology• Legitimate input values automatically learned• Be traffic non-blocking – keep human in the loop

Compatible with technology solutions• Natively interface with SIEM solutions:• Understand ICS/SCADA Protocols

Be Scalable & Adaptable• Multiple Sensors for each command center• Small form factor – 1U or smaller• Compatible with environmentally hardened platform• Deployable in redundant architectures

Page 14: Lessons Learned for a Behavior-Based IDS in the Energy Sector

Contact Information

Jerry S. Crowley, PhD, Sr Security System Engineer

The Boeing [email protected]

Clifford H. Gregory, PhD,CEO – USA

SecurityMatters, [email protected]

mailto:[email protected]
mailto:[email protected]

Lessons Learned Handbook · 2011-10-12 · • Lessons Learned, an adjective, describes anything related to a Lessons Learned procedure. E.g. Lessons Learned process, Lessons Learned

Lessons Learned Handbook · 2011-10-12 · • Lessons Learned, an adjective, describes anything related to a Lessons Learned procedure. E.g. Lessons Learned process, Lessons Learned

Successes, Challenges, & Lessons Learned...Successes, Challenges, & Lessons Learned Overview Introduction Successes Challenges Lessons Learned New Approaches Highway 70 To Phoenix

Successes, Challenges, & Lessons Learned...Successes, Challenges, & Lessons Learned Overview Introduction Successes Challenges Lessons Learned New Approaches Highway 70 To Phoenix

ASSESSMENT & LESSONS LEARNED FROM AFRICAN DIASPORA MARKETPLACEpdf.usaid.gov/pdf_docs/PDACT256.pdf · ASSESSMENT & LESSONS LEARNED FROM AFRICAN ... ASSESSMENT & LESSONS LEARNED FROM

ASSESSMENT & LESSONS LEARNED FROM AFRICAN DIASPORA MARKETPLACEpdf.usaid.gov/pdf_docs/PDACT256.pdf · ASSESSMENT & LESSONS LEARNED FROM AFRICAN ... ASSESSMENT & LESSONS LEARNED FROM

Lessons learned & not learned at MSU

Lessons learned & not learned at MSU

Lessons Learned

Lessons Learned

Lessons Learned Remote PM+ Cohort Integrated K+S · Lessons Learned Below are key lessons learned on providing Remote PM+ Training of Helpers. These lessons learned are based off

Lessons Learned Remote PM+ Cohort Integrated K+S · Lessons Learned Below are key lessons learned on providing Remote PM+ Training of Helpers. These lessons learned are based off

Lessons Learned from Failures Dec 2014 - MTS Houston · 212 on board, 123 perished, 89 survivors ... Lessons Learned Lessons Learned. ... Lessons Learned from Failures Dec 2014.pptx

Lessons Learned from Failures Dec 2014 - MTS Houston · 212 on board, 123 perished, 89 survivors ... Lessons Learned Lessons Learned. ... Lessons Learned from Failures Dec 2014.pptx

Lessons Learned and Lessons to Be Learned: Investment Law & … · 2014. 4. 30. · 1 Lessons Learned and Lessons to Be Learned: Investment Law & Development for Developed Countries

Lessons Learned and Lessons to Be Learned: Investment Law & … · 2014. 4. 30. · 1 Lessons Learned and Lessons to Be Learned: Investment Law & Development for Developed Countries

Lessons Learned:

Lessons Learned:

Lessons Learned from “Lessons Learned” · 2 LESSONS LEARNED FROM “LESSONS LEARNED” 2. The NRC set safety goals in its Safety Goal Policy Statement, initiated not long after

Lessons Learned from “Lessons Learned” · 2 LESSONS LEARNED FROM “LESSONS LEARNED” 2. The NRC set safety goals in its Safety Goal Policy Statement, initiated not long after

Lessons learned from accident investigation Seminar/IHS - Day 2... · LESSONS LEARNED FROM OTHERS LESSONS LEARNED FROM UAE ... Lessons Learned . ... Dealing with survivors and bereaved

Lessons learned from accident investigation Seminar/IHS - Day 2... · LESSONS LEARNED FROM OTHERS LESSONS LEARNED FROM UAE ... Lessons Learned . ... Dealing with survivors and bereaved

an in depth investigation of lessons learned · •IDS: General Education Seminar: Service – Becoming a Peer Writing Tutor –Fall 2014 •Coming Soon! –IDS: General Education

an in depth investigation of lessons learned · •IDS: General Education Seminar: Service – Becoming a Peer Writing Tutor –Fall 2014 •Coming Soon! –IDS: General Education

Lessons&Learned&in&Deploying&Akka& Persistencedownloads.typesafe.com/website/presentations/lessons-learned-akk… · Lessons&Learned&in&Deploying&Akka& Persistence Duncan&K.&DeVore

Lessons&Learned&in&Deploying&Akka& Persistencedownloads.typesafe.com/website/presentations/lessons-learned-akk… · Lessons&Learned&in&Deploying&Akka& Persistence Duncan&K.&DeVore

LESSONS LEARNED AND GOOD PRACTICES...Lessons Learned Lessons are learned for sharing and applying to similar projects. Project lessons are learned from experiences, both inspiring

LESSONS LEARNED AND GOOD PRACTICES...Lessons Learned Lessons are learned for sharing and applying to similar projects. Project lessons are learned from experiences, both inspiring

Lessons Learned Globally - Campaign for Tobacco-Free Kids...Process lessons learned 2. Content lessons learned See next page for lists of these lessons learned. 7 | Lessons Learned

Lessons Learned Globally - Campaign for Tobacco-Free Kids...Process lessons learned 2. Content lessons learned See next page for lists of these lessons learned. 7 | Lessons Learned

Lessons Learned Events at SLAC · 2012-09-14 · Lessons Learned Events: Summary Comments . Important to identify and communicate lessons learned! Lessons learned and near misses

Lessons Learned Events at SLAC · 2012-09-14 · Lessons Learned Events: Summary Comments . Important to identify and communicate lessons learned! Lessons learned and near misses

Lean lessons learned - lean startup methodology and lessons learned from Blossom

Lean lessons learned - lean startup methodology and lessons learned from Blossom

LEARNED LESSONS:

LEARNED LESSONS: