In a modern environment, there are several types of communications: wire (plant and outside telephone), fiber optic (data and voice), radio (pagers and mobile radios), and satellite upload and download links. All are susceptible to interference and attack including tapping and monitoring (may be illegal, but when has that stopped anyone with mal intent?), signal interruption (jamming, cutting lines, establishing false commands), spoofing and misdirection (think radio commands and requests for assistance or misdirection), and introduction of viruses, worms, etc. through these channels into the other hardware and software that operate both analog and digital equipment.

Communications Life Cycle

All communications security goes through a life cycle, and this life cycle is only a slight modification of the basic security life cycle, which has been presented before in a previous chapter. It indicates the need for continuous review and improvement (Fig. 6.1).

The process of cyber security is continuous; it must be continuously updated. As new programs and cyber intruders develop and exploit new vulnerabilities in computer programs and systems, the network defenders have a continuous struggle to defeat their attempts. High-profile attacks by China and private hackers have exposed vulnerability in even the best and most secure systems including the New York Stock Exchange, the major credit card companies, and many of the major banking and financial houses. Some data breaches are made public; most of them, however, are not unless vital information is compromised.

A recent study by Symantec’s research arm Norton indicated that in 2012 there were 18 victims of cyber crime per second or a total of 1.5 million victims per day. The total value of cyber crime worldwide is $110 billion USD/year.¹ According to the report, approximately 40% of the people affected by cyber crime do not use strong passwords. Additionally, there are malware and other programs where the unsuspecting are enticed into accessing websites that implant tracking cookies or programs that log keystrokes and lock the user’s computer.

Some Solutions to the Problem of Cyber crime

There is no one solution to the problem of cyber crime because of the changing nature of the problem. Increasingly, more and more of cyber crime is accessed through mobile devices by individuals who use their cellular phones on public networks. But, businesses are equally vulnerable, and networks are getting harder to defend as they become more complex.

The following general recommendations should be incorporated into any company in an effort to provide basic cyber security. These are some of the basic elements, and the list is far from all-inclusive, but it does address the basic elements.

Communications Security

Some of the first philosophical questions that must be answered when looking at a secure communications system are where the communications are taking place, who is generating information, what information they are generating, and who needs to receive the information.

The purpose of a communications system is to facilitate an interchange of ideas, which may be mobile or not, and collect and distribute them collectively to where they are to be acted upon. Some examples include:

• The shipping department must be able to connect to the receiving department for routing vehicles. Both must be able to communicate with the guard station and warehouse to authorize the receipt and storage of a shipment.
• The telephone system provides a central nexus for all communications in the plant (Centrex, Switchboard, or something else).
• The guards must be able to summon assistance when required much like the fire brigade and the crash cart and ambulance.

Communications as Transactions

When we start to look at the communications as transactions, they take on a different view. In that manner, we can prioritize their importance and relate the facilities to their purpose. Communications transaction security requires both the sender and the recipient to be secure. Are the following secure and practical and why?

• Guard making rounds communicates to central dispatch in front of the plant.
• Guard calling for help on the telephone.
• Laboratory calling production operations with results of tests.
• Central communications station next to the boilers in the plant use the plant stack as antennas for plant-wide communications.
• Workers are summoned by pagers.
• Workers and guards informed of problems by plant radio from central station.
• General manager phones a worker in another building to come to a meeting.
• Lila (purchasing) phones Mary in shipping.

Telephone System Security

Some or all of the following questions should be asked and answered if one is to have a secure telephone system:

• Are the communications centralized through one vulnerable area such as a telephone trunk line and PBX switchboard, or are they distributed?
• Where is the central trunk line located with respect to the plant?
• Is the central communications line accessible outside the plant? Is the phone cable buried and is the switch box in a hidden location?
• How easily can someone with mal intent gain access to the phones, and how easily can they be disrupted or monitored?
• If a telephone truck showed up at the front gate or parked at the central switchboard or junction box, unannounced, would anyone notice?
• If the local phone company had valid credentials, would your guard force allow them entry into the plant without checking with the telephone company dispatch to verify that the persons were legitimate and without being aware of a communications problem where outside help had been called in?

Radio Communications

Every large plant uses a plant radio, some use cellular telephones, and others still use pagers. Analog systems are easier to break into and spoof than digital systems, but there are still a lot of analog systems in use. The following should be tested:

• Is the central radio secure or vulnerable to attack and being disabled from within or without the plant fence?
• Can anyone with a radio of the right frequency gain access to (monitor or interrupt) plant communications?
• Are plant public broadcasts (all radio) transmissions encrypted or in plain language?
• How easy would it be to steal or duplicate a plant radio?
• If you have a centralized dispatch system, do you have a backup location in case of an emergency? Does that alternative station have the same capabilities that the regular station has? In other words, is it a full duplicate station and does it have full capabilities? Is it used and maintained periodically just to make sure it is functioning?
• Would a power failure cripple your ability to communicate either with inside or outside facilities?
• Would an attack that destroys the plant radio house eliminate your ability to obtain plant-wide assistance or summon or control the workforce?
• Is there an alternative method of summoning outside assistance if the main trunk telephone line is cut?
• What happens if the local cellular telephone tower is destroyed? Or what happens if someone attempts to use cell phone jammers?

Digital Communications

Many plants have common systems that are wide open to attack from the Internet and other sources. Just because the transaction involved in digital exchange is usually incomprehensible to our ears and eyes does not mean that the digital transactions are unimportant. Transactions between machines are much like human transactions, in that there are a call and response to initiate the transaction and code checking when the recipient recognizes that the transaction is directed toward it. Then, there are an interchange of data and a closure agreement when both parties sign off.

Sometimes, the conversation is dedicated (telephone and SCADA), other conversations are continuous and do not sign off, and some digital conversations are shared, while others are not. It all depends upon how the data are transmitted, the devices, and the encoding. We often do not pay attention to it, because it is automatic. An example is the old dial-up modem. When it connected with the service provider, it provided a code of dial tones, and then when the provider responded, the system would produce something that sounded like static but that is digital communication.

When we examine the challenges of providing adequate cyber security and the integration of World Wide Web pages and websites into a server, even by e-mail rerouting, it is easy to see how attacks can take place via the Internet and through digital and analog communications via Wi-Fi and wired communications. The variety of digital attacks alone are virtually endless. A recently established website put up by T-Mobile (Deutsche Telekom) lists the type of attacks occurring each second of the day. A recent study by SYMANTEC (INTERNET SECURITY THREAT REPORT -2014 http://www.symantec.com/content/en/us/enterprise/other_resources/b-istr_main_report_v19_21291018.en-us.pdf) indicates that businesses have a 1:3 to a 1:5 chance of being cyber attacked, (and that is based on the attacks that were caught and foiled). A similar report by Shane Shutte in September 2014 (http://realbusiness.co.uk/article/27859-there-are-now-117339-cyber-attacks-per-day) indicated that there are about 1.4 cyber attacks per second, but the article is unclear as to whether that was just for the United Kingdom or worldwide. Other statistics have indicated that the worldwide number of attacks is between 3 and 4 attacks per second. It is important for any company to train their employees to avoid the various traps and malicious e-mail scams and web-based programs that are prevalent on the Internet. Every company needs a very good firewall and IT department to keep their Internet functioning.

Cyber security

How to Perform the Vulnerability Assessment

There are any number of ways a vulnerability assessment can fail, most notably when the credentials of the assessment team are questioned or when senior management says, “I don’t like it,” “This can’t be right!,” or “I don’t believe it!”

There are a number of things that an assessment team must do in order to have a chance at developing an assessment that will be considered and utilized. These critical success factors include the following:

Communications Procedure Design: Hints and Helps

• A written procedure must be clear, in plain language, and easily understood, even if that means redundant with respect to some actions.
• Do not let your legal team anywhere near the procedures because they will screw it up by applying legal principles and arcane language.
• Procedures, especially those that involve the entire company, must be consistent across diverse business units.
• Must be developed in concert with others rather than in isolation (no need for “reinventing the wheel”).
• Keep in mind that the sharing of information, especially about real or perceived vulnerabilities and attacks, is important.
• Identify parties responsible for initiating and conducting risk assessments.
• Determine who has to participate.
• Get agreement on steps to be taken.
• Determine in advance, if possible, how disagreements are to be resolved.
• Identify which approvals are required.
• Determine how the assessment is to be documented.
• Determine how documentation is to be maintained.
• Determine who gets the reports.
• Determine who can authorize recommendations.
• Standardize reporting formats, that is, tables, lists, questionnaires, and standard reports: KISS, or keep it simple, stupid!

Benefits: Identified

The identified benefits from providing a cyber security risk assessment and developing policies and procedures to address those risks include identifying the risks on a continuing basis; helping employees and personnel understand the business; helping employees avoid risky behaviors and practices; alerting employees to be aware of suspicious events and practices coming in via e-mail, Internet, and other forms of digital communications; and providing an effective way to communicate risk information to specific business units.

Cyber Threat Matrix: Categories of Loss and Frequency

Categories of loss I through IV:

• Death, loss of critical information, system disruption, or severe environmental or other damages
• Severe injury, loss of proprietary information, occupational illness, and major system or environmental damage
• Minor injury, minor occupational illness, and minor damage
• Less than minor injury, occupational illness, or less than minor system or environmental damage

Categories of frequencies A–E:

• Frequent, possibility of frequent incidents
• Probable, possible isolated incidents
• Occasional, possibility of occurrence sometime
• Remote, unlikely
• Improbable, virtually impossible

  The threat matrix looks like this (Fig. 6.3):

For each occurrence, a ranking and a rating are developed, and alternatively, internal software is used to help develop corrective actions based on a list of security controls and provides related cost estimates. The team should develop a list of possible corrective actions.

For each scenario requiring risk reduction, the team should identify one or more corrective actions from the list of alternatives they have developed and then select the most effective correction action based on the effectiveness of possible control in reducing probability or severity of incident and cost.

Finally, the team should develop corrective actions and prepare an exit briefing and a draft report that each team leader reviews. When all the changes are finalized, the report is implemented and the changes are submitted to middle management for their consideration and implementation. Middle management will receive the report and implement the changes. Corporate security will monitor the progress of the implementation changes.

Setting up Internet Security

Internet vulnerability is potentially one of the greatest threats to cyber security. Through a combination of e-mail, web browsers, and other programs, there are substantial security holes in any web-based system. They include (i) Trojan horses, (ii) worms, (iii) malware, (iv) denial of service, (v) attacks, (vi) keystroke loggers, and whatever new that is under development at any given moment. According to various sources on the Internet, even JPEG files and other types of graphic elements can contain hidden controls that can corrupt or take over a computer’s operating system.

Part of the problem is that the Internet Explorer is particularly vulnerable precisely because it is integral to the Windows operating system and is impractical to remove or disable the system. Apple systems are harder to attack because the registers in the operating system are individual to the machines, whereas Windows registry files are all similar.

Cyber security Tools

The US Department of Homeland Security has developed the following tools for use. Some may be export controlled. The National Cyber Security Division’s Control Systems Security Program (CSSP) (http://www.sans.org/press/dhs-inl-win-ncia.php) is designed to reduce cyber risks. They have developed the following tools:

• Catalog of Control Systems Security: Recommendations for Standards Development.

  Control System Cyber Security Self-Assessment Tool (CS2SAT).

• CSSP documents in conjunction with the Industrial Control Systems Cyber Emergency Response Team (funded by the US Department of Homeland Security) (ics-cert.us-cert.gov/csstandards.html#control). Cyber Security Procurement Language for Control Systems.
• The ISA Automation Standards Compliance Institute is a licensed distributor of the CS2SAT program. The program will assist SCADA and process control system users in improving their security.