Ciberseguridad en Redes Industriales. Ing. Gerardo Viar

Transcripción

1 Ciberseguridad en Redes Industriales Ing. Gerardo Viar

2

3 Aceleración de Ataques a OT 2014 US: Paper Mill damaged remotely by former worker 2015 Ukraine: Grid taken down for up to 6 hours 2017 Attack triggers 150+ warning sirens across Dallas 2017 Malware used in 2016 Ukraine attack found to have ICS unique modules 2014 Germany: Attackers damage smelter 2016 Ukraine: Second Electric Grid Attack 2017 Hospitals, Factories Impacted by Wannacry Ransomware Evolución de los Ataques Ataques IT en puntos de entrada Brechas de IDMZ Tools de ataque específicas para OT m

4 Search Engine for IoT Devices

5 Title

6 Panorama en Latinoamerica

7 2016

8 2016

9 Arquitectura Industrial Modelo ISA99/ISA95 Internet Enterprise Network Levels 4 5 Enterprise/IT Integration Collaboration Wireless Application Optimization Web Apps DNS FTP Patch Management Terminal Services Application Mirror AV Server Firewall (Active) Gbps Link for Failover Detection Firewall (Standby) Industrial Demilitarized Zone (IDMZ) Firewalls Application and Data share Access Control Malware Protection Factory Talk Application and Service Platform Servers Switches L3 Flow Sensor Network Services Manufacturing Zone Level 3 Distribution and Core Site Operations and Control Multi-Service Networks Network and Security Management Routing Switches Basic Control Robotics Machines Cell/Area Zone Levels 0 2 Layer 2 Access Real-Time Control Fast Convergence Traffic Segmentation and Management Ease of Use I/O Controller / PLC HMI Sensor Material Handling Process

10 Qué hacer? NERC-CIP v5

11 Los Riesgos por Sector

12 Title

13 Title LERC Low Impact External Routable Connectivity

14 Vulnerabilidades Equipos sin funciones de Seguridad Diseño de red sin Seguridad Servicios innecesarios levantados Falta de integración Seguridad Física y Seguridad Lógica Insuficiente Auditoria y Monitoreo Falta de Autenticación/Autorización para las HMI Conocimiento de Normas y Ciberseguridad

15 Arquitectura Industrial Modelo ISA99/ISA95 Internet Active IPS, Firewall, app. control, web content, malware protection, etc. Web Apps DNS FTP Enterprise Network Levels 4 5 Enterprise/IT Integration Collaboration Wireless Application Optimization Patch Management Terminal Services Application Mirror AV Server Firewall (Active) Active Gbps Link for Failover Detection Firewall (Standby) IPS, Firewall, malware protection, etc. Industrial Demilitarized Zone (IDMZ) Firewalls Application and Data share Access Control Malware Protection Factory Talk Application and Service Platform Servers Switches L3 Passive/Active Hybrid Flow Sensor IDS, Zone enforcement, app control, Malware protection, etc. Network Services Manufacturing Zone Level 3 Distribution and Core Site Operations and Control Multi-Service Networks Network and Security Management Routing Switches Basic Control Passive/Active Hybrid Robotics PLC/RTU Config Management Machines Cell/Area Zone Levels 0 2 Layer 2 Access Real-Time Control Fast Convergence Traffic Segmentation and Management Ease of Use I/O Controller / PLC HMI Sensor Material Handling Process

16 Internet Enterprise Network Levels 4 5 Enterprise/IT Integration Collaboration Wireless Application Optimization Web Apps DNS FTP IAM Patch Management Terminal Services Application Mirror AV Server IAM NGFW Firewall (Active) Gbps Link for Failover Detection Firewall (Standby) NGFW Industrial Demilitarized Zone (IDMZ) Firewalls Application and Data share Access Control Malware Protection Factory Talk Application and Service Platform Servers Switches L3 Flow Sensor SIEM NBAD Network Services Manufacturing Zone Level 3 Distribution and Core Site Operations and Control Multi-Service Networks Network and Security Management Routing Switches Basic Control NGFW Robotics Machines Cell/Area Zone Levels 0 2 Layer 2 Access Real-Time Control Fast Convergence Traffic Segmentation and Management Ease of Use I/O Controller / PLC HMI Sensor Material Handling Process

17

18

19 Recomendaciones Generales Establecer políticas para el control de la Seguridad Crear una DMZ para comunicar IT/OT Proteger el interior y las fronteras de la red Crear Políticas de Acceso Remoto Integrar la Seguridad física y electrónica Activar funciones de seguridad en HW disponible

20 Segmentación Visibilidad y Analisis Acceso Remoto Servicios

21 Gracias!