>> Sector-specific technology concerns.
The learning objectives for this lesson are to
define embedded systems and components,
to explore industrial computer systems,
and to examine HVAC's use of embedded systems.
Let's get started. Internet of Things, or IoT.
This describes a global network of
appliances and personal devices.
They contain sensors,
network connectivity, and software.
They can collect information and then pass
it between themselves and other systems.
This is referred to as machine-to-machine, or M2M.
Each device will have a unique identifier
that allows it to operate on the Internet,
or through intermediary devices.
IoT networks are usually composed of the following.
First, you need a hub or a control system.
This is a communications hub
for Z-Wave or Zigbee networking.
It is a control system accessed
usually by an app on your mobile device.
Then you add smart devices.
These are the endpoint devices such as your light bulbs,
doorbells, cameras, and smart home automation.
They often come built-in
with their own security vulnerabilities.
One of the things that happens here is that
manufacturers do not often go and
release new firmware that
patches vulnerabilities that have
been discovered in their devices.
Also with IoT, we can add in wearables.
These are watches, bracelets, rings, pendants,
glasses designed as personal accessories.
All of them allow connectivity to the IoT mesh network.
Finally, we have sensors.
These are able to measure the temperature,
the humidity, light, pressure,
and many other variables.
Microcontrollers. These perform sequential operations
from a vendor-determined dedicated instruction set.
These embedded in systems often only
need to perform the same basic task over and over again,
so the hardware controllers can be
programmed with these instructions when they're created.
Field programmable gateway array, or FPGA,
is a controller that can have
its own program logic
configured to run specific applications.
System on a chip. This integrates
parts of a chipset into a single chip.
Chipsets can include up to four chips.
They control the communications between the CPU,
RAM, and storage, and peripherals.
Systems on a chip contain
the processor along with a graphics processor,
or GPU, memory,
USB controller, power management, and wireless radios.
It uses low power and offers really good performance.
A Raspberry Pi is a very good example of this,
and that's what's in the picture here.
Industrial control systems, ICS.
These provide mechanisms for
workflow and process automation.
ICS is controlled machinery that is used
in critical infrastructure such as power utilities,
water utilities, telecoms,
health providers, and national defense.
Distributed control systems,
these are an ICS that manage
process automation within a single site.
Think of this as the main controller for
a specific site that has
many integrated control systems embedded throughout.
Programmable logic controller, PLC.
This is a type of computer that
enables automation in settings
such as assembly lines and
autonomous field operations and robotics.
PLCs can interact with a variety of
sensors to connect the digital and real worlds together.
PLCs can also be programmed to
perform actions in response to triggers.
Ladder logic is the sequential control language
that dictates how a PLC operates.
It uses a graphical flowchart-like interface.
ICSs are made up of plant devices and
equipment embedded
programmable logic controllers, or PLCs.
PLCs are linked by OT fieldbus serial network,
or with an industrial Ethernet to actuators.
Actuators are the devices that operate motors,
circuit breakers, valves,
and other sensors like temperature.
PLC configuration is performed by
human machine interfaces, or HMIs.
HMIs may be local control panels
or software on a computer.
PLCs are also connected in a loop,
and process automation is
run by a central control server.
The data historian is a database of
all information generated by the control loop.
Supervisory control and data acquisition or SCADA.
This is large scale multi-site ICS,
where you use a SCADA system in
place of a control server.
SCADA are usually software
running on computers that gather data from
management plant devices and equipment
with embedded PLCs known as field devices.
SCADA usually have a WAN connections such as satellite,
cellular, or links to the field devices.
Heating, ventilation, and air conditioning, or HVAC.
This uses temperature and moisture sensors for
humidity control to manage the environment of a building.
These can be remotely controlled,
and management is often outsourced to third parties.
This is a major security concern since
these embedded systems are network
connected and accessed by third parties.
Keep in mind that often the third parties do not have
the same level of security as the source organization.
If you remember back to the Target breach,
this is exactly what happened with them.
Their third party HVAC vendor was breached,
and then that allowed them to go straight into Target.
When you're outsourcing these types of things,
you want to make sure that
the vendor understand security,
or at least will allow you to help lock things down.
We had a customer that when we were doing
the initial assessment and takeover of the site,
we discovered a Raspberry Pi.
We wanted to know what it did,
and we dug a little deeper and
found out that it was the device that
the third-party HVAC company used to control the system.
The problem was, it
had not been updated in over four years.
It was running a very outdated version of
Debian that had so many vulnerabilities in it.
We contacted the HVAC vendor,
and they said that we weren't allowed to access it,
that if we made any changes
to it it'd mess up the system.
I spoke with our customer
and let them know the situation,
how serious this was, and
for example, what happened to Target,
and they decided that
either the HVAC vendor needed to update it,
or they would have to remove
it and come up with some other way.
In the end, it turns out that there was
an update available for the Raspberry Pi,
but the HVAC vendor wasn't
aware of it because it wasn't their wheelhouse.
This wasn't something they specialized in.
They got these devices,
they put them in, and that was it.
We finally got it updated,
and we were able to install a
monitoring agent on it so that
we can make sure that we had some level of access to it,
at least for the logging to
ensure that nothing was coming in.
The key point to remember is that you can't rely
on your third-party vendors
because IT is not their thing.
Even if they're installing some form of technology,
it's not likely their thing.
Let's summarize. We discussed the Internet of Things.
We also went over microcontrollers and system on chip.
We went over industrial control systems and SCADA,
along with programmable logic controllers.
Let's do some sample questions. Question 1.
This type of system takes the place of
a control server in large, multi-site ICS.
Supervisory control and data acquisition, or SCADA.
Question 2. A blank is necessary for
the Z-Wave or Zigbee networking in an IoT environment.
Hub or control systems.
Question 3. This type of device has a full chipset and
a CPU on a single chip. System on a chip.
Question 4. This is used to program
PLCs and uses a flowchart graphical interface.
Ladder logic. I hope
this lesson was helpful for
you, and I'll see you in the next one.