>> ICS Protocols.
The learning objectives for
this lesson are to differentiate
industrial control systems protocols
and to explore ICS/SCADA usage by Sector.
Let's get started. We're going
to begin with the Controller Area Network.
Cars have become more complex over the years and
now with the introduction of unmanned aerial vehicles,
we need something to help us control
the complex systems within these vehicles.
This is where the Controller Area Network comes in.
These vehicles rely on electronics now that will
help them to control their engine and power systems,
the breaking and then landing for
UAVs and the suspension instability.
Each of these subsystems included
in an electronic control unit known as an ECU.
These ECUs are connected to
one or more CAN bus serial communications buses.
The Onboard Diagnostics or ODB-II to is
a good example of this
and if you look at the picture on the screen,
this is an ODB-II connector that you can plug
into the ODB-II port on your vehicle,
plug the other end into your laptop or mobile device,
and then you can download diagnostics
information from your vehicle.
But the bad thing about the Controller Area Network is
that it operates in a way that's similar to Ethernet,
but it has zero security.
The ECUs will transmit their messages
as a broadcast and because of this,
all of the other ECU's on
the same bus will receive the message.
It also has no source addressing or message
authentication and is susceptible to DoS attacks.
To top all of this off,
it's also usually accessible
remotely via the vehicle cellular navigation system.
Modbus. Operation Technology or OT networks,
are all the parts of an ICS network,
in contrast to a normal client-server network.
Modbus is a protocol used on OT networks,
and it allows control servers and SCADA devices
to query and change the configurations of PLCs.
Originally Modbus was a serial protocol
known as Modbus RTU,
but it has been modified to run on
Ethernet and use TCP/IP.
Other protocols include
the Common Industrial Protocol or CIP,
the Distributed Network Protocol or
DNP3 and the Siemens S7 comms.
Data Distribution Services or DDS.
This enables the interoperability of networks for
machines for the purposes of scalability,
performance, and quality of service.
It supports Cloud and on-prem scenarios,
and it allows for
automated orchestration of all connected components.
Safety Instrumented Systems or SIS.
These are composed of sensors, logic solvers,
and final control elements,
such as horns, flashing lights or sirens.
It's designed to return an industrial process to
a safe state after preset conditions have occurred.
The goal is to monitor industrial processes for
possible dangerous conditions and reduce
the impact of an emergency event
by taking defined actions.
An example of this would be
an assembly line where maybe the rate of
speed is going too high or
a temperature has raised to an unsafe level.
This would trigger events
such as stopping the assembly line
or turning off the machines that are getting
too hot and then also sounding an alarm.
ICS/SCADA usage by Sector.
We'll begin with the energy sector,
which is power generation and distribution,
and also includes the oil and gas industry.
To make it more confusing,
it could also include public utilities like water,
sewage, and public transportation networks.
Industrial sector is the mining
of raw materials and includes the refining,
which uses high heat and pressure furnaces,
presses, centrifuges, and pumps.
Manufacturing is the creation and the assembling
of components to make final finished products.
Automated production systems would include forges,
meals, and assembly lines.
The logistics sector is about
movement of materials and goods.
It will use embedded devices to help control
automated transport and lift
systems and sensors for component tracking.
Facilities management sector would be HVAC,
lighting, and security systems.
Finally, we have healthcare which
aids in patient tracking,
medical equipment and supplies,
but it could also include
environmental controls like HVAC.
ICS and SCADA security.
ICS and SCADA systems are often referred to as
defenseless systems and this is because
that over the years as they were developed and improved,
no thought was given to security at any level.
The other problem is though,
is that these are embedded in
the critical areas of national infrastructure.
Attacks on these could bring about real-world impacts.
Because of this, ICS/SCADA system and
it should be isolated via air-gapping.
You could also use change control to help detect
any unauthorized access to these devices.
Let's talk about some real-world impacts
that we've already seen.
In 2007, Estonia was under cyber attack from Russia.
They used a large DDoS attack,
but it also brought down
critical infrastructure like banking and transportation.
Then in 2015, APT Sandworm,
which is a Russian APT,
attacked the power grid for Ukraine.
It brought down the power for more than
230,000 people and it lasted for more than six hours.
These are already direct attacks
on infrastructure that is impacting
people directly. Instructor side note.
This is completely off of this particular topic,
but dealing with things to help you
understand how you can also use
similar devices in your own life to help
you just understand things in a different way,
but you could get Raspberry Pi's
and use them for different projects.
For example, you could build
your own temperature sensor or a motion sensor.
A lot of people have set them up for
weather stations or airplane tracking,
building their own security systems.
One thing is you could build a Pihole,
which is a free software that can be installed on there.
They will block ads and
malicious websites on your network.
Then another fun project is
a penetration testing drop box.
But the point is, is that Raspberry Pi's are infinitely
usable and there are so many people that have used them
for different projects that if you have an idea,
chances are someone else has already done it,
and that will help you get a good start,
but the devices are so useful because
of the variety of sensors that are available for them,
what's already built into the devices
themselves and they're very
inexpensive when you can get them.
In 2022, the supply chain issues are
causing these have become hard to get that
supposed to be eased up by the end of the year,
and they've slowly started to trickle back in,
but you can pick up one of these devices for
less than 50 bucks and use them for
so many things and they are a lot of fun to work with.
Let's summarize. We went over
the Controller Area Network or the CAN.
We also discussed Modbus and
the Data Distribution Service or DDS.
We discussed the Safety Instrumented Systems or SIS,
and ICS/SCADA usage in various sectors.
Let's do some example questions.
Question 1, this is composed of sensors,
logic servers, and devices
such as horns and flashing lights.
It is designed to return industrial processes to
a safe state after certain conditions are detected.
Safety Instrumented Systems.
Question 2, ICS/SCADA systems
should use this technique to secure systems.
Air-gapping or isolation.
Question 3, cars and UAVs use these to
manage the multitude of
complex systems it takes to operate them,
such as their braking,
landing, engine control and suspension systems.
Controller Area Network.
Finally, Question 4.
This is a protocol originally designed as
a serial protocol that is used on OT networks.
Modbus. I hope this lesson
was useful for you, and I'll see you in the next one.