As a cyber security analyst.
A lot of times we have to deal with different aspects of our environment that are critical in nature.
Critical infrastructure is one of those things that we're really going to play.
If you're attributed to different IT technologies that are outside the norm, meaning that we're not
just dealing with windows servers or different routers or switches, it's more with water departments
or power departments or different aspects that are in the public nature.
That's what we're going to cover in today's episode.
We're going to cover critical infrastructure, operational technology, which coincides with critical
infrastructure, industrial control systems, or ICS, and finally SCADA or SCADA, depending on where
you are in the world, supervisory control and data acquisition systems.
It's important to know, as you're going through this different episodes, that this aspect isn't necessarily
something you may not see throughout your entire career, but Cisa requires that you have a basic understanding
of it as you move through the different exam objectives.
Critical infrastructure encompasses operational technology, industrial control systems, of course
SCADA, DCS and PLCs.
All this comes into play when we're looking at critical infrastructure as a whole.
Remember, critical infrastructure is literally the public facing infrastructure that we utilize within
our own government.
This is where if something were to go bad, the entire public faces a problem with it.
For instance, the Colonial Pipeline that we saw a while back was a lockdown of the entire natural gas
line or the gas line that was associated with it, providing a problem within our communities on the
east coast of the United States.
This was an attack against a critical infrastructure.
Those pipelines provided a needed energy resources to the public at large, and the FBI and major federal
agencies were involved to clear that up as quickly as possible.
When it comes to critical infrastructure, all you really need to know, as far as Cisa is concerned,
is that it has to deal with public facing technologies that serve the greater government or the greater
good for the people.
Operational technology is the hardware and software associated with that critical infrastructure.
These are usually the control boards or the control systems that allow those pipelines or those water
companies to operate in which the ways they which they do.
Now, there's different subsets of operational technology that we'll go into a little bit.
But what you really need to know about operational technology is that it's the control systems that
manage everything.
For instance, if I'm on the electric company, I may have a control system that is specific to the
engineering of the electrical company or the electrical grid.
If I'm in the water company, I may have a different control system, but it's all considered operational
technology at that public facing series.
That could be oil gas, it could be hospital, it could be electrical, it could be plumbing and water.
The boats are endless.
It's still part of that critical infrastructure that we talked about.
Industrial control systems.
Take it one step further.
This is the real time control or operation of those public facing works.
This is real time control and integrated into the sensors and actuators.
When we talked about Colonial Pipeline and how it affected.
We were talking about energy moving from one point to another and the IT systems that are associated
with it.
When it comes to operational technology, more often than not, we're talking about the actual control
boards at a higher level.
If you look at a hierarchy, those operational technologies, maybe they face the interface between
the IT world and the critical infrastructure, the ICS, the industrial control systems.
That's where the real control comes into play outside of our normal IT environment.
This is where we develop real control systems that interface outside of the entire environment and provide
us with the actuators and the internet connected systems that allow those systems to function on a pseudo
internet.
Again, we're not providing internet access to internal industrial cultural systems, but we do have
the OT, which provides that internet access to those industrial control systems.
I know it gets a little bit confusing as I'm going through this.
Just realize that OT stands over it, and if we go back to the original slide, you can see that OT
encompasses all of Ike's that really comes into play, how OT interacts with our Ike's systems, with
the integrated sensors and actuators.
We're really providing the access to those different levers or mechanical functionality of those public
works.
For instance, I want a water pipe opened.
I would go through the OT system to access the Ike's system, and the Ike's system is what turns the
little knob to allow the water to flow.
If I wanted the water to stop, I can again go through the OT system to interface with the Ike's system,
which then makes the flow stop.
This is where the interconnected systems come into play.
Now I can have Ike's systems that interact with other Ike's systems depending on how my network is laid
out, but a lot of times I want to put a clear deliminator between what has online access and what does
not.
A lot of times, those OT systems that we talked about earlier, while they may be connected to the
internet, they're not truly connected to the internet.
That means that yes, you can access them, but you're going through a critical IT system that is blocked
off from everything else and allows only someone with authorized authenticated user privileges to interface
with those IT systems.
Those systems are then firewalled off and encapsulated in such a way to make it highly secure.
But they're not 100% invulnerable, as we saw in the Colonial Pipeline ransomware attack.
We also know that ICS systems use a specialized communication.
We're not talking about basic binary that you see on a computer system.
It's not unusual to have ICS systems talking in a way or a function that isn't normal for regular computers
to talk on.
Believe it or not, that's a security safeguard.
We don't want our ICS systems to be able to talk by a windows system that just connects into it willy
nilly.
It needs to have specialized communication protocols that come into play, so that your average everyday
user can't interconnect with it and make it do things that it's not supposed to do.
By having that specialized communication system in place, we limit the vulnerabilities associated with
the ICS system through standard communication protocols.
We also might update those systems on other pathways.
It's not unwise or unusual to have your specialized communication only available through floppy drives.
If you're familiar with nuclear power plants.
A lot of those nuclear power plants don't actually take CDs or even Blu ray discs.
In fact, if you want to update the software on those systems, you need a five and a quarter or a 3.5in
floppy drive.
And we don't even make those anymore.
But that's how they update those systems, and they refuse to upgrade those systems, because we don't
want people to be able to access those systems through regular means.
By keeping that system down to a 3.5in drive or a five and a quarter drive, even though it doesn't
possess all the data infrastructure that we see in modern communication, we limit the attack vectors
associated with our ICS systems that a malicious actor may be able to utilize the supervisory control
and data acquisition, SCADA or SCADA, depending on where you're from, provides those limited supervisory
control over specific user machines.
What do I mean by that?
It's not uncommon to have a big machine that you interact with that may have a lever or a limited functionality
for pen or code utilization.
We provide data acquisitions back into our IX machines through SCADA.
This device then allows the human to interact with it by either punching in a code, maybe switching
a lever, or even providing limited remote access to it.
When you think about OT and then IX, realize that SCADA or SCADA is really the man machine interface
that interacts with it.
This data acquisition and supervisory control system allows for things like power plants to remain operational,
utilizing older technology that would then not be available to most people.
It's not uncommon to have a Scottish system that literally looks like it was from the 1990s or even
1980s, because it hasn't been updated that often.
And again, we use that as a security safeguard against normal malicious attack vectors that we may
see on a day to day basis.
We also provide limited, very limited remote access.
This is usually via command line interface, using a proprietary software that allows somebody to access
that software or that machine interface device in such a manner to where, again, you have very limited
capabilities of it.
If I wanted, for instance, to shut down an entire gas line for emergency control, then yes, I might
write that into the code that allows me to have remote access.
However, I would have to have a secure mechanism in place to limit the availability for malicious actor
to get into play.
To be able to use that.
Now, within the Colonial Pipeline, we saw that Scota was taken advantage of through a known vulnerability
that the malware was able to get into, but they didn't really get into the remote SCADA access.
What they really did was provide a ransomware, which locked them out of the main systems for understanding
how those systems are hacked and the data flow within them.
They didn't really get into the Scottish system.
They got into the controlling hierarchy system that allowed them to see the data and then lock it out.
If you really look at it, the Colonial Pipeline was fine.
It just couldn't be operated because all the higher level systems and the high point of the hierarchy
were locked down because of a ransomware attack.
Within this episode, we talked about critical infrastructure and how it intersected with operations,
technology and again with industrial control systems and finally the supervisory control and data acquisition
systems.
It's important to understand you only need to have a high level overview of what these systems represent
and how they are utilized.
I would expect to see systems or questions that interface with if the power plant is associated with
a known attack, where does that tie into the overall infrastructure of the operational system?
Obviously, that would be a critical infrastructure.
I would not expect to see questions that relate back to a specific control system or a make and model,
and I would not expect to see a lot of questions that go into pure detail of a specific technology when
associated with critical infrastructure.
A lot of the questions that you are going to see really relate back to the high level overview of what
is critical infrastructure, and how does it interplay with different utility companies.
If you can answer most of those questions, you should be fine within this episode.