Industrial Control Systems-A new target?

Industrial Control Systems- A new target?

Industrial Control Systems (ICS) used for monitoring and controlling equipment and processes used in oil, gas and energy plants, are a critical component of the plant infrastructure. ICS solutions were purpose-built and isolated pieces of hardware and software. Their purpose-built design philosophy in tandem with the apparent lack of interaction with other systems and technologies led to their development without Information Security principles in mind. Unlike the past however, most ICS vendors nowadays use market-standard IT technologies in their solutions. Moreover ICS components like SCADA are today interconnected with corporate networks. While this convergence of technologies can improve productivity and profitability, it unavoidably exposes ICS components to cyber-attacks.

Facts:

32% of Operators indicated their control system assets / networks had been infiltrated or infected
34% of Operators believe their systems have been breached more than twice in the past 12 month
15% of Operators reported needing more than a month to detect a breach
44% were unable to identify the source of the infiltration

(Source: SANS Institute Survey – June 2015)

Stuxnet, Shaman and Havex are widely known examples of threats targeting Industrial Control Systems reaching to them over market standard IT tools and interconnections. Although securing industrial control systems is of paramount importance, it poses many unique challenges. Maintenance windows can take months or even years to plan and execute for applying patches and updates. Performing even minor changes outside maintenance windows could prove catastrophic by bringing a system down even for a few minutes. Industrial control systems are not isolated any longer. Undocumented or poorly updated documentation of interconnections with corporate networks can make complex and otherwise thorough Risk Assessments a fairytale to an attacker.

Our approach

Neurosoft together with our partner Positive Technologies can offer a new approach to critical systems security. The approach includes all layers (defense in depth) such as Perimeter Infrastructure, Policies-Procedures-People and Cyber Security layers.

The solution that is proposed is related to four main areas:

Research

To understand threat landscape
To discover security vulnerabilities and related risks
To offer extensive security expertise in the field

Consulting

To apply our research in the real world – Intelligence
To adopt Information Security best practices for ICS
Develop guidelines, controls and procedures for secure implementation of ICS
Training and Security Awareness Programs

Products

To build safe and secure ICS protection solutions
Block malicious activities by protecting the SCADA protocols
Monitor and detect attacks or malicious actions
To automate security processes and controls

Verifications of ICS security level

Verification of organization effectiveness protecting business measures
See into all networked systems for audits/compliance – periodically

Our credentials
Technology brief in attached Gartner Report. Major references on ICS Security solutions include:

ENEL – Italy (Multinational Power Company)
Ferrovie Trenitalia – Italy (Italian Railways)
KOSPO – South Korea (Energy Generation, KEPCO Subsidiary)
SONELGAZ – Algeria (State Owned Electricity & Gas Distribution)
LUCOIL – Russia (Oil & Gas Producer)

About Neurosoft

Neurosoft S.A. is an ICT company (AIM Milan Listed) with in-house Software Development and System Integration capabilities. The company’s headquarters are in Athens with subsidiaries/rep offices in Cyprus and UAE. The main competences within the System Integration Directorate lie within three main focuses areas: Telecommunications Infrastructure projects, Information Technology infrastructure projects and Information Security projects. Neurosoft System Integration mixes product offerings from world-leading hardware and software vendors with in-house expertise and research to formulate turnkey customer-specific solutions. In all cases the company-wide mentality has been built around complex, large-scale implementations and strict Service Level Agreements. For more information please visit our website www.neurosoft.gr

About Positive Technologies

Positive Technologies is a leading provider of vulnerability assessment, compliance management and threat analysis solutions to more than 1,000 global enterprise clients. PT solutions work seamlessly across business networks, securing applications in development; assessing network and application vulnerabilities; assuring compliance with regulatory requirements; and blocking real-time attacks. Our commitment to clients and research has earned Positive Technologies a reputation as one of the foremost authorities on SCADA. For more information please visit our website www.ptsecurity.com

Athens, November 19^th 2015