POWER June 2015 - 43

CYBERSECURITY
So You Want to Be an
NSM Analyst
What type of person makes an ideal
industrial control system (ICS) analyst
for the purposes of network security
monitoring (NSM)? As this article underscores,
a questioning, vigilant attitude
is paramount.
Additionally, these general technical
skills and abilities can be very helpful:
■ Understanding what the control system
does, and its components.
■ Knowledge of the ICS protocols that
are used.
■ Awareness of existing vulnerabilities
of their control system components.
■ Ability to use NSM software and write
custom intrusion detection system
(IDS) rules.
■ Being able to communicate effectively.
■ Taking charge if an incident occurs.
traffic to the sensor. Many organizations
have network sensors already deployed
on normal IT networks, but these sensors
may not always be best suited for a control
system environment.
If you are considering installing NSM sensors
in your ICS, I strongly suggest that you
begin in a lab environment and with all of
the important ICS stakeholders, such as security
operations, plant operations, engineering,
and even the ICS vendors. NSM sensors
for ICS environments must consider traffic
volume and speed, the physical environment
(whether or not the sensor needs to be industrially
hardened), and what protocols the sensor
needs to interpret.
The software platform of the sensor is important
to meet these requirements. There are
several new commercial ICS-specific platforms
available on the market that can collect
data and present it to a dashboard for the analyst,
perform deep packet inspection of ICS
protocols, and even draw a network diagram.
There are also free tools available for NSM
sensors, the most popular being Security Onion.
Security Onion contains several tools
such as Wireshark, Bro IDS, and Snort IDS
that understand DNP3, Modbus, and other
ICS protocols.
Placement of the sensors is important as
well, so that the perimeter and important internal
systems in the ICS network are visible
to an analyst. (See sidebar, " So You Want to
Be an NSM Analyst. " ) The sensors should be
connected to either an existing switch with
June 2015 | POWER
port mirroring capability, or a dedicated network
tap should be installed. It is even possible
to passively monitor serial-based traffic.
Lastly, don't forget to secure the sensors and
the data they collect.
The NSM sensor can collect several types
of data. The richest type is the full packet
capture (pcap), which is like a phone recording.
It provides a record of exactly what happened.
Because many ICS networks are low
bandwidth compared to IT systems, capturing
full pcaps is an advantage. The next type
of data is called session data, which is like
records on a phone bill showing who called
whom when, and for how long. Session data
has the advantage of taking less storage space
than full pcaps. Be sure to size the sensor's
hard drive appropriately for how much data
to store for how long. Other types of data include
extracted files, intrusion detection system
(IDS) alerts, and collected log files such
as syslog and Windows event logs.
Advantages for Network Security
Monitoring in ICS
In his book, Bejtlich talks about several
disadvantages of implementing NSM in
IT networks, such as high bandwidth, encryption,
and mobile devices. It turns out
that these disadvantages don't exist in ICS
networks, because ICS usually have lower
bandwidth, the devices are static, and the
traffic is unencrypted.
Plant owners are faced with aging control
system components that have little or
no security and cannot be readily patched
or upgraded. NSM is the best way to monitor
and protect legacy control system components.
When the devices are eventually
upgraded, NSM can still be used to monitor
the newer, more secure devices, because
we know that an unknown vulnerability
may still be lurking.
www.powermag.com
43
Expecting that your ICS will be breached
is a more powerful position than trying to
prevent all breaches.
Figure 2 is an example of a typical plant
network architecture. At the top is the corporate
IT infrastructure consisting of business
systems, personal computers, and laptops.
Next is the plant demilitarized zone (DMZ)
in which firewalls protect the plant and yet allow
corporate access to certain types of plant
data such as the plant historian. Deeper into
the network are the plant distributed control
systems (DCS) for turbine control, balance
of plant, water plant, continuous emissions
monitoring, and historian. At the lowest level
are the controllers themselves, such as the
3. Under the hat. Chris Sistrunk, shown
here, and other security experts recommend
using network security monitoring because
it enables power plants to discover " hidden "
digital traffic that can potentially harm industrial
control systems. Courtesy: Chris Sistrunk
2. Example of a plant network architecture diagram. Courtesy: FireEye
http://www.powermag.com
POWER June 2015

Table of Contents for the Digital Edition of POWER June 2015
