When asked "What cyber attacks have had the biggest effect on the natural gas sector?" Andrew Ginter, VP Industrial Security at Waterfall Security Solutions had an interesting answer:
"The attacks I worry about have not been widely reported. Most victims are not aware they have been attacked at all. Take for example remote access. Everyone assumes it is perfectly safe to reprogram a pipeline control system from a hotel room or from an engineer's basement, provided there is a full set of IT protections deployed.
But consider: if I were an attacker, what is my easiest way to sabotage operations? I would write a bit of malware; I'm a programmer after all. I would put a phishing email together and trick one of these remote engineers into clicking on my attachment. Anti-virus would not activate because I've just written this attachment - there is no signature for it. My malware would wait until this remote user activated his VPN and logged into the control system through a two-factor-authenticated Remote Desktop session. My malware then creates an invisible, virtual screen, moves the Remote Desktop window to the screen and shows the engineer a message like "Remote Desktop has become unresponsive. Looking for a solution...". And of course the malware reaches out to the Internet to give me control of the session.
IT networks accept this risk, because IT networks are breached every day. What's one more compromise? This is what intrusion detection is for. Unlike IT networks though, control networks are not breached every day and intrusion detection takes time. The briefest exposure of pipeline control networks to an external remote-control attack is unacceptable.
This is why people are deploying control-system-centric Unidirectional Security Gateways instead of firewalls, and why standards are evolving to require unidirectional defenses. Unidirectional gateways prevent this kind of remote control attack and all other remote control attacks for that matter. The latest French ANSSI standards for critical infrastructure say it best: they permit IT-style defenses only for control systems that French society considers expendable. For the most important control systems, unidirectional communications are required, and firewalls and remote access are forbidden; the risks are simply too great.
The question facing all of us going forward is simple: which of our control systems do we think are expendable? That is: expendable enough to continue accessing remotely, through firewalls? And which of our systems deserve unidirectional protections?" Let us know your views below.
To know more about technological developments and applications in the gas industry, attend the CoTEs programme. The Centres of Technical Excellence (CoTEs) is a free-to-attend technical seminar programme at the Gastech Exhibition.
Sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.