The reliable and secure operation of critical infrastructure is of great importance to national security, economic vitality, and public safety. Threats to the infrastructure are both real and growing. For example, according to the U.S. Department of Homeland Security, during the five-month period between October 2011 and February 2012, there were dozens of reported attacks on computer systems in the United States that control critical infrastructure, up considerably from the number occurring during the same period a year earlier. While none caused significant damage, they were part of a spike in hacking attacks on networks and computers of all kinds during the same period. Understanding what attacks have been carried out, where the current threats lie, and what is being done to mitigate risk is vital to the security of critical infrastructure the world over.
A significant portion of the critical infrastructure that serves as the backbone of the electric, water, oil, and gas industries relies on industrial control systems (ICS) to function. ICSs are used to send automated or operator-driven supervisory commands to remote station control devices, which are often referred to as field devices. Field devices control local operations, such as opening and closing valves and breakers, collecting data from sensor systems, and monitoring the local environment for alarm conditions. ICSs include different types of industrial control systems—for example, distributed control systems (DCS), supervisory control and data acquisition (SCADA) systems, and programmable logic controllers (PLC). ICSs are highly interdependent—a disruption of one component can have a cascading effect on others.
Early ICS infrastructures were not necessarily designed with cybersecurity in mind. Instead, threat countermeasures were layered on in a piecemeal fashion after the networks were operational, leaving ample room for attackers to compromise their functionality.
While many in the security press have been consumed with the more exotic attacks—such as malicious worms called Flame, Stuxnet, and Duqu—organizations relying on SCADA and ICS networks are likely more at risk from conventional network threats: buffer overflows, default passwords, phishing, and the ever-present denial-of-service attack. It is these exploits that have allowed hackers to take over PLCs by issuing stop commands and inserting substitute device logic and malicious instructions. Many of these exploits can be found through freely available open-source penetration testing frameworks obtainable by both ethical and unethical hackers.