Steve Parker - The Internet of Everything: Cyber-defense in an Age of Ubiquitous Vulnerability

The Internet of Things Everything:
Cyber-defense In an Age of Ubiquitous
Vulnerability
EnergySec Hawaii Educational Sessions
February 24, 2016
Steven Parker
President

It’s getting weird out there!
3

Introduction
 The Internet of Things Everything
– Planes, trains, and automobiles
– Home electronics, smart meters, light bulbs
– Kids toys, smart phones, home security
– Refrigerators, washing machines
– Transformers, Traffic Lights, Drones
– What’s left?
 Attack pathways surround us. What’s
next?
 Let’s provoke thought, not fear!
4

Approach and Goals
 Discuss technology that falls outside the
normal scope of protection for mission
critical systems, yet could be used
tactically to impact critical operations
 Explore possible attack methods utilizing
these technologies
 Discuss possible actions to mitigate the
impact of the scenarios
5

Thesis
In the near future, “cyber attacks” will be
used to support nearly every traditional
attack tactic from the non-cyber world.
To paraphrase Jack Whitsitt, Cybersecurity
isn’t about cyber, or security, or technology. It
is about your mission.
6

We Can’t Protect Everything
 Protection Paradigms
– Air Gaps
– Layered Defense
– ”Borderless” networks
– Resiliency
– Impact Levels
7

Scoping – NERC CIP Style
A Cyber Asset that if rendered unavailable,
degraded, or misused would, within 15 minutes of its
required operation, misoperation, or non-operation,
adversely impact one or more Facilities, systems, or
equipment, which, if destroyed, degraded, or
otherwise rendered unavailable when needed, would
affect the reliable operation of the Bulk Electric
System. Redundancy of affected Facilities, systems,
and equipment shall not be considered when
determining adverse impact. Each BES Cyber Asset
is included in one or more BES Cyber Systems. A
Transient Cyber System is not a BES Cyber Asset.
8

But We Must Protect the
Mission
 Survival Paradigms
– Redundancy
– Backup Systems
– Recovery
– Manual Operation
– Alternative Procedures
– People?
9

Resiliency – NERC CIP Style
Each Responsible Entity shall have one or
more documented recovery plans that
collectively include each of the applicable
requirement parts in CIP‐009‐5 Table R1 –
Recovery Plan Specifications. [Violation Risk
Factor: Medium] [Time Horizon: Long Term
Planning].
10

Roadmap to Achieve Energy
Delivery Systems Cybersecurity
By 2020, resilient energy delivery systems
are designed, installed, operated, and
maintained to survive a cyber incident while
sustaining critical functions.
11

Dependencies
 Things we choose not to protect, or protect less
– Corporate/Business Networks
– HVAC
– Email
– Support Systems
– Others?
 Things outside of our control
– Power
– Water
– Internet
– GPS
– Telecommunications
– Certificate Authorities
– Supply Chain
– Others?
12

Power
13
Without Power, nearly everything breaks.
Do you own manual can opener?
Gas pipeline/power generation interdependency (ERCOT
issue)
How long will your generator run?
Are you on a well?
Is your iPhone charged?

Internet/Communications
 Do you depend on cloud services?
– Is your recovery plan on a hosted instance of
Sharepoint?
 Internet based VPN tunnels?
 Cellular backhaul?
– Metering, Operations, ???
 Facebook/Twitter/National Weather Service
 Operational coordination, SCADA, Customer
interactions
 What else?
15

Tactical Cyber Attacks
21
Deli.
Meat.
Scale.

Tactical Cyber Attacks
For western intelligence agencies, the blowout
was a watershed event. Hackers had shut
down alarms, cut off communications and
super-pressurized the crude oil in the line,
according to four people familiar with the
incident who asked not to be identified
because details of the investigation are
confidential. The main weapon at valve station
30 on Aug. 5, 2008, was a keyboard.
22

Scenarios
Would you like to play a game?
Brainstorm plausible-ish scenarios in which cyber
attacks can impact mission critical operations
 Electric Power
 Airlines
 Manufacturing
 Roll your own
23

Thank You
Steven H Parker
President, EnergySec
steve@energysec.org
503.905.2923 (desk)
@es_shp (twitter)
www.energysec.org

Steve Parker - The Internet of Everything: Cyber-defense in an Age of Ubiquitous Vulnerability

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Viewers also liked

Viewers also liked (13)

Similar to Steve Parker - The Internet of Everything: Cyber-defense in an Age of Ubiquitous Vulnerability

Similar to Steve Parker - The Internet of Everything: Cyber-defense in an Age of Ubiquitous Vulnerability (20)

More from EnergySec

More from EnergySec (14)

Recently uploaded

Recently uploaded (20)

Steve Parker - The Internet of Everything: Cyber-defense in an Age of Ubiquitous Vulnerability