Protects plants from Cyber-attacks.

Eaton has launched its next generation Tofino industrial security solution. The 9202-ETS MTL security system provides the highest level of network security for process automation applications. The MTL Tofino security system is exceptionally easy to install compared with alternative systems and includes the latest configurator software to protect industrial networks from cyber-security vulnerabilities. This maximises plant uptime and process availability while protecting it from external network attack.

“When Industrial Control and Supervisory Control and Data Acquisition (SCADA) systems were not connected they were considered immune to attacks, but the trend towards open standards such as Ethernet TCP/IP and web technologies has seen these systems affected by a growing number of threats,” said Roger Highton, product line manager, Eaton. “Traditional firewalls are not designed for control systems or industrial threats, thereby putting essential utilities at risk, and each year, the damage to critical infrastructure from network incidents and cyber-attacks runs into billions of dollars. The MTL 9202-ETS gives process managers in the power, utilities, oil and gas and water and wastewater industries a cost-effective security protection that is highly effective and quick to install.”

It supports all popular industrial protocols with the Firewall Loadable Security Module (LSM) which compares network traffic against a set of rules. The new release includes the EtherNet/IP Enforcer LSM for deep packet inspection of EtherNet/IP (CIP) communications. Tofino can also be configured remotely with the Netconnect LSM, providing further flexibility to the user. Further LSM’s can also be specified such as the Modbus enforcer and OPC enforcer LSMs providing deep packet inspection for these key industrial protocols and the Event Logger LSM logs security events and sends alarms. The LSMs are available pre-installed or can be purchased separately.

The 9202-ETS MTL security appliance delivers defence in depth for a wide range of DCS, PLC, SCADA, networking, and automation systems. As it does not have its own IP address, it sits as an invisible device on the network and is designed to stop threats without disrupting the critical process application.

The Tofino system includes a number of templates for use with a wide range of automation protocols to further ease installation. In addition, it provides a number of rules and a test mode, so users can check the proposed configuration will not interfere with the operation of the plant before putting the security appliance into operation. Tofino Configurator checks for missing or invalid rules and suggests solutions, thereby aiding set-up.

The 9202-ETS MTL security appliance has a rugged hardware design suitable for use in harsh and hazardous environments. It has a robust metal housing for DIN rail mounting,
-40°C to +70°C operating temperature ratings together with Class 1 Division 2 and ATEX Zone 2 hazardous area approvals. This ensures it will give years of reliable service, providing secure networks with security zones as per NERC, ANSI/ISA, and IEC standards.

Terminator termination! Byres say goodbye to Tofino!

Eric Byres and his wife Joann Byres (Tofino co-founder and Belden Vice President) have announced that they are retiring from the Tofino Security group at Belden effective January 30, 2015.

Joann & Eric Byres

In Eric's last blog at Tofino/Belden he states, "As we reflect back on almost a decade and half in the industrial security business, we remember the wild ride it has been to create and grow both a SCADA security business and the industry as a whole. From our early days of critical infrastructure security research, to Stuxnet, to last year’s release of the Tofino 2.0 product line, we have seen a lot of changes.

"When we think about what we aimed to achieve, we’re glad that some of our core beliefs have gained widespread acceptance. This includes the principle of “security simplicity” and the necessity of Deep Packet Inspection (DPI) for industrial protocols. We also tried to contribute to the ICS security industry overall and our work on standards, particularly with ISA, was rewarding.

"Stepping away from industrial security, Tofino firewalls and endless airport security checks is going to be a big change. "

Eric in full battle gear!

This blog then outlines the influential work accomplished during their time batteling against the evils of the syber, especially in their innovative work following the discovery of Stuxnet and the initial warnings they issued, "Security threat to the control system world!"  in 19th July 2010.

The world of industrial automation owes a debt to the "Stuxnet Terminator" and his work against this and many other "little varmints!"

We wish them both well in their retirement and having seen details of some of the ideas they have for their retirement we know that the will continue to make an impact on the standard of living of disadvantaged youth in our unequal world.

Distributor for industrial security system for Britain!

"The industry has come a long way since StuxNet."

Electroustic now distributes Tofino's Xenon industrial firewall. Manufactured by Hirschmann, the Tofino Xenon security system is the latest addition to the Tofino family and is purpose built to provide comprehensive network protection for production systems.

The Tofino Xenon security system is both versatile and rugged, allowing it to withstand the harshest of environments, making it ideal for any industry in which maximum data security is required. This includes plant and process engineering, the transportation sector, oil and gas, power transmission and renewable energy applications such as wind farms.

Security in industry has become of paramount importance in recent years. The cost of cyber attacks on critical infrastructure is now measured in billions of dollars worth of damage.   

With Tofino's Plug-n-Protect technology, Xenon is incredibly simple to implement. The application can be installed in a live network with no special training, pre-configuration or changes to the network itself, eradicating expensive downtime.  

The industrial firewall's security stems from stateful packet inspection (SPI) that not only examines a packet based on its header, as with traditional static filtering, but rather packet contents, to establish more information than simply source and destination. SPI tracks each connection - traversing all interfaces of the firewall and ensuring its validity. 

Furthermore, as an added security measure against port scanning, the SPI closes off ports until connection to a specific one is requested.

"Here at Electroustic we provide industrial Ethernet solutions to a variety of industries," reported Paul Carr, managing director and owner. "Security is currently a very pertinent and prominent issue for nearly all the sectors we supply to.

“That's why we recommend Tofino products that help customers meet and exceed NERC CIP (North American Electric Reliability Corporation Critical Infrastructure Protection) requirements and ISA/IEC-62443 Standards. The Xenon firewall delivers peace of mind, which is essential – the industry has come a long way since StuxNet." 

In addition to the Xenon's in built features, optional deep packet inspection (DPI) is available. This feature allows the user to implement detailed filters within their system. Tofino’s flexible architecture goes beyond traditional firewall security by providing tailored protection zones to protect critical system components.   

Combat cyber-threats with specialist training!

SolutionsPT is continuing its proactive response to the growing threat to cyber security in British manufacturing by becoming an authorised training provider for Tofino® Security Products, (now part of Belden.)

Earlier this year SolutionsPT became a Certified VAR Gold Partner for Tofino’s Industrial Security Solution. Tofino, as our readers will know, is renowned in the industry for cyber security protection within control networks. Tofino’s flexible architecture enables users to create security zones – Zone Level Security – throughout their control network to protect critical system components. (See more on our ICS & SCADA Page on Tofino's part in the battles against Stuxnet and its siblings!)

SolutionsPT is now helping fight the battle against cyber-threats by providing training aimed at maximising the potential of Tofino’s Industrial Security Solution, which includes the EAGLE20TM Tofino Hardware.

The one day course is designed to deliver a fundamental and in-depth understanding of the Tofino Industrial Security Solution by equipping users with the knowledge to install and configure Tofino within a manufacturing network to enable users to extend Cyber Security down to the control network and securely track network devices and easily create firewall rules.

Mike Lees, Hardware Manager at SolutionsPT said: “We are dealing with specialist security solutions designed specifically for the industrial IT market. It is therefore important that we educate our customers to use them effectively and ensure best practice is met, to make certain they are getting the best return on their investment, especially as security is such an ever-increasing issue in our industry”.

Courses will deliver a fundamental and in-depth understanding of the Tofino solution to users in IT, system administration, operations and engineering departments.

Delegate numbers are kept purposefully low so that individual needs and specific industry and company issues can be addressed fully.

Security partnership

HardwarePT has announced a new partnership with Tofino Security, in response to the growing cyber threats in the industrial automation industry.

Tofino Security, a Belden brand, provides practical and effective industrial network security and SCADA security products which are simple to implement and that do not require plant shutdowns. The partnership will see HardwarePT becoming the largest provider of Tofino Security’s industrial network security products, consultancy and training to the manufacturing and infrastructure sectors in the UK and Ireland.

Mike Lees, Business Manager at HardwarePT, said: “Since the Stuxnet attack, industrial IT cyber security has become a major consideration for manufacturers and infrastructure organisations in meeting their availability targets. Our experience is that while such high profile targeted incidents make the news headlines, the main threat comes from inadvertent infection by system users, with the end result being just as devastating and highlighting the need for a solution based around strength and depth. We recognised the need to work with a specialist security vendor and it was clear that Tofino Security would be the perfect partner, due to its experience, credibility and pedigree of success”.

“Unlike security products designed for mainstream IT, the Tofino Security solution has been designed with the rugged environment, staff skills and specific needs of industry in mind, is fully compliant with the ANSI/ISA-99 security standard and is, therefore, well matched with the needs of our customers.”

Frank Williams, Senior Product Manager at Tofino Security, said "We are delighted to be working with an organisation like HardwarePT which understands the specialist requirements of the industrial sector and is able to offer a complete solution to its customers from system design through to the on-going management of Tofino installations."

Partnership responds to automation cyber threats

HardwarePT, the industrial IT division of SolutionsPT, has announced a new partnership with Tofino Security, in response to the growing cyber threats in the industrial automation industry.

Tofino Security, a Belden brand, provides practical and effective industrial network security and SCADA security products which are simple to implement and that do not require plant shutdowns.

The partnership will see HardwarePT becoming the largest provider of Tofino Security’s industrial network security products, consultancy and training to the manufacturing and infrastructure sectors in Britain and Ireland.

Multiple Pathways for Stuxnet Infection
(Pic Tofino)

Mike Lees, Business Manager at HardwarePT, said: “Since the Stuxnet attack, industrial IT cyber security has become a major consideration for manufacturers and infrastructure organisations in meeting their availability targets. Our experience is that while such high profile targeted incidents make the news headlines, the main threat comes from inadvertent infection by system users, with the end result being just as devastating and highlighting the need for a solution based around strength and depth. We recognised the need to work with a specialist security vendor and it was clear that Tofino Security would be the perfect partner, due to its experience, credibility and pedigree of success”.

“Unlike security products designed for mainstream IT, the Tofino Security solution has been designed with the rugged environment, staff skills and specific needs of industry in mind, is fully compliant with the ANSI/ISA-99 security standard and is, therefore, well matched with the needs of our customers.”

Frank Williams, Senior Product Manager at Tofino Security, said ‘We are delighted to be working with an organisation like HardwarePT which understands the specialist requirements of the industrial sector and is able to offer a complete solution to its customers from system design through to the on-going management of Tofino installations."

Tofino Security products protect zones of equipment on the plant floor and are complementary to Belden’s Hirschmann brand, which is the industry leader for industrial networking solutions in sectors including oil and gas, utilities, transportation and automation.

• See also our ICS & SCADA Security page.

Hardening vulnerable SCADA protocols

Successful security testing results announced!

Belden has announced vulnerability testing results of the Tofino Security Appliance by Digital Bond. Presented at the SCADA Security Scientific Symposium (S4) in Miami, Digital Bond’s findings revealed that the industry’s known sophisticated cyberattacks could not compromise the Tofino firewall.

“Advanced industrial communications opened the door to outside attacks and over the past few years these attacks have greatly increased in both volume and impacts. It’s our job to ensure that organizations stay secure in a rapidly evolving industrial environment,” said Eric Byres, CTO of Belden’s Tofino Security. (see also Major acquisition strengthens war on Stuxnet and other malware Sept 2011)

Digital Bond's Reid Wightman

“The Digital Bond team, led by Reid Wightman, a researcher at IOActive (and formerly with Digital Bond), shares our goal. Their testing and results demonstrate the strength of our security solutions, but also emphasize the critical nature of continuous assessment and the immediate resolution of discrepancies.”

Considered one of the world’s most respected sources for control system security research, Digital Bond’s security evaluations are among the most rigorous tests in the industry.

Both the Tofino Security Appliance and its management software withstood a variety of sophisticated reverse engineering attacks. The firewall was also subjected to flooding, fragmentation and fuzzing attacks designed to determine if it could be tricked into either blocking good messages or allowing bad messages. The Tofino Security Appliance passed these tests without issue.

Testing also included attacks on Modbus communications, the world’s leading industrial protocol. “Tofino Security provides an awesome security appliance that does the best possible job with the current protocols. It did an excellent job of securing the Modbus protocol, preventing disallowed function codes from getting through,” said Wightman.

He concluded: “I would recommend the appliance to anyone in search of an industrial cyber security solution. In all, I’m quite impressed with the Tofino Security Appliance.” Wightman’s concerns were with the SCADA and IP protocols themselves - he would like to see the industry start creating standards for new, more robust protocols this year.

Byres acknowledged Wightman's concerns, "The SCADA protocols were never designed with security in mind. It will take a major effort to either fix the existing protocols or create new ones. In the meantime, Tofino’s advanced Deep Packet Inspection determines if a message is a read or a write message and drops all write messages, significantly improving the security of the technologies that industry is using today."

In addition to Modbus, Tofino Security provides Deep Packet Inspection for the widely-used OPC and Ethernet/IP protocols. It is a key reason that major automation vendors Schneider, Honeywell, Emerson, Yokogawa and Invensys/Triconex have adopted Tofino and Belden firewalls to secure their systems. As a result, many new sales of critical SIS, PLC and DCS products include a robust industrial security solution from Belden.

For those companies that want even more security, Belden products such as the Tofino Virtual Private Network modules and Hirschmann Power Mice switches with Dynamic ARP Inspection provide robust anti-spoofing and integrity features. Belden's vision is to offer a layered solution that covers all aspects of critical industrial security.

“Customers need solutions designed for long-term implementation that just work,” said Byres. “Our advanced technologies—including Deep Packet Inspection—and our comprehensive lifecycle approach to industrial security contribute to such solutions. Thank you to Digital Bond for their thorough testing of our products.” (See Digital Bond Testing Proves Tofino Hardens Vulnerable SCADA Protocols on Tofino Blog page!)

Secure critical industrial infrastructure

New ConneXium Tofino Products Deliver a Simple Way to Secure Automation Systems

Schneider Electric has selected Tofino Security technology, from Belden Inc.,  to protect its industrial automation systems. The new ConneXium Tofino Security Solution is a suite of products that hardens industrial systems against network incidents and cyberattacks, improving operational security, reliability and performance.

In the last decade, industrial automation systems have been increasingly linked to business systems as organisations look to work smarter and more efficiently. Legacy industrial communication systems originally designed to work only within facility walls are now a hub of information activity, with intelligence passing back and forth between the plant floor and, when necessary, the outside world.
At the same time, the cyber threat level for critical infrastructure, especially threats aimed at energy, water and transportation systems, has increased dramatically.

“Processors and manufacturers are continuously threatened by new and increasingly dangerous cyberattacks, which require greater vigilance and security,” said Dave Doggett, program director for Industry Cyber Security at Schneider Electric. “The ConneXium Tofino Industrial Security Solution provides a key element in mitigating risks by managing the traffic to and from Schneider Electric automation devices before patches are applied or new more secure products deployed.”

“In addition this capability can be used to enforce plant procedure by blocking inappropriate programming commands to devices, preventing mistakes. By collaborating with the experts at Tofino Security, we are able to provide our customers with an easy-to-deploy industrial grade firewall that works seamlessly with our systems.”

The core of the new product line is the ConneXium Tofino Firewall, a rugged security appliance. By inspecting each network message that passes through it, the firewall can ensure that only the right network messages from the right computers can be sent to critical controllers. Hacking attempts, deliberately corrupted messages and even network traffic storms are stopped dead by the ConneXium Tofino Firewall.

The popular Modbus protocol is further secured using the Deep Packet Inspection capabilities provided by the ConneXium Tofino Modbus TCP Enforcer module. Only “allowed” Modbus commands from “allowed” devices go through the firewall, preventing incidents caused by inappropriate remote programming or deliberately corrupted messages from malware until appropriate patches or changes can be applied to the control system.

The firewall is configured using the new ConneXium Tofino Configurator, Windows-based software that includes Tofino’s patented Plug-n-Protect technologies. “We have worked hard to make the ConneXium Tofino a solution that can be used out of the box,” said Eric Byres, CTO and vice president of engineering at Tofino Security. “Engineers don’t need to be security experts to secure their facility with Tofino.” See Eric Byres article on the Tofino Blog, "Making SCADA Security Simple with the Schneider ConneXium Tofino Firewall" (14/11/2012).

An example of the Plug-n-Protect technologies included in the ConneXium Tofino are 15 pre-configured templates for major Schneider automation products. Engineers simply select the models of Schneider product they are using in their plant from the templates. They then decide which devices they want to allow communications to and the ConneXium Tofino Configurator automatically determines the appropriate rules. The software also includes expert technology that looks for common mistakes in firewall programming and proposes possible improvements.

Bob Lockhart, senior research analyst, Pike Research commented, “Automation systems face unique cyber security challenges that require protection, built by companies that understand how those systems work. Lacking extravagant IT budgets, automation systems also require cyber security systems that just work, with a minimum of human intervention. Companies want to focus on their core business, not the enabling technology.”

Once in the field, it is easy to keep the ConneXium Tofino Firewall up-to-date using Tofino Security Profiles. These are sets of tailored rules and protocol definitions that defend against newly disclosed vulnerabilities and malware. Each Tofino Security Profile is packaged so that it can be quickly deployed without impacting operations, thereby providing a quick and effective defense against new threats. For example, recently Schneider Electric utilized the Tofino Security Profile feature to make available mitigation against publicly announced vulnerabilities in its Modicon PLC product line, allowing customers quick access to a mitigation prior to the subsequent release of new firmware without the need to interrupt production for a firmware update until a scheduled maintenance period.

The ConneXium Tofino Security Solution is the latest offering in the ConneXium family of industrial communications and security products. Earlier in 2012 the ConneXium Eagle Firewall was released, providing boundary protection and encryption for industrial facilities.

SCADA security simulator

Byres Security (now part of Beldon - see our blog Major Acquisition strengthens war on Stuxnet etc...) has released the new Tofino SCADA Security Simulator (TSSS), part of the Tofino Industrial Security Solution. The product is a complete control system in a box, designed to demonstrate the vulnerability of SCADA and PLC components to security failures, and to test new solutions. It makes the impact of security failures to critical industrial processes easy to grasp, and it shows how to secure processes using the Tofino Security Appliance (TSA). The TSSS is an important tool for helping infrastructure operators, vendors, systems integrators, government agencies and researchers improve Industrial Control System (ICS) security.

Eric Byres demonstrates the new TSSS in this video!

“Cyber threats to industrial processes have been difficult to demonstrate, making it hard to test designs, train staff or research mitigating technologies,” remarked Eric Byres, CTO and VP Engineering of Byres Security. “Now, with the Tofino SCADA Security Simulator anyone can understand both the impact of security breaches on industrial processes and how to stop them.”

A typical TSSS demonstration starts by showing how SCADA and Industrial Control Systems operate, using a widely deployed PLC to control production. Next, SCADA specific malware attacks the control system and destroys the process. Finally, the system is secured using leading technology such as the Tofino Industrial Security Solution. The TSSS provides hands-on experience and reveals the impact of SCADA security in a tangible and visual manner.

Joel Langill, CSO of SCADAhacker.com, explains: "You can only be so effective when trying to explain cyber security to someone using a deck of PowerPoint slides. When you shift the discussion to an actual demonstration showing both an attack and a successful mitigation to an attack, people actually understand it."

Joel continues: "As a security consultant, I use the TSSS not only for simple demonstrations of cyber security controls, but also to implement various security strategies in an offline manner. I can then develop corresponding Tofino Security Appliance configuration schemes which can be applied to online production systems. I find it very handy to be able to use the TSSS with a variety of SCADA / HMI applications, and with associated field control equipment like PLCs, RTUs and application servers."

The Tofino “complete SCADA simulation system in a box” is available in a portable carry-on case, or in a large “trade-show” format. It comes with simple step-by-step instructions for demonstrating SCADA operations, security risks and security solutions. Simulations are available for gas pipelines, power facilities, chemical plants and water utilities. The product is available now from Byres Security and from Tofino Certified VARs.

• See Eric Byres's blog: A Truly Portable SCADA Security Simulator (29/9/2011)

Control system security and OPC

Effective OPC solutions mean better control system security

MatrikonOPC and Byres Security have just published a new white paper on security and OPC. Eric Byres explains: "OPC is the world’s most widely used industrial integration technology for SCADA and ICS systems. Due to this popularity, I believe it is vital that controls and network professionals understand how to deploy it securely."

Click for Blog: OPC Security:
More than the Sum of the Parts

For the past decade, industrial control system professionals have wanted to believe that ‘air gaps’ truly existed between their systems and the rest of the world. They have also hoped that ‘security by obscurity’ would keep them safe from security threats.

Those days are over. Recent security incidents such as the game-changing Stuxnet worm are a wakeup call for the industrial automation industry. While the risk of cyber attacks and malware are no longer in doubt, the question remains, “Exactly how can an engineer reliably secure his or her control system?”

Complicating the situation is the widespread use of commercial off-the-shelf (COTS) information technologies like Windows and Ethernet on critical control systems. The use of these common networking, computer and software technologies has certainly reduced costs and increased business agility. However, it has also increased the demands to balance the need for accessibility to control system data with the need to safeguard the integrity and usability of mission critical systems.

One of the most effective ways to manage the conflict between the demands of efficient access and the demands of effective security is to minimize the variety of interfaces and protocols operating between the control system and external networks. Having one approved connectivity solution serving multiple corporate requirements not only reduces administration costs, but also reduces the opportunities open to the attacker or worm. This is known as "reducing the attack surface” of a system.

Thus the key task for an administrator is to select an appropriate communications technology that can be used by the widest variety of control AND business systems. While there are a number of possible candidates, OPC is without question one of the easiest and most widespread standards to address the demands of universal data access in the industrial automation world.

By layering defenses that are OPC-aware, high security solutions can be created that meet both the security and access expectations of a company, all without administrative overload on the network or controls team. The result is a standards-based solution that has been proven across numerous control systems.

Furthermore, since OPC is so universal, it has the potential to be the only protocol needed for enterprise to control system communications. And following the security principle of “reducing the attack surface”, an OPC-based solution is possibly the most secure solution for control system interfacing available today.

It is important to emphasize the standards in recommending an OPC security solution. There are many so called “security solutions” that are secure only because they are obscure. It only takes one determined hacker (such as Luigi Auriemma who published 34 SCADA/HMI vulnerabilities in March 2011) to break into proprietary systems and publish the exploit code on the Internet. Then “security by obscurity” is useless.

In terms of providing network-focused security, an OPC-aware solution is the Tofino Security Appliance with the Tofino OPC Enforcer Loadable Software Module. It is designed to secure ANY OPC product, because it uses core IP, TCP, RPC and DCOM standards exactly as they were intended. Similarly, for application-focused security, and for granular role and user-based security, the MatrikonOPC Security Gateway is fully based on the OPC Security specification and provides complete security for OPC architectures.

These two products have been successfully tested together with the Tofino technology providing front line protection from 99.99% of all network based attacks such as Denial of Service, unapproved clients, malformed DCOM connections etc. Once network traffic related to OPC has been vetted, the MatrikonOPC Security Gateway enforces the specific security policies chosen by the administrator– ensuring each user only gets access to the specific data he or she has authorization to work with.

The bottom line for control engineers looking for a reliable security solution is: if you use one protocol for control system communications and if you select standards-based OPC security products, you can achieve high security without administrative overload.

For a detailed discussion of defense in depth for OPC Security, download the White Paper “Effective OPC Security for Control Systems – Solutions you can bank on”.

Controlling spread of Stuxnet

New application note:  Preventing the spread of the Stuxnet worm in both Siemens and non-Siemens network environments.

One of the key things Byres Security have learned in their test lab (and confirmed by INL at the ICSJWG  - US Industrial Control Systems Joint Working Group - meeting last week) is that the Stuxnet worm is very aggressive once it accidentally gets into a control system. And once it is in, it is almost impossible to remove, since the worm just keeps popping up as it re-infects PCs.

We have a number of links to Stuxnet related articles at the bottom of our blog "Stuxnet – not from a bored schoolboy prankster!"

To counteract this they wanted to create a document to give specific guidance on how to prevent Stuxnet and Stuxnet-like worms from migrating between ANSI/ISA-99 security zones in a control system. Of course the configuration examples they use are based on their Tofino Industrial Security Solution, but the concepts are generally applicable to other firewalls.

The paper (pdf) is available on the Tofino Blog from Monday 7th September 2011.

Stuxnet paper updated

The single most visited page in the Read-out Blogs is that written by Nick Denbow last month (Sept 2010) which we entitled: Stuxnet – not from a bored schoolboy prankster! (21/9/2010). We have endevoured to add links from other sources to this from time to time. This one will also be added to it.

Now Byres Security has issued the latest version of their Stuxnet White Paper and we consider it important enough to add it as a separate blog.

Basically they have massively updated the original paper, published at the start of the Stuxnet event (back in July - see Security threat to the control system world!) to focus on specific mitigations that are recommended for all control systems, regardless of whether Siemens product is used or not.

• A new summary of what Stuxnet is, what its consequences are, and how it is spreading

• A revision of the list of vulnerable systems

• An expanded analysis of the available Detection and Removal tools

• A new Prevention/Mitigation section that covers both patchable and non-patchable systems
  

The paper, which is Version 3.0 of this Stuxnet White Paper has been renamed to: 'Analysis of the Siemens WinCC / PCS7 “Stuxnet” Malware for Industrial Control System Professionals' and may be downloaded from their Tofino Website.

OPC Firewall shipping

Earlier this month we reported on Byres Security's Tofino OPC Enforcer, a rather revolutionary firewall technology. This is now available and shipping. This new module is designed specifically to secure industrial systems using OPC Classic.

OPC Classic (i.e. all OPC variations other than OPC-UA) is the world’s most widely used industrial integration protocol. Unfortunately, it is also famous for being very difficult to secure.

The Tofino OPC Enforcer radically changes the OPC security landscape because:

• It is the first ever industrial firewall for managing OPC traffic. Unlike other firewalls, this product inspects, tracks and secures every connection made by an OPC application, opening only the exact TCP port required for a connection between an OPC client and server.
  
• It is implemented without requiring any changes to the control system. The Tofino hardware is simply installed into the live network and configured using a drag and drop editor to select permitted clients and servers. Once installed, network security is assured, with all OPC traffic managed behind the scenes.

They have also published an OPC Feature Page, which is a hub of information on OPC and security, and includes a link to download a new White Paper titled “Securing Your OPC Classic Control System” written by me and Thomas J. Burke, the President of the OPC Foundation.

Security breakthrough for OPC-based industrial automation

New Tofino® OPC Enforcer technology secures any system using classic OPC, the world’s most widely used industrial integration protocol
Byres Security has released the new Tofino OPC Enforcer firewall, part of the Tofino Industrial Security Solution. This new module locks down any industrial network using the previously hard to secure OPC Classic protocol. Using deep packet inspection firewall technology, the Tofino OPC Enforcer provides superior security over what can be achieved with conventional firewall solutions. The result is improved network reliability, availability and security for any process control or SCADA company using OPC.

Byres Security have published an OPC Feature Page, which is a hub of information on OPC and security, and includes a link to download the new White Paper titled “Securing Your OPC Classic Control System” written by me and Thomas J. Burke, President of the OPC Foundation.

OPC Classic is widely used in control systems as an interoperability solution, interfacing control applications from multiple vendors. Unfortunately, as numerous studies show, the technologies underlying it were designed before network security issues were widely understood. As a result, OPC Classic has been almost impossible to secure until now.

Thomas J. Burke, the president of the OPC Foundation, notes; “The Tofino OPC Enforcer is an important innovation and a great solution for all the systems that currently use OPC Classic – approximately 90% of all industrial networks”.

While the OPC Foundation is working hard to get its new and more secure OPC-UA technology into the market place, it will be years, if not decades, before all legacy OPC DA, HAD and A&E installations are replaced. In the meantime, the Tofino product addresses the security gap by providing a plug-n-protect solution that can be deployed in minutes without changes to existing OPC systems.

The Tofino OPC Enforcer provides two important benefits to control systems users:

1. It provides robust security and stability for any system using OPC DA, HAD or A&E, thus preventing industrial network attacks and accidents. Unlike other firewalls, this product inspects, tracks and secures every connection made by an OPC application, opening only the exact TCP port required for a connection between an OPC client and server.


2. It is implemented without any control system changes. The Tofino hardware is simply installed into the live network and configured using a drag and drop editor to select permitted clients and servers. Once installed, network security is assured, with all OPC traffic managed behind the scenes.

The recent Stuxnet worm attacks against Siemens HMIs and PLC systems has highlighted the need for better security on the plant floor. At the same time, many incidents result from internal network problems.

“Past industrial shutdowns, for example, haven’t been caused by hackers. Instead they were the result of badly configured software causing traffic storms that impacted critical controllers and other systems,” said Eric Byres, security expert and Chief Technical Officer at Byres Security. “The Tofino OPC Enforcer LSM does much more than block hackers and viruses from accessing automation systems. Its dynamic port management techniques prevent many basic network problems from spreading throughout a plant or SCADA system.”

Availability and Requirements
The Tofino OPC Enforcer is available now from Byres Security and from leading automation industrial suppliers MTL Instruments and Belden / Hirschmann. It requires the Tofino Security Appliance, the Tofino Central Management Platform and the Tofino Firewall LSM. The technology will also be available as a stand-alone appliance, the Triconex Tofino Firewall from Invensys Operations Management in Q4 2010.

Industrial cyber security advances!

-Triconex / Tofino OPC firewall addresses historical security challenges, improves interoperability of critical safety systems-

Invensys Operations Management has teamed with Byres Security Inc. and MTL Instruments to deliver a ground-breaking cyber security solution. The new Triconex® / TofinoTM OPC firewall will harden industrial safety systems against network accidents and attacks. It is the first firewall that protects integrated applications based on OPC Classic, the world's most widely used industrial integration protocol.

To enable greater interoperability of its Triconex safety systems, Invensys pioneered embedding OPC servers within its Tricon™ communications module (TCM). To ensure that these modules were cyber secure, Invensys teamed with Byres Security, which had recently introduced the world's first content inspection firewall for the MODBUS TCP protocol as part of Byres Security's Tofino product line, in order to create a firewall specifically for Triconex systems. The two companies then enlisted the services of MTL Instruments to build the security hardware. The result is the Triconex / Tofino OPC firewall, which is now available for Invensys customers using the Triconex TCM with the embedded OPC solution.

"Processors and manufacturers are continuously threatened by new and increasingly dangerous cyber attacks, which requires greater vigilance and security," said Joe Scalia, portfolio architect, Invensys Operations Management. "The Triconex / Tofino OPC firewall mitigates those risks by managing the traffic to and from the Triconex TCM, providing further assurance that a cyber incursion will not compromise integrated communications between the safety and critical control systems and supervisory HMI or distributed control systems. By tapping into the Invensys Operations Management ecosystem of partners and collaborating with the renowned experts from Byres Security and MTL, we co-innovated to resolve a crucial client challenge and help them achieve safety excellence."

The Triconex / Tofino OPC firewall provides security features developed specifically for Triconex and its embedded OPC Classic server to protect against malicious attacks and other threats to network operations. Users deploy the new firewall in front of the Triconex OPC server, thwarting attacks and traffic storms before they reach the safety and critical control system. It automatically mitigates risks related to previously published DCOM vulnerabilities, while providing packet management and rate limiting to prevent network traffic problems that could have an adverse effect on the stability of the safety system.

For many companies, good network reliability, like that provided by the Triconex / Tofino OPC firewall, is just as important as good security, and with its unique features and capabilities, the Triconex / Tofino OPC firewall can help avoid multi-million dollar accidents and untold environmental damage.

"Past plant shutdowns, for example, haven't been caused by hackers. Instead they were the result of badly configured software causing traffic storms that impacted critical controllers and other systems," said Eric Byres (pic right), security expert and technical officer at Byres Security. "The Triconex / Tofino OPC firewall does much more than block hackers and viruses from accessing the safety system. Its dynamic port management and built-in traffic-rate controls prevent many basic network problems from spreading throughout a plant."

"The next generation of the OPC Foundation interoperability specifications, the OPC Unified Architecture, incorporates similar cyber security protection, based on the excellent work of founding companies like Byres Security, MTL Instruments and Invensys," said Thomas J. Burke, president, OPC Foundation. "Launching the unique Invensys solution is the important milestone in demonstrating that users can secure the interoperability of OPC Classic within other applications without worrying about cyber security. As the use of OPC Unified Architecture expands, we look forward to collaborating with these market leaders to develop additional innovative, readily deployable solutions for the benefit of the entire OPC user community."

"We were pleased to join Invensys in developing a firewall for their industry-leading Triconex safety solutions," Byres said. "Together with MTL, we have delivered a solution that will improve plant safety and security, as well as enable manufacturers to deploy OPC to achieve new levels of interoperability for all of their operations, enabling, for example, tighter integration of safety and asset management systems to share data and help prevent trips."

See also Security beyond Plant Walls (29/7/2009)

More security

New series provides flexible, functional industrial network security

To mark the introduction of a new decade (hopefully not with a bang!) where they hope that industrial network security will be widely adopted, Byres Security are starting off 2010 with the introduction of a new line of Tofino products, the Tofino Argon Product Series.

This is a suite of five rugged Plug-n-Protect™ security appliances with varying connectivity, temperature and power supply capabilities, as well as a selection of firmware modules that customize the functionality of each appliance. The result is a practical and effective cyber security system that is uniquely suitable for protecting industrial facilities with a variety of SCADA, process control and networking systems.

The release of these new products lets companies select the exact mix of security features, fibre/twisted-pair network support and environmental hardening their plants need in a security solution. For example, detailed filtering of Modbus TCP messages over fiber optic cable (by combining the Tofino Argon Modbus Enforcer LSM with the Tofino 220 MM/MM appliance) might be ideal for securing an onsite tank farm, while secure remote maintenance support over a DSL modem would take advantage of the Tofino Argon VPN LSM and the Tofino 220 TX/TX appliance combination.

“The mix and match strategy of the Tofino Argon Product Series is about making control systems simpler and more secure” remarked Eric Byres, a leading global industrial security expert and the Chief Technology Officer of Byres Security Inc. “Complex IT firewalls include convoluted features that you don’t need and don’t use – they are an invitation to configuration errors and ultimately a big security risk. Tofino is designed with the needs of industry in mind, letting you purchase just the features you need to secure your control system.”

The Tofino Argon Product Series is part of the Tofino Industrial Security Solution, which includes Tofino technology that is sold by Belden / Hirschmann, Honeywell and MTL Instruments. All Tofino products are simple to implement and do not require shutdowns to deploy, providing increased safety, network security and performance of control systems.