Why SCADA Networks Are Vulnerable To Attack - Part 1: Unintended Consequences

This multi-part series discusses the security vulnerabilities of the sensor/actuator controls at the heart of SCADA, smart grid and energy management systems, and proposes a means of containing, if not fully addressing, the limitations of these systems.

* * * * * * *

In the 1980s the proximity access card was introduced to the building security market. Until that time, gaining access to high security facilities – including many government agencies – required one to physically insert a magnetic stripe or Wiegand card into a reader.

Proximity card readers from Schlage, Sielox, Indala, and others overcame the inconvenience of swiping a card by using radio energy to sweep the area in front of the reader. Users needed only to place their wallet, purse, valise, or ID badge near a reader and the radio energy would be picked up by their proximity card.

A tuned circuit internal to the card would resonate when within range of the reader, generating a unique radio signature that would be captured and analyzed by the access control system. If the signature matched that of a valid card already programmed into the system, access would be granted. Simple, elegant, and convenient, proximity card systems quickly grew in popularity.

Problem was, this innovative technology had profound, unintended consequences. It allowed the surreptitious identification of people with access privileges to high security facilities. One could use radio energy to sweep a crowd of people and, by virtue of their proximity card, pick out persons of interest based on their signatures generated by their proximity cards. At a time when the Cold War was steamy hot and espionage was rampant, the proximity card was a new-found tool for adversaries.

The unintended consequences of a new technology are not usually discovered until after it's in use, sometimes widespread use, by which time available remediation options might be limited or very expensive. Such is the case with SCADA, smart grid, and energy management systems, which are now front and center in the effort to better manage energy consumption and lower greenhouse gases. Unintentionally vulnerable to manipulation and unauthorized access, these systems can literally turn out the lights, stopping a utility or enterprise cold in its tracks.

(Photo: www.brightsecuritygroup.com)

Is there a role for Wi-Fi in offloading traffic from cellular networks?

We are today witnessing a mobile device boom driven by distributed workforces that need secure anywhere-connectivity, and consumers who want always-on Internet access. Smartphone sales grew 29% year-over-year in 2009 to surpass notebook sales (1), and dual-mode (Wi-Fi/cellular) phones and smartphones will more than double from 2008-2013 to 130.9 million units (2).

One consequence of the flood of mobile devices is growing congestion on cellular data networks. Slow and dropped network connections are legion in large metropolitan areas like Beijing, New York, and San Francisco. Cellular data traffic is rising beyond sustainable network capacity, and there are no signs that it abate any time soon.

This problem is compounded by the challenge carriers face in obtaining acceptable ROI from their massive infrastructure investments. Value-added services like video help a carrier’s bottom line, but the more bandwidth-hungry video booms, the greater capacity is squeezed. Sticky new services and applications needed to secure customer loyalty only add to bandwidth woes.

One solution is to offload bandwidth-intensive multimedia traffic to nearby Wi-Fi networks, a process called “cellular offload.” In theory pushing traffic from overcrowded cellular networks onto high capacity, high-speed Wi-Fi networks should alleviate network congestion. The challenge for carriers is ensuring that bandwidth relief doesn’t come at the expense of the customer experience…or at the customer’s expense.

Cellular offload must be simple to initiate, the quality of service on Wi-Fi must be equal to or better than that offered on cellular, and there should not be cost penalties to the user. That’s a tall order. Many a manufacturer of metropolitan mesh Wi-Fi networks that has attempted cellular offload has failed.

Why? Because metro mesh networks were designed for e-mail and Web access, and not high-density, latency-sensitive data, voice, and video applications. Mesh technology is available that can handle these types of applications, Azalea Networks being a noted example, but metro mesh vendors have so fouled the market that customer resistance is high though not insurmountable.

Cost penalties are another concern. Some carriers, ATT among them, are trying to convince subscribers to pay twice for cellular offloading – once for cellular data service and once for a home Wi-Fi access point to handle traffic that the cellular network can’t. Even if the economics did work for a consumer, this stop-gap crumbles the moment users step foot outside their homes. A system-wide solution – not an ad hoc one – is the only way to address the dilemma.

A corollary to Parkinson’s Law says that data expands to fill all available bandwidth. So while some pundits say we’ll obtain bandwidth relief from 4G cellular (most studies say otherwise), those networks will attract applications that are even more bandwidth heavy.

What we need a commuter lane to handle network overspill and ensure that essential and urgent cellular traffic has the bandwidth it needs. Wi-Fi networks can be that path, if constructed correctly and with the right building blocks, and can do so at a price that is affordable to implement on a vast scale.

So let's stop blaming the rising popularity of Web-enabled smartphones and start focusing on using Wi-Fi to solve the problem.

(1) Dataquest Insight: PC Vendors' Move Into the Smartphone Market is Not Challenge Free
(2) Dataquest Insight: Factors Driving the Worldwide Enterprise Wireless LAN Market, 2005-2013

Project "CleanWallet": The Newest Way To Separate Wi-Fi Customers From Their Money

The best pickpockets create a diversion before they dip and run. They'll bump into you, drop an object nearby, or yell something to catch your attention.

Distracted by the commotion, the extraction proceeds unnoticed. That is until you next reach for your money only to find it's gone missing. Never to be seen again.

This week at Interop Cisco created such a diversion when it announced the availability of a new hardware-based spectrum analyzer. With features remarkably similar to Aruba's recently announced software-based spectrum analyzer - and using words so closely paired to Aruba's that a plagiarist would swoon - Cisco proclaimed that the world at last had a solution for dirty air. The secret: a new line of access points containing - drum roll, please - an embedded ASIC. Did that get your attention?

Now for the dip. In order to get this feature you have to replace your existing access points. If you want clean air everywhere then you have to replace all of the access points in your network. Every single one. Brilliant!

You've got to credit where credit is due. Project "CleanWallet" is really a double-dip - once for new APs and once for the 802.11n APs you only just purchased. Even the Artful Dodger would be impressed.

Silly sods, us. Instead of forcing customers to divvy up cash to replace their access points, our new software-based spectrum analyzer works with all Aruba 802.11n access points, including those already installed. Aruba's spectrum analyzer is feature rich, and includes Fast Fourier Analysis, spectrograms, interference classification, and programmable recording/playback.

We don't require any new hardware to make spectrum analysis work, and for customers using our Wireless Intrusion Prevention Module the feature comes for free. Aruba's 802.11n access points are already significantly less expensive than Cisco's, so the entire Wi-Fi system, including spectrum analysis, is easy on your wallet.

If Project "CleanWallet" isn't your thing, give us a call. We'll prove that you don't have to pay through the nose or sacrifice features to get clean air.

Innovation Shouldn't Have To Be Delivered By Forklift

Ever notice how the latest and greatest innovation from some vendors invariably requires replacing the equipment you've already installed? Known as a "forklift" upgrade, these swap-outs benefit the vendor at the expense of the customer's time and money.

Let's face it, forklift upgrades are driven by vendor greed. The worst offenders make no apologies for their inability and/or unwillingness to design upgradable products. It's just not in their DNA. Product design recapitulates corporate philosophy, to paraphrase Haeckel.

There are existence proofs that a forklift is not a mandatory prerogative to obtain a new feature - even one incorporating a profoundly complex new technology. Therefore a forklift-based strategy must originate in a forklift-oriented mentality.

Case in point - spectrum analysis.

Wi-Fi networks operate in environments containing electrical and radio frequency devices that can interfere with network communications. 2.4 GHz cordless phones, microwave ovens, wireless telemetry systems, and even adjacent Wi-Fi networks are all potential sources of interference. Interference sources can be either continuous or intermittent, the latter being the most difficult to isolate.

The task of identifying interference typically falls to a spectrum analyzer, the gold standard for isolating RF impediments. Spectrum analyzers help isolate packet transmission issues, over-the-air quality of service problems, and traffic congestion caused by contention with other devices operating in the same channel or band. They are an essential tool to ensure that networks run as they should.

To be effective the analyzer needs to be in the right place at the right time. The ideal solution is a spectrum analyzer that’s built into the wireless LAN infrastructure, and can examine the spectral composition of the RF environment anywhere in the Wi-Fi network, at any time. Today vendors offer handheld spectrum analyzers as well as ones that require the addition of spectrum analysis monitors (effectively doubling the total number of access points on site for full coverage).

Rumors are that at least one vendor will be offering new access points with integrated spectrum analysis. Consistent with their company policy, however, a forklift upgrade will be required to use it.

Aruba has taken a completely different tack with spectrum analysis. Its recently introduced scientific-grade spectrum analyzer includes traditional tools such as Fast Fourier Transform (FFT), spectrograms, and interference source classification. It also includes powerful new features such as interference charts, channel quality measurement, and spectrum recording and playback.

Uniquely, the new spectrum analyzer works with all Aruba 802.11n access points, including those already in service. That is, a customer with an existing Aruba 802.11n deployment can enable spectrum analysis on any of their existing access points without adding any new hardware. None.

And the cost? Zero if you are already using Aruba's Wireless Intrusion Protection (WIPS) Module into which the new analyzer is integrated.

Why does Aruba introduce new features that expand the capabilities of its customers' already deployed networks? Why did it add distributed forwarding without a controller in the data path? E9-1-1 call positioning? Wired switch management?

Because adding features recapitulates our corporate commitment to value, driving growth by enhancing the utility of our customers' investments. It's a mutually beneficial arrangement, and one that stands in sharp contrast to a forklift mentality.

The next time you consider an IT vendor consider how they deliver innovative features. With a hand outstretched in partnership or reaching for your wallet.

Adversity Drives Innovation

Economic downturns are commonly viewed as a time of retrenching and cut-backs, but they're also times of intellectual ferment and innovation. While budget cuts and scaled back programs create adversity, there remains a job to do and customers to satisfy.

The issue is how to accomplish this with fewer available resources. To do this you have to get creative, and adversity catalyzes the process. It is the gap between available resources and demand that drives innovation, creativity, and opportunity.

In the words of J.C. Maxwell, “adversity motivates.” Maxwell’s "Benefits of Adversity" identifies the positive attributes of adversity:

1. Adversity creates resilience;
2. Adversity develops maturity;
3. Adversity pushes the envelope of accepted performance;
4. Adversity provides greater opportunities;
5. Adversity prompts innovation;
6. Adversity recaps unexpected benefits;
7. Adversity motivates.

The present downturn is no exception. IT managers face budget and headcount cuts, yet the companies for which they work cannot stop running. Leveraging investments in existing infrastructure, minimizing major new capital investments, and recouping savings from company operations are the new marching orders. If satisfying existing needs was good enough then the task at hand would be straightforward – weather the adverse economic climate by cutting as much spending and headcount as possible.

But in business it isn't that simple. The end of any downturn is followed by an uptick that will require increased IT services. Cut too far today and IT won’t be able to respond tomorrow. Business will suffer - again. IT managers must therefore be cognizant of the future and look at changes and cuts with an eye towards their impact on a future recovery.

This begs the question – is it possible to batten down the hatches to survive the current economic storm while laying the foundation for a future recovery? The answer is yes...but the challenge to doing so, surprisingly, is neither technological nor monetary but conceptual.

Doing more with less requires a new way of thinking about problems. In the IT world it means reconsidering the value of overbuilding complex, expensive infrastructure. In this market, in this economy, the first priorities need to be streamlining costs, boosting productivity, and enhancing efficiency.

A simple example will drive home the point. To lower costs, most enterprises are reducing their real estate footprints. Today 88% of employees work somewhere other than the corporate headquarters - many hotel in branch offices, work from home, or work on the road. The traditional way in which these remote users would be served is with a branch router. This paradigm might be acceptable for a large office but it's outrageously expensive for a branch of just a few people.

The challenge is how to network a large and growing remote workforce in an environment focused on cost reduction. It is here that adversity catalyzes innovation. By standing the problem on its head and saying the real issue is how we enable mobility at low cost for a large number of users - not how we connect a branch office - new, non-traditional solutions emerge.

To a router vendor every problem ends with a hardware-based solution - it is the proverbial key under the streetlight. Reconstituting the problem expands the area of illumination, revealing, for instance, that cloud-computing and virtualization are new options not previously considered.

Simply reframing a question can open a completely new set of solutions. Adversity forces the process by highlighting the inadequacy of the “old school” way of thinking and opening the door to innovative new solutions. Ones that focus on today's needs instead of yesterday's answers.

VBN Killed The Branch-In-A-Box

In 1979 The Buggles released their debut single, 'Video Killed The Radio Star,' a nostalgic look at radio from the perspective of the video age that killed it.

Progress drives on, looking nostalgically in the rear view mirror from time to time, but propelled forward by the engine of our insatiable desire for something better.

Tube-based table radios are nostalgic. So are rotary phones, wooden plows, and iron clad ships. Doesn't mean we want to use them anymore. They were abandoned because something better came along. Something easier to use. Faster.Less expensive.

Technology transitions happen all the time in enterprise IT, but the branch office and fixed teleworker seem to have been neglected along the way. And what an oversight it was. Today more than 85% of employees work outside of the primary corporate campus. Yet they need - but haven't had - the same access to corporate network resources and applications as someone in the home office.

The solution cobbled together by router vendors was to remotely replicate the infrastructure that's on the corporate campus. That is, assemble a stack of appliances for security, VPN, Wi-Fi, routing - and then try to integrate them to work together.

Over time the separate appliances morphed into an integrated branch-in-a-box router. But experience showed that while you can morph a router from a hairball, but you can never take the hairball out of the router. From the user's point of view, the solution was little improved.

The fundamental problem is that the campus network and its branch offspring were designed assuming static users sitting behind protective firewalls. Mobility - mobile users specifically - breaks that model. You have to punch holes in firewalls, configure complex VLAN assignments for segmenting traffic and user types, install VPNs to protect roaming users. The list goes on and on. And grows more expensive, complex, and user unfriendly as it does.

Virtual Branch Networking (VBN) 1.0 was introduced in 2009 as a ground-up, mobility focused solution. VBN made it less expensive and simpler to securely connect remote users with the enterprise network at low cost and without changing the user experience.

VBN 2.0 goes one giant step farther by leveraging cloud services to do the job done by branch routers today - application acceleration, content security, remote access. Only it does so using a lower cost, more scalable solution that delivers a consistent user experience regardless of where you work: in the corporate HQ, in a branch office, from home, or on the road.

The cloud provides a massively scalable, economical way of delivering services and applications. It has changed the way we transfer data, download files, and use applications. When applied to branch networks, cloud services are the perfect tonic. They deliver essential business-critical services, without complexity, to widely distributed users at less than half the cost of the branch in-a-box router. This is one change you'll make and never, ever look back.

In my mind and in my branch,
We can't rewind it bought the ranch,
VBN killed the branch-in-a-box.

Read more about VBN 2.0 on-line.

The Lessons of Wi-Fi #14: Wi-Fi Should Save Money, Not Waste It

The computer science graduate students shuffle into class, taking their assigned seats. The professor opens the lesson by asking if there are any questions about the assigned reading.

A student raises her hand and asks, "We live in such a complex world. How could it possibly have been created in just 7 days." Without a moment's hesitation the professor looks up and responds, "Because there was no installed base – it was a new deployment."

Retrofitting 802.11n Wi-Fi to an existing network requires consideration of a number of factors: switch capacity, cable length, cable capacity, power sources. The last item is especially important during the transition to 802.11n. Many 802.11n access points far exceed the current capability of existing 802.3af Power-over-Ethernet (PoE) sources. Some require an astounding 32 Watts or more, far beyond the capabilities of 802.3af.

Unless you read the fine print in product data sheets you could find yourself exceeding the power delivery capabilities of both power sources and a single Ethernet cable. A Wi-Fi network that was supposed to reduce the cost of IT infrastructure by doing away with unneeded wired ports and switches could instead result in a whopping big bill to replace PoE infrastructure.

The Lessons of Wi-Fi #14: a Wi-Fi network should save money, not waste it. If you have to add supplemental power injectors, especially mid-span power sources, labor and hardware costs will soar. Power-hungry access points and high-current injectors also generate a lot of heat, so you'll incur higher recurring cooling costs. And your carbon footprint will grow.

Aruba's 802.11n access points operate from 802.3af power sources. Always have. In fact, we were the first company to introduce an 802.3af powered 3x3 MIMO access point. The access points also feature a lifetime warranty because the company stands behind what it builds.

As you consider an upgrade to 802.11n, be certain that 802.3af delivers sufficient current to power all of the radios to their full operating mode in every access point. If the data sheet says you need something other than a single 802.3af supply operating over 100m of cable to get full performance, consider yourself warned.

So check out our range of 802.11n access points and leave it to someone else to relearn the lessons of Wi-Fi.

The Lessons of Wi-Fi #12: Your Wi-Fi Network Should Not Be A One Trick Pony

Time was when you left work at the office. Those days are long gone. Enterprises and institutions with workforces, offices, or colleagues spread across time zones often have time- and location-shifted working conditions.

Users might need to work from home, on the road, or at a remote site. In all cases, a user will be most productive if the network experience - and access to applications and network resources - is the same remotely as it is at his or her desk at work.

Can the wireless LAN infrastructure that's used in a campus environment pull double duty and be used by remote users, too? The stock answer from most vendors is "nary the twain shall meet" - use a campus wireless LAN at work and a remote access solution like a virtual private network (VPN) everywhere else.

Since using a VPN is very different than accessing a campus network, this means that users need to be trained how and when to use the appropriate access method. And that means Help Desk calls. The end user is stuck with two parallel, non-intersecting networks to buy, maintain, and learn. Ouch!

The Lessons of Wi-Fi #12: your Wi-Fi network should not be a one-trick pony. One common network infrastructure should support both the campus wireless LAN and off-site users. And it should provide an identical end user experience regardless of how or where the network is accessed.

Enter Aruba's Virtual Branch Networking (VBN) technology. VBN uses low-cost Remote Access Points (RAPs) to securely connect remote users, and their Wi-Fi and wired Ethernet devices, back to a controller in the data center. The same controller that runs the campus Wi-Fi network.

Any standard Aruba indoor access point can be used as a RAP. That means one SKU can serve as both a campus AP or a Wi-Fi enabled remote access device for a home, branch office, or road warrior.

The $99 list price RAP-2 unit pictured here is small enough to fit in a shirt pocket or valise. It works with any IP-based devices - laptops, iPhone, iTouch, PCs, printers, wired and wireless voice over IP phones, wireless projectors - all of which can simultaneously share a single RAP. As can multiple users.

VBN features one-button installation so that a non-technical person can provision a RAP-2 by him or herself. No IT assistance, no user training required. Once commissioned the user just turns on his or her MacBook, PC, iTouch and they're instantly connected to the network...just as they would be on campus.

Data encryption and an integrated firewall provide comprehensive network security for all RAPs, while centralized management ensures speedy diagnostics and updates right over the network.

You don't have to suffer a double budget hit to get best-in-class campus Wi-Fi and secure remote access. So check out VBN and leave it to someone else to relearn the lessons of Wi-Fi.

The Lessons of Wi-Fi #11: Aesthetics Matter

If you walk around most any IT trade show, a harsh reality sinks in. While a lot of engineering goes in hardware and software design, spending is often miserly when it comes to packaging design.

Consumer companies hire world-class designers - or design firms like IDEO - to create products with rakish, timeless good looks. The resulting products fit well in virtually any decor.

Step into the enterprise market and things change. Evidently many enterprise vendors believe that function trumps form. Make a product function well and no one will care that it was hit with the ugly stick. Even if the products are intended for open display - on ceilings in Board Rooms, classrooms, branch offices.

The Lessons of Wi-Fi #11: aesthetics matter. Businesses and institutions spend fortunes, large and small, with architects and interior designers to ensure that their facilities are attractive. Every component that goes into a building - from fire sprinkler heads to smoke detectors to wiring devices - must pass muster. How could any IT vendor believe that the very same aesthetics standards don't also apply to IT gear. Especially publicly visible devices like Wi-Fi access points.

Visit an IT trade show and you'll see shoe-box sized APs, bristling with dark, leg-like antennas. And squat APs, disk-shaped like the calling card of a digital elephant. And bulbous APs shaped like a knight's helmet.

In the landscape of the ceiling, camouflage is paramount: a diminutive, sleek design with neutral colors and a shape that matches other ceiling fixtures fits in best. At Aruba we use world-class packaging designers to help our indoor access points blend into their surroundings. Our AP-105 Access Point is the smallest enterprise-class 802.11n AP on the market, and neutrally blends into any public environment. While its stellar performance calls attention to the product, its packaging does not.

You don't have to compromise aesthetics to get best-in-class Wi-Fi. So check out the AP-105, and leave it to someone else to relearn the lessons of Wi-Fi.

The Lessons of Wi-Fi #10: A Bad Tool Will Never Find A Good Network

You need a new Wi-Fi network for your school. The legacy system is a patchwork of consumer Wi-Fi gear and just can't handle your multi-media, throughput, and security requirements. Moreover the old network is a bear to manage because it doesn't provide any diagnostic information about the cause of increasingly frequent network outages.

One of the vendors you call in gives you a nifty sales pitch about their newfangled access points and even throws in a free network survey. When you ask about network management the sales person says they have a system that automatically discovers, configures, and monitors the whole wireless network, and can scale from single sites to cover the whole school district.

"But what if a problem originates in the wired network or in a mobile device? Or I want to manage the wired switches? How do I handle those scenarios?" you ask. All you draw in return is a blank stare.

The Lessons of Wi-Fi #10: to paraphrase a late13th century French proverb, mauvés hostill ne trovera ja bon network - a bad tool will never find a good network. Network management is really about optimizing operations management, about how to keep a network running 99.9999% of the time. Configuration and monitoring are only small pieces of the work that needs to be done.

Physicians train for hundreds and hundreds of hours to properly handle emergencies. Why? Because patients rarely die waiting for routine check-ups. It's in an emergency - when the stakes are high and time is very short - when they must prove their mettle. The same is true for network management tools.

Wireless networks don't work in isolation. Their operation depends on a wired core, closet switches, cabling, and the mobile devices with which they're associated. A fault could happen anywhere along this chain but "look" like it originated in the Wi-Fi network because that's where the problem first surfaced. A monitoring and diagnostics tool that only looks at the operation of the wireless network will stumble badly in this situation. And the consequence? Classes come to a halt, business stops, patients wait. Pretty bad.

Aruba's AirWave 7 tool is different. It's an operations solution that integrates the management of wireless networks, wired infrastructure, and client devices into a single interface. AirWave 7 provides a single point of visibility and control for the entire network edge, including wired and wireless infrastructure as well as individual client devices. In so doing, AirWave 7 reduces the cost and complexity of network management, while improving service quality for users.

A Mobile Device Management module gives IT managers control over mobile client devices from the same intuitive console they use to manage the network infrastructure. From a single console managers can supervise mobile devices, access points, controllers, and wired edge switches, including vital performance data, port utilization statistics and error data. By integrating monitoring of the wired and wireless infrastructure, the software facilitates faster and more accurate root-cause analysis.

And AirWave 7 is a multi-vendor tool. It works with Cisco and HP switches, among others, and supports wireless LANs made by more than 15 vendors, including Aruba, Cisco, HP, and Motorola. You're only out of luck if you own non-standard products or products from small niche vendors.

If you'd like to get the whole picture on network management you've only to visit the AirWave product site to see what real operations management can do for you. And leave it to someone else to relearn the lessons of Wi-Fi.