CMU5XX-INFOSEC

Information Security for Industry

Session 2: Cyber-Physical Systems & Critical Infrastructure

James Williams

jwilliams@staff.newman.ac.uk

Learning Objectives

  • Define Cyber-Physical Systems (CPS) and their role in modern industry.
  • Differentiate Information Technology (IT) from Operational Technology (OT).
  • Analyze the architecture and vulnerabilities of ICS and SCADA systems.
  • Deconstruct historic attacks against critical infrastructure (Stuxnet, Colonial Pipeline).
  • Evaluate the Purdue Model for ICS network segmentation.

Seminar Structure (3 Hours)

Part 1: The IT/OT Convergence (1.5 hrs)
  • Understanding IT vs OT Priorities
  • ICS and SCADA Fundamentals
  • Task 1: IT/OT Priority Mapping
Part 2: Securing Critical Infrastructure (1.5 hrs)
  • The Purdue Enterprise Reference Architecture
  • Real-World Case Studies (Stuxnet)
  • Task 2: SCADA Risk Assessment

Part 1: The IT/OT Convergence

Duration: 1.5 Hours

Cyber-Physical Systems (CPS)

Systems where computer algorithms control or monitor physical entities.

  • Includes smart grids, autonomous automobile systems, medical monitoring, and industrial robotics.
  • The Stakes: If a corporate web server crashes, a company loses money. If a Cyber-Physical System crashes (e.g., a power plant cooling system), people can die.
  • The physical impact changes the entire security paradigm.

IT vs OT Priorities

Operational Technology (OT) manages industrial operations. Its priorities directly conflict with standard IT security.

  • IT Priority: Confidentiality > Integrity > Availability. (It is better to lock the system down than let data leak).
  • OT Priority: Availability > Integrity > Confidentiality. (A factory line must never stop running, even if the data is unencrypted).
  • The Conflict: An IT admin pushes a mandatory Windows Update to an OT terminal, causing it to reboot. The reboot halts a chemical mixing process, ruining a $5M batch of product.

ICS and SCADA

The systems controlling the world's infrastructure.

  • ICS (Industrial Control Systems): The broad term for systems controlling physical processes (manufacturing, energy, water).
  • SCADA (Supervisory Control and Data Acquisition): A subset of ICS used to control geographically dispersed assets (e.g., an oil pipeline stretching 1,000 miles).
  • PLCs (Programmable Logic Controllers): The actual ruggedized microcomputers that flip the physical switches and read the sensor data.

Introduction to Task 1

Bridging the cultural and technical gap between IT security teams and Plant Floor engineers is critical to securing modern infrastructure.

We will analyze how standard IT security controls fail when applied to OT environments.

Task 1: IT/OT Priority Mapping

Timing: 45 minutes

A new CISO at a water treatment facility mandates that all computers, including the SCADA terminals on the plant floor, must adhere to the standard IT security policy.

  1. The policy requires Complex Passwords that expire every 30 days. Explain why this is dangerous for a SCADA terminal controlling a water valve in an emergency.
  2. The policy requires Automated Vulnerability Scanning (Nessus) every Friday. Explain the technical risk this poses to legacy PLCs.
  3. Propose two compensating controls that improve the security of the OT environment without violating the priority of Availability.

15 Minute Break

Please return promptly for Part 2.

Part 2: Securing Critical Infrastructure

Duration: 1.5 Hours

The Purdue Model

The industry standard for ICS network segmentation (ISA/IEC 62443).

  • Level 4 & 5 (Enterprise): Corporate IT network (Email, ERP).
  • Level 3.5 (IDMZ): The Industrial DMZ. The critical barrier between IT and OT.
  • Level 3 (Operations): SCADA servers and historian databases.
  • Level 1 & 2 (Control): PLCs, HMIs (Human Machine Interfaces).
  • Level 0 (Process): The physical sensors, motors, and valves.
Rule: No direct communication is allowed between Level 4 and Level 3. It must pass through the IDMZ.

Case Study: Stuxnet (2010)

The first true cyber-weapon. Targeted Iranian nuclear centrifuges.

  • The Air-Gap Bypass: The facility was disconnected from the internet. Stuxnet spread via infected USB drives dropped in the parking lot.
  • The Zero-Days: Used four separate Windows zero-day exploits to traverse the corporate network to the Siemens Step7 SCADA software.
  • The Physical Impact: It subtly changed the rotor speeds of the centrifuges while sending fake "normal" telemetry data back to the monitors, physically destroying the equipment without alerting operators.

Case Study: Colonial Pipeline (2021)

A ransomware attack that caused panic-buying of gasoline across the US East Coast.

  • The Vector: Attackers gained entry via an old, inactive VPN account that did not have Multi-Factor Authentication (MFA) enabled.
  • The Convergence Failure: The ransomware only hit the IT network (billing and enterprise). However, the company shut down the OT network (the physical pipeline) because they couldn't bill customers for the gas being delivered.
  • Proves that a failure in IT can completely halt OT operations due to business logic dependencies.

Introduction to Task 2

Securing Critical Infrastructure requires thinking about worst-case physical scenarios and designing fail-safes that work even when the digital systems are completely compromised.

We will conduct a high-level risk assessment for a vulnerable manufacturing environment.

Task 2: SCADA Risk Assessment

Timing: 50 minutes

You are auditing a power generation plant. You discover that the engineers frequently use TeamViewer on their home laptops to remotely access the Level 3 SCADA terminal to monitor turbine efficiency.

  1. Based on the Purdue Model, explain exactly why this architecture is a critical security violation.
  2. Describe the potential physical impact if a malicious actor compromised an engineer's home laptop and gained access to that SCADA terminal.
  3. Propose a secure architectural redesign using an Industrial DMZ (IDMZ) and jump servers to allow remote monitoring without direct OT access.
Practical Resource: CISA Industrial Control Systems Guidance

Summary & Next Steps

  • IT focuses on data; OT focuses on physics. Security policies must respect this distinction.
  • Air-gaps are rarely truly disconnected. Robust network segmentation (Purdue Model) is the only reliable defense for critical infrastructure.
Next Week: Information Security Policies & Procedures