Elektronika 2009-11.pdf - Instytut Systemów Elektronicznych
Elektronika 2009-11.pdf - Instytut Systemów Elektronicznych
Elektronika 2009-11.pdf - Instytut Systemów Elektronicznych
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
Ontology-based approach to scada systems<br />
vulnerabilities representation for CIP<br />
(Podejście ontologiczne do reprezentacji podatności systemów scada<br />
dla ochrony infrastruktur krytycznych)<br />
dr inż. MICHAŁ CHORAŚ 1,3 , mgr inż. ANNA STACHOWICZ 1 , mgr inż. RAFAŁ KOZIK 1,3 ,<br />
mgr inż. ADAM FLIZIKOWSKI 1,3 , mgr inż. RAFAŁ RENK 1,2<br />
1 ITTI Sp. z o.o.<br />
2 Adam Mickiewicz University, Poznań<br />
3 Institute of Telecommunications, UT&LS, Bydgoszcz<br />
Critical Infrastructures are the organizations delivering goods<br />
and services in an economy that are fundamental to the functioning<br />
of society and the economy [1]. As for types of critical<br />
infrastructures, there are some domains within an economy<br />
that are considered crucial and most important. The loss of or<br />
disaster within a CI will affect a part or all society. Some of<br />
critical sectors described in [2] are agriculture and food, water,<br />
public health and defence.<br />
The INSPIRE Project focuses on telecommunication, energy<br />
and transportation sectors. CI are now identified and protected<br />
by national and international law and regulations<br />
(nationally in e.g. Poland by Ministry of Infrastructure in Crisis<br />
Management regulations [3]; internationally e.g. by NATO and<br />
by EU) [4-6]. Most of them are also intuitively recognized as<br />
critical by societies. Unfortunately, not all phenomenon and<br />
aspects within CI are well recognized. It is not possible to create<br />
mathematical equations fully describing CI - their functioning<br />
and dependencies. CI are nonlinear and chaotic: it<br />
means that small change may cause enormous effects (as in<br />
the butterfly effect). Even if we had equations describing CI,<br />
small increase or decrease of non-important tiny factors, could<br />
cause enormous change in the overall result [1].<br />
Complexity and wide range of critical infrastructures implies<br />
huge problems in their reliability and security. In dispersed<br />
critical infrastructures like electric power, water, railway<br />
or telecommunication sectors SCADA (Supervisory Control<br />
and Data Acquisition) systems are commonly used. SCADA is<br />
a monitoring, supervisory and controlling system with data acquisition<br />
from remote data fields. On the contrary to other control<br />
systems like for e.g. Distributed Control Systems (DCS),<br />
SCADA is intended especially to geographical dispersed systems.<br />
Control, measure and monitoring remote field data elements<br />
are provided by Remote Terminal Units (RTUs).<br />
Communication of RTUs with other SCADA components like<br />
Master Terminal Units, Operation Control Centres is provided<br />
by telecommunication network.<br />
Three generations of SCADA systems can be distinguished<br />
according to [7]:<br />
• 1 st generation - SCADA systems are monolithic and performed<br />
all computing functions themselves without connectivity<br />
with other systems;<br />
• 2 nd generation - SCADA systems are distributed, taking advantages<br />
of LocalArea Network, which connected multiple stations<br />
with different functions shared information in real-time;<br />
• 3 rd generation - it is extension of 2 nd generation in a way<br />
that system architecture became open, utilized open standards<br />
and protocols and connectivity of SCADA station and<br />
functions was moved from LAN to WAN.<br />
Nowadays most of SCADA development comply with 3 rd<br />
generation SCADA systems. SCADA systems have been designed<br />
without security considerations for many years. Nowadays,<br />
more and more SCADA systems have connections with<br />
business systems, corporate networks, which showed a risk,<br />
that unauthorized, unintended entities may have access to<br />
critical SCADA data information. The great benefit of integration,<br />
the communication between SCADA systems and corporate<br />
networks or Internet, which increase efficiency of<br />
business processes became a great risk and source of vulnerabilities.<br />
Therefore, there is an emerging need of identifying<br />
SCADA vulnerabilities and understanding interdependencies<br />
between them, especially these implied by SCADA systems<br />
interconnection with telecommunication infrastructures. In this<br />
paper we present an ontology-based approach to tackle this<br />
difficult task.<br />
Motivation to ontology-based approach<br />
Interoperation with different network technologies and various<br />
applications causes SCADA systems inherit typical network<br />
and application vulnerabilities. That is why security aspects in<br />
SCADA systems are not so different than in network security.<br />
One of the most important aspects in security are vulnerabilities.<br />
Vulnerabilities are the weak points in (SCADA) system<br />
components, which can be exploited by an attack. Definitions<br />
of vulnerability and threat according to ISO/IEC 13335-1:2004<br />
standard are as follows [8]:<br />
• vulnerability: “includes a weakness of an asset or group of<br />
assets which can be exploited by a threat”;<br />
• threat: “a potential cause of an unwanted incident which<br />
may result in harm to a system or organization”.<br />
Threats and attacks exploit vulnerabilities, so identification<br />
of vulnerabilities is a key aspect of security consideration and<br />
risk assessment. Known vulnerabilities can be fixed and potential<br />
attack can be prevented. There are several sources of<br />
vulnerabilities, for e.g. vulnerability repositories such as National<br />
Vulnerability Database (NVD) [9] or Open Source Vulnerability<br />
Database (OSVDB) [10]. However they do not<br />
express all security issues, their properties and relations. That<br />
is why we find ontology as a suitable tool for showing identified<br />
vulnerabilities as a classification and their connections<br />
with other security aspects like threats, attacks, SCADA resources<br />
and communication infrastructure [11]. Ontology is a<br />
form of knowledge representation in a form of data model that<br />
provides a decryption of domain and relations between domain<br />
concepts.<br />
ELEKTRONIKA 11/<strong>2009</strong> 35