Elektronika 2009-11.pdf - Instytut Systemów Elektronicznych

Ontology-based approach to scada systems
vulnerabilities representation for CIP
(Podejście ontologiczne do reprezentacji podatności systemów scada
dla ochrony infrastruktur krytycznych)
dr inż. MICHAŁ CHORAŚ 1,3 , mgr inż. ANNA STACHOWICZ 1 , mgr inż. RAFAŁ KOZIK 1,3 ,
mgr inż. ADAM FLIZIKOWSKI 1,3 , mgr inż. RAFAŁ RENK 1,2
1 ITTI Sp. z o.o.
2 Adam Mickiewicz University, Poznań
3 Institute of Telecommunications, UT&LS, Bydgoszcz
Critical Infrastructures are the organizations delivering goods
and services in an economy that are fundamental to the functioning
of society and the economy [1]. As for types of critical
infrastructures, there are some domains within an economy
that are considered crucial and most important. The loss of or
disaster within a CI will affect a part or all society. Some of
critical sectors described in [2] are agriculture and food, water,
public health and defence.
The INSPIRE Project focuses on telecommunication, energy
and transportation sectors. CI are now identified and protected
by national and international law and regulations
(nationally in e.g. Poland by Ministry of Infrastructure in Crisis
Management regulations [3]; internationally e.g. by NATO and
by EU) [4-6]. Most of them are also intuitively recognized as
critical by societies. Unfortunately, not all phenomenon and
aspects within CI are well recognized. It is not possible to create
mathematical equations fully describing CI - their functioning
and dependencies. CI are nonlinear and chaotic: it
means that small change may cause enormous effects (as in
the butterfly effect). Even if we had equations describing CI,
small increase or decrease of non-important tiny factors, could
cause enormous change in the overall result [1].
Complexity and wide range of critical infrastructures implies
huge problems in their reliability and security. In dispersed
critical infrastructures like electric power, water, railway
or telecommunication sectors SCADA (Supervisory Control
and Data Acquisition) systems are commonly used. SCADA is
a monitoring, supervisory and controlling system with data acquisition
from remote data fields. On the contrary to other control
systems like for e.g. Distributed Control Systems (DCS),
SCADA is intended especially to geographical dispersed systems.
Control, measure and monitoring remote field data elements
are provided by Remote Terminal Units (RTUs).
Communication of RTUs with other SCADA components like
Master Terminal Units, Operation Control Centres is provided
by telecommunication network.
Three generations of SCADA systems can be distinguished
according to [7]:
• 1 st generation - SCADA systems are monolithic and performed
all computing functions themselves without connectivity
with other systems;
• 2 nd generation - SCADA systems are distributed, taking advantages
of LocalArea Network, which connected multiple stations
with different functions shared information in real-time;
• 3 rd generation - it is extension of 2 nd generation in a way
that system architecture became open, utilized open standards
and protocols and connectivity of SCADA station and
functions was moved from LAN to WAN.
Nowadays most of SCADA development comply with 3 rd
generation SCADA systems. SCADA systems have been designed
without security considerations for many years. Nowadays,
more and more SCADA systems have connections with
business systems, corporate networks, which showed a risk,
that unauthorized, unintended entities may have access to
critical SCADA data information. The great benefit of integration,
the communication between SCADA systems and corporate
networks or Internet, which increase efficiency of
business processes became a great risk and source of vulnerabilities.
Therefore, there is an emerging need of identifying
SCADA vulnerabilities and understanding interdependencies
between them, especially these implied by SCADA systems
interconnection with telecommunication infrastructures. In this
paper we present an ontology-based approach to tackle this
difficult task.
Motivation to ontology-based approach
Interoperation with different network technologies and various
applications causes SCADA systems inherit typical network
and application vulnerabilities. That is why security aspects in
SCADA systems are not so different than in network security.
One of the most important aspects in security are vulnerabilities.
Vulnerabilities are the weak points in (SCADA) system
components, which can be exploited by an attack. Definitions
of vulnerability and threat according to ISO/IEC 13335-1:2004
standard are as follows [8]:
• vulnerability: “includes a weakness of an asset or group of
assets which can be exploited by a threat”;
• threat: “a potential cause of an unwanted incident which
may result in harm to a system or organization”.
Threats and attacks exploit vulnerabilities, so identification
of vulnerabilities is a key aspect of security consideration and
risk assessment. Known vulnerabilities can be fixed and potential
attack can be prevented. There are several sources of
vulnerabilities, for e.g. vulnerability repositories such as National
Vulnerability Database (NVD) [9] or Open Source Vulnerability
Database (OSVDB) [10]. However they do not
express all security issues, their properties and relations. That
is why we find ontology as a suitable tool for showing identified
vulnerabilities as a classification and their connections
with other security aspects like threats, attacks, SCADA resources
and communication infrastructure [11]. Ontology is a
form of knowledge representation in a form of data model that
provides a decryption of domain and relations between domain
concepts.
ELEKTRONIKA 11/2009 35