Sourcefire: attacks against SCADA-based systems just the start

The recent attacks against SCADA systems can be a wake-up call to the managers of in-house process controls.

According to Dominic Storey, EMEA technical director at Sourcefire, process control security should come under IT's remit. “One technology doesn't grasp what percentage control nodes at the moment are within the business, you just should inspect a significant organisation to peer how malware gets in,” he said.

This week saw attacks against SCADA-based systems in Illinois and Houston, and Storey said they were the start of a trend.

He said: “The thermal stress caused the wear [to the water pump within the first attack]; it's something we discuss when customers deploy intrusion prevention systems (IPS). It cannot determine a sophisticated persistent threat (APT) as, once it's in, it's largely useless, in order that is where intrusion detection systems (IDS) helps through anomaly detection analysis.”

Storey predicted a "perfect storm" as there's no best practice for connecting network security layers for SCADA-based systems. “There isn't any way of searching for connected sensors or what came from a sensor,” he said.

“Also, call to mind SCADA as a hardware system, nine times out of ten that's an old Windows system, so often there are vulnerabilities. Technology has to be proactive and ready to take action.”

Asked what administrators can do to guard themselves against attacks to SCADA systems, Storey said they must allow an IDS to define how to write rules; he also claimed that ‘Snort' is ideal for this.

He said: “Focus on protecting, know what the devices are and feature a back-up plan if you can't detect something with a rule. Prepare you will have a practical solution. many people reflect on SCADA as power and water, but think of a manufacturer like Heinz, Guinness or DHL; if their system breaks down or is compromised, it's a huge issue.”

Storey said learn how to think about SCADA was because the "third network" after the info centre and office automation. He said: “This isn't the end of the road for this, we are able to see more power outage, however it will take a huge brand to be hit for it to be taken seriously.”