-: ICS and SCADA vulnerabilities.
So, at this point, we've talked about a couple of pieces
inside embedded systems,
and a lot of these things are going to be put together
into an ICS or SCADA network.
Now, before we dive into that,
let me first just take a step back and talk
about the type of technology we're talking about here.
Now, in general, we work in IT,
which is information technology.
That's our standard Windows computers, and networks,
and things like that.
But when we start talking about ICS and SCADA,
we are talking about OT, which is operational technology.
This is a communications network
that's designed to implement an industrial control system
rather than data networking.
So, here, we're really not talking about end-user machines.
We're not talking about having a Windows 10 host
sitting on this network.
Instead, with OT, we're talking about things
that's using technology and computers
to be able to do things in the physical world,
like open or shut a valve, like do manufacturing,
like create power generation in a power plant,
things like that.
So, if I look here, for instance, this is what OT looks like.
Usually, they look like big cabinets
with dials and gauges and buttons.
So, if I wanted to open or shut different valves
or turn on or off different pumps,
I would push the different buttons
on that diagram on the front of that cabinet,
instead of using something like a Windows machine
and using the command like, start, open valve, enter, right?
This is a different way of thinking.
Now, you can still have computers like Windows computers
that can talk to these networks
if you integrate the two, but you don't have to.
A lot of OT can just be done in a manufacturing plant
using systems like this.
Now, when we deal with industrial control systems,
these are going to prioritize availability
and integrity over confidentiality.
So, if we talk about the CIA triad normally in IT,
here, we're really talking about the AIC triad.
Availability is paramount.
And this makes sense if you think about it,
because OT was originally designed to do manufacturing,
and anytime the plant was down, we weren't making money.
So, for them, availability was everything.
Also, the plant didn't talk to the Internet, originally.
It was all within the borders of the plant.
And so, we had that physical boundary.
So, confidentiality wasn't as big of a deal
because we trusted the people working for us.
So, availability was much more important.
So, now that we've done an introduction
to operational technology, let's talk specifically
about three key areas.
I've already talked about the terms ICS and SCADA.
And we're also going to talk about Modbus.
Now, let's start with ICS.
ICS is an Industrial Control System.
When you hear ICS, this is essentially just a network
that manages embedded devices.
So, if I work in some place like an electrical power station
or a water supplier,
or I work in a hospital doing health services,
I might work in telecommunications in the backbones.
I might work in manufacturing, or in defense needs.
All of these things use ICS.
They all use this operational technology
using these Industrial Control Systems.
For instance, if you're driving a U.S. Navy warship,
there are a ton of ICS and SCADA systems on those things,
because you essentially have a power plant on board.
You have the engines on board,
and all that stuff is essentially a big manufacturing plant,
and it has similar components to that.
And so, those things all run on ICS and SCADA, as well.
Now, one of the things that ICS uses
is what's known as Fieldbus.
Fieldbus is a digital serial data communications
that are used in operational technology networks
to link different PLCs together.
So, we talked about those PLCs in a previous lesson, right?
I might have a PLC that opens and shuts this valve
to let more gas into the engine,
so that we can go faster on a ship, for instance.
Well, that is just one PLC, but I might have another PLC
that opens and shuts a breaker that allows electricity
to go to a different part of the ship.
And if I want to connect all those things together,
I need a way to do it.
And that's what we use Fieldbus for.
It's this digital serial data communications
that we use to link all these things together.
Now, another thing we have to be able to do
is we need to be able to talk to these machines
and tell them what to do.
And that's where we use an HMI: a Human Machine Interface.
This is the input and output controls on a PLC
that allows a user to configure and monitor the system.
So, when I'm trying to tell the system to do something,
like open a valve, I need a way to give it that input.
I can do that by pushing a button.
That could be a Human Machine Interface.
Or, I could open that valve on a touchscreen
by tapping it and saying open.
These are all different ways I can interface with it.
Now, ICS is all about managing process automation
by linking together these PLCs
using the Fieldbus to make changes in the physical world.
I want to open a valve. I want to start a motor.
Those kind of things.
Now, I, as a human, need to be able to see
what the machine is doing by reading gauges
or other screens,
and be able to give input into the machine
of what I want it to do,
by pushing buttons, turning knobs, entering keystrokes,
or even using a touchscreen.
So, for example, here if I worked in a hospital,
I might have a Human Machine Interface
that's a flat panel screen,
and I can touch it and tell it what I want to be done.
This way, this panel can then send the information
to that machine to do what it needs to do.
In this case, it's a radiography machine
that's going to take an X-Ray.
This also has PLCs connected to it, within a control loop.
And that whole process automation system
is governed by some kind of a control server.
This is how all this stuff ties together.
Now, one of the other things we have to think about
is having some way to know what all these systems
have done in the past,
because if we're doing an incident response,
we want to be able to figure all that out.
And so, as a cybersecurity analyst,
one of the things you want to look for is the data historian.
Now, the data historian is a software that aggregates
and catalogs data from multiple sources
within an industrial control system.
Now, again, as an analyst,
this is important for you to know
because if you're working in a place
that has an industrial control system,
you want to find out where the data historian is
and how you can use it,
because that's going to have valuable information for you.
All right, so now that we're done talking about ICS,
let's focus on the second part of this lesson,
which is all about SCADA.
SCADA is a Supervisory Control and Data Acquisition.
This is a type of industrial control system.
So, it's a type of ICS that manages large-scale, multi-site
devices and equipment spread over a geographic region.
So, when I'm talking about ICS, I'm looking at one plant.
When I talk about SCADA, I'm talking about multiple plants.
That's really the way I like to distinguish these two.
So, when you deal with SCADA,
this typically runs a software on ordinary computers
and it gathers data and manages it
across the different plant devices
and the different equipment that has embedded PLCs.
So, when you're dealing with SCADA,
it typically is going to use
some kind of a wide area network connection.
That could be cellular.
That could be microwave. That could be satellite.
Whatever you want to use.
And then, they're all going to link back
to those field devices, back to the central SCADA server.
So, I mentioned earlier, I have a smart meter on my house.
They don't have to come out once a month
and read my electrical meter to know how much to bill me.
Why don't they have to do that?
Because it's part of a SCADA network,
and all the houses in my area
are part of that SCADA network.
They have a cellular chip in there,
and it takes that reading once a month,
sends it back over cellular as a text message
or data format, whatever they use,
to their SCADA server,
collates that information, passes it to the billing system,
and then I get a bill.
That's how SCADA can be used in the real world.
Now, the third part of this
we need to talk about was Modbus.
Now, because ICS and SCADA
are really focused on operational technology,
they don't have to use things
that we'd only use in the IT world.
But they have to have a way to communicate with each other.
And Modbus is that way.
Modbus is a communications protocol
that's used in operational technology networks.
So, in our IT networks, what do we usually use?
TCP/IP, right?
Well, we don't have to use that inside these OT networks.
And often, we don't.
Modbus is instead what we use.
So, Modbus is going to give the control servers
and the SCADA host the ability to query
and change configurations of each PLC.
Now, this is important to know.
Because this is more of a proprietary protocol,
it looks different than TCP/IP.
So, if you're trying to do an incident response,
and you think somebody's in your ICS SCADA network,
and you've been studying how to do TCP/IP your entire life,
are you going to know what you're looking at?
Most likely not.
And that's why there are experts in ICS and SCADA systems.
Because it is a different way of thinking.
It is a different way of communicating,
and they use a different protocol.
So, keep that in mind.
If you're dealing with an ICS or SCADA network,
it is different and you have to follow
different ways of doing things,
because a lot of your normal tools that you would use
for ethernet and TCP/IP
either won't work or they could cause damage.