-: Premise System Vulnerabilities.
In this lesson, we are going to talk about premise systems.
Now, what is a premise system?
Well, a premise system is a system used
for building automation and physical access security.
And these are a different type of network, as well.
Oftentimes, you'll have this as a third network
in your organization.
When you're dealing with this and you go to your front door
of your building and you try to get in
and use your card and your PIN,
that has to go through some kind of an access control system.
That is a premise system, right?
That is physical access security.
If I look at the security cameras,
those are part of your premise system, as well.
Now, when we deal with a premise system,
a lot of these system designs
are going to allow for monitoring to be available
across the corporate data network
or even directly from the Internet.
And this is really great from a monitoring perspective.
It makes it really easy for us.
But this is also dangerous, right?
Because when we have a connection
to the corporate data network,
that means someone can hack into your premise network.
They can cross over into your data network.
And if you connect directly to the Internet,
that might give them a way in to that premise network.
So, these are things you have to think about
when you're dealing with security.
Now, in addition to this,
we also have building automation systems.
Now, building automation systems,
they have components and protocols
that facilitate the centralized configuration
and monitoring of your different mechanical
and electrical systems within offices or data centers.
Now, oftentimes, you're not going to be controlling
the actual power generation, right?
That will be ICS and SCADA.
But you are going to have other ways to look at the information
inside your building through these automation systems.
For instance, at our offices,
we have a battery back-up system.
This is a whole building system so that if we lose power,
we have that battery that can kick in
and support us for about 24 hours.
Now, we have the ability to log in to that battery remotely
over the Internet
so we can see exactly how much battery is left,
how quickly our burn rate is, and things of that nature.
If you're in a bigger building, you might have elevators
and you want to be able to figure out
where the elevator is at any given time.
If you've watched any spy movie,
I'm sure you've seen the idea of building automation systems
where they turn on and off the AC,
usually they turn on and off the elevators
or turn on and off the lights to a particular floor.
That's what a building automation system really is.
Now, when you start dealing
with all these building automation systems,
they have lots of different parts
that could bring up vulnerabilities to your network.
So, again, I like to keep these
as their own segmented network
but when we start covering these vulnerabilities,
we have things like the process and memory vulnerabilities
inside the PLCs
because these building automations are going to use PLCs.
If you're going to control elevators and lighting
and water and fire mains and power,
all of those things do have PLCs that you can control
within your building.
Then, we have to think about how we're going to keep
our credentials safe because oftentimes,
these things have poor security management.
A lot of times, people write their code
with plain text credentials or keys
inside the application code.
That way, they'll say my password is password
and they'll put it right in the code
and that could be exploited by an attacker.
Another thing I often see occur
is code injections against the web user interface.
A lot of these building automation systems,
the way that they are monitored,
is through a web interface,
whether locally or over the Internet.
So, if there is web interface presented,
that means an attacker could access that
and then do a code injection,
doing something like an XML injection, an SQL injection,
a cross site scripting injection, something like that.
And so, you got to keep that in mind.
This is an area that could allow
for somebody to get into that network
and then control your building.
Now, one of the things we really have to worry about
with these premise systems and building automation systems
is that they can be used to create
a denial of service condition in the real world.
Now, what do I mean by that?
Well, let's say I got a hold
of your building automation system
and I was able to do a code injection
to take access over it.
I could create a denial of service condition for you
that could affect your entire building
by turning off your HVAC, which is your air conditioner.
And if you have a server farm
and I take away your air conditioner,
that can overheat the systems and cause them to shut down.
Now, I have caused an electronic attack
against your servers by doing a physical attack
by taking away your cooling.
These are the things you have to think about.
Another reason to worry about these systems
is often, they're not well-secured.
If you think back to 2015, there was a big case
of this in the news with Target.
Target is a big retail chain in the United States.
And they actually had one of their contractors
who ran their HVAC systems,
their systems had gotten hacked.
And somebody went through their systems
through the HVAC at the Target stores
and then down into the point of sale systems,
the cash registers, and started collecting credit card data.
This was a huge breach and it was huge black eye
for the corporation.
So, remember, these building automation systems
could be used as an intrusion vector
as somebody wants to pivot from that
into a more dangerous attack against your corporate network.
So, you have to make sure the right protection's in place.
Now, the final thing I want to talk about in this lesson
is the idea of PACS,
which is the Physical Access Control System.
Now, the Physical Access Control System
is all of the components and protocols
that facilitate the centralized configuration
and monitoring of security mechanisms
within offices and data centers.
So, when we start talking about all the security cameras
and the access control to badge in and badge out
of your building,
that is all part of your Physical Access Control Systems.
Now, PACS can either be implemented
as part of your building automation system
or as part of a separate system.
Either way will work.
It just depends on how your contractor sets it up
or how your organization sets it up.
Now, one word of warning here.
PACS are often installed and maintained
by a third-party external supplier
and because of that, a lot of times, people omit that
from their risk analysis or their vulnerability assessments.
So, as you're starting to think about your networks
and you think okay, I've got this Windows network here,
I've got the server farm here,
I might have this OT over here,
they don't think about the building network itself
because it's some third-party contract.
So, that's okay if you're going to exclude it from your scope
if you have that in writing that that is part
of their responsibilities.
And they will probably have some kind of requirement
to give you every quarter, every six months, every year,
some kind of a vulnerability statement
of what the network looks like because again,
you can outsource the task
but you can't outsource the responsibility.
If their network is tied to your network in any way
and there's a vulnerability in their network,
that means the attacker could get from them to you,
just like they did with Target.
So, keep that in mind.