Energy Sector's IT Networks in the Bulls-Eye

Stuxnet and Triton/Trisis may have forever shaken the naive sense of security in ICS/SCADA networks, but attackers meanwhile are quietly hammering away at the IT infrastructure of energy firms and utilities in their quest for valuable intelligence on industrial systems.

Recent attack activity tracked by security threat monitoring firm Vectra Networks of more than 4 million devices and systems shows that the IT networks in energy and utilities are being hit regularly by attackers intent on blending in as they conduct deep reconnaissance on their ultimate targets: the industrial networks. From January to June of this year, for every 10,000 host systems, nearly 200 remote access hacking attempts were spotted. In addition, some 314 lateral-movement activities were detected for every 10,000 host devices and cloud application operations. Vectra's data also shows nearly 300 data exfiltration actions per 10,000 host devices and cloud app operations.

Attackers targeting energy companies and utilities increasingly hit their IT networks with stealth tactics, such as employing legitimate Windows tools, too. Chris Morales, head of security analytics at Vectra, says attackers targeting energy and utility organizations are employing the same techniques against their IT infrastructures as nonutility businesses, including phishing and so-called "living off the land" methods of attack, in which they employ legitimate software tools, such as Microsoft PowerShell and Remote Desktop Protocol (RDP), to infiltrate their victims so that their network activity doesn't raise red flags.

"So much happens on [utilities'] IT systems and IT networks," Morales says. [Attackers] are using tools already there, like PowerShell, and hooking into Windows servers, and still using phishing to access credentials to get on those IT networks."

It's a wakeup call for energy firms to better monitor and protect their IT networks. It's also an opportunity to get ahead of attacks on their industrial networks and power generation. "If at least you know what they took on the IT side, you could still adapt [defenses] before they weaponize that," Morales says.

Eddie Habibi, founder and CEO of ICS security firm PAS Global, says his firm has seen how IT network hacks can ultimately can be used to harm the human machine interfaces (HMI) of machines in the industrial network side, for example. That can allow an attacker to corrupt databases, for example, he says, or block the ICS/SCADA operator's view of a manufacturing process.

But for attackers to truly disrupt or sabotage an industrial process, stealing operator credentials from the IT network isn't enough ammo. Hacking the operational technology (OT) network requires intel about the process control network, the systems installed, and other detailed information. "Exploits on the IT side creating a denial-of-service can easily [move] to the IT side of OT systems and process control. However, those attacks generally do not go beyond the IT layer," Habibi says.

That's because most of the attackers hacking at the IT networks aren't sophisticated enough to leverage that stolen data or systems to manipulate the OT network, he says.

Even so, a sophisticated and well-resourced attacker could control the process control network if he or she can get the detailed information of the OT network, including admin passwords, network names, and IP addresses, from an IT network hack, Habibi notes.

That type of deep intelligence-gathering appears to be driving the activity Vectra spotted in its research. "They're trying to get blueprints for all ICS systems, which happen to exist on Windows file shares," Morales says.

He notes how a utility system admin told Vectra the biggest thing on the firm's radar screen is suspicious or malicious use of its administrative servers, which are mostly older Windows 7 systems. "One thing he told us is that ICS 'doesn't keep me up at night,'" but rather, his IT network being attacked, Morales says.

Microsoft Active Directory (AD) servers are becoming a juicy target as a trove of user credential and server information. Attackers have been detected running scripts on the AD server as a way to keep a low profile. "They're sitting there instead of going box to box," Morales says. "They are trying to build a user list and a server list to know what's out there" on the victim network, he says.

Hydro Ottawa, the power distribution company for Ottawa, Canada, employs some continuous network monitoring of its ICS network to spot any anomalies that could indicate malicious activity. "It's really simple to monitor because the traffic is static," says Jojo Maalouf, the utility's manager, IT security. Any deviations are relatively simple to spot, he adds, and it avoids the issue of tampered logs by an attacker.

Blind Spot
Without a detailed, updated accounting of specific equipment, systems, and software (including versions) in the OT network, an energy or industrial firm is especially vulnerable to attack. And many of these organizations have only a snapshot of their infrastructures.

Take the case of a chemical company whose board of directors requested the CIO and CISO investigate whether its OT network was vulnerable to the Triton/Trisis attack that targeted the Schneider Triconex safety instrumentation system. "Two weeks later, four of its sites said they had the same [vulnerable] Triconex system ... But [then another] two weeks later, four more plants said they had it," Habibi says. In the end, it turned out there were Triconex systems at all 12 of its manufacturing sites.

"The first step to mitigate risk is to identify the risk," he says.

Hydro Ottawa's Maalouf says his firm takes a governance approach as well. "As we are deploying systems or solutions .... what does it look like from an IT perspective? From a cybersecurity perspective? What requirements do we want to define? Do you understand what the network topology looks like, the threat landscape?" he says.

The utility uses a threat risk assessment to define its major threats and its critical areas are, and how to mitigate attacks. "We do a lot of that, with continuous improvements" to the process, he says.

There's also the usual layered security setup with firewalls, access control, segmentation, identity management, and antivirus measures. "If you have complete inventory of sensors, controllers, and HMI ... and regularly check for vulnerabilities in those systems plus implement change management, you've gone a long way in protecting your systems and assets," Maalouf says.

Related Content:

Black Hat Europe returns to London Dec 3-6 2018  with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.