Industrial VAPT

The value of VAPT in OT

The aim of a penetration test is to illustrate as clearly as possible what the consequences of a certain issue with your cybersecurity could be, and what that would mean to your organization. For example, the risk that an IT security incident, like ransomware, could also affect the OT network, threat actors breaking into the OT network to access the intellectual property, supply chain risks caused by remote vendor connectivity, or the potential impact of a cyber-physical attack.

VAPT provides insight into the current cyber resilience of the IT and/or OT networks for these kinds of threats and if improvements might be required. Secura records the outcomes of the VAPT test in a clear report with a concise management summary, an extensive risk analysis for each outcome, and recommendations on a strategic, tactical, and operational level. The results of the assessment can be used to take steps to close security gaps and reduce the risk in your organization.

VAPT in the Industrial Sector

Within industrial environments, many critical business processes depend on OT. Networks with Industrial Controls Systems (ICS) such as DCS, PLC’s and SCADA systems manage and automate critical processes. Still, the enterprise’s IT services are just as important for daily operations. Moreover, due to the convergence of IT and OT and Industry 4.0-initiatives, the dependency between these two environments is also increasing. A successful business depends on reliable systems in both IT and OT; therefore, VAPT testing is important for all these systems. Different technologies are used across these environments, and it is collectively known that OT systems might not be resilient against VAPT scans. It is obvious that each area requires a different approach.

Secura’s approach in VAPT for OT

Our specific VAPT approach in the OT environment depends on which levels are in scope from the Purdue levels.

The Purdue Model

According to the Purdue model, a typical OT network consists of different levels:

Purdue Level 2 & 3

Generally, systems that reside in Purdue levels 2 and 3 (Area Supervisory and Site Operations, respectively) are based on generic IT components. Depending on the criticality of each system, we can use more or less intrusive methods. The question is often to test how resilient the systems and network are against targeted attacks. In these levels, systems may also use OT-specific protocols, like Modbus, DNP3, IEC-101/104, CIP Ethernet/IP, etc., to communicate to each other and to systems in the lower Purdue models. It is also not uncommon within OT environments that custom applications or solutions are installed on this level that might add an attack surface. The ultimate question is whether a hacker can move laterally over the network and to the deeper levels of the system.

In the penetration test stage, we try to exploit vulnerabilities in the system configurations, installed (custom) applications, weak IT protocols like FTP, Telnet, HTTP, and SNMP, and insecure industrial protocols. The goal is to gain access to engineering workstations, SCADA databases, or human-machine interfaces to investigate if we could influence the process.

Purdue Level 0 & 1

In level 1 (Basic control) and level 0 (Process), we will not use any intrusive methods unless it is specifically requested, for example, when the system could also be operated manually or is not in active use due to a scheduled maintenance period. Often, the question is whether an attacker can manipulate signals or measurements or carry out a cyber-physical attack, especially when this level might also contain safety systems (SIS). It is also possible to research if these lower levels (that might be installed in unmanned remote locations) can provide access to higher levels of the OT network and maybe even the IT environment.

In these levels, most of the communication is performed via OT-specific protocols, of which many are insecure. Some examples are, Modbus-TCP, Fieldbus, Profibus, HART, and many more, including vendor-proprietary protocols.

On request, we could, as part of the penetration test, investigate the possible vulnerabilities in these levels as well. We will try to exploit vulnerabilities in the used communication protocols, potential vulnerabilities in the controller’s or device firmware, or abuse weaknesses in the device configuration.

Connectivity

Finally, all these components are connected via network devices such as switches, routers, firewalls, and even wireless access points. On top of that, it is also common that a lot of protocol and media converters are used in OT environments, like RS-232/RS-485 to Ethernet or Copper to Optical Fiber converters. All these intelligent devices generate additional attack surfaces. Therefore, network configuration and segmentation are crucial and a good focus area for our VAPT service. These devices are resilient for these types of scans and will be included in the scope of regular vulnerability scans and tests.

During the penetration test, we try to abuse weaknesses in the configuration of these devices or exploit potential vulnerabilities in the firmware to gain access to the infrastructure layer. If succeeded, it becomes easier to attack other network parts, manipulate network traffic to influence the process, or eavesdrop on unencrypted communication.

• Level 0 – Process
  This level contains devices that physically interact with the process. For example, field instruments, variable frequency drives (VDF), pumps, motors, actuators, and robotics.

• Level 1 – Basic Control
  This level contains the controllers that interact with the field instruments and actuators. For example, DCS and Safety controllers, Programmable Logic Controllers (PLC), and Remote Terminal Units (RTU).

• Level 2 – Area Supervisory
  This level contains the devices used to monitor or interact with the controllers. For example, Human Machine Interfaces (HMI), Engineering workstations (EWS), and OPC data collectors.

• Level 3 – Site Operations and Controls
  This level contains a system to support site-wide operations, maintenance, and optimizations. For example, data historians, I/O servers, and more generic security services for the OT environment like Domain Controllers, backup servers, and patch & AV distribution servers.