5 June 2017

“By now the ‘Air gapping’ myth should be expunged from every ICS/SCADA manager on earth.” I really like this statement from Daniel Cohen-Sason, published on 23 May 2017 in the CYBERBIT blog.

From my point of view, the ‘Air Gap’ era ended with the introduction of portable engineering stations about 30 years ago.

Modern OT networks are often designed on the basis of the ISA 95 Standard with network zones and security devices, e.g. firewalls, to control the communications flow between the process control and SCADA systems across the zones. Modern production requires a lot of Machine-to-Machine (M2M) communication between the production networks zones and between the production network and the business network. Besides this M2M communication Human-to-Machine (H2M) communication is required, e.g. for operator access from the business network and for remote maintenance.

For M2M and H2M interaction communication channels must be opened on the firewalls. With this, there is always a chance that malware can spread across such required connections. Furthermore, cyber attackers can gain access, e.g. through remotely exploitable vulnerabilities, after they hijacked a M2M communications endpoint in the business network. We dealt with this very effectively in the past 20 years.

Many of the required connections use the SMB protocol for exchange of data. That’s no problem per se. The problem is, that we still use Windows 7 and Windows Server 2008 in the manufacturing industry which cannot work with the latest versions of the SMB protocol for data exchange.

Since WannaCry exploited a vulnerability in SMB version 1.0, it was only a matter of time before WannaCry would find its way across a required connection from the business network to the production network.

How to deal with the problem?

• Priority patching.

The systems at the border between the business network and the production network must me patched with highest priority. Although this is somewhat tricky to achieve in WSUS, it’s worth to deal with this WSUS feature. In addition to the operating system components, all application components must be patched as well. The same applies to Linux based systems.

• Deactivating SMB.

Is a great means in the case of an emergency, and part of a long-term data exchange strategy.

• Set up asset and vulnerability management.

At least all systems at the endpoints of required M2M and H2M connections must be included. This enables you to evaluate the scale of the problem in the case of a new vulnerability.

• Faster innovation cycles.

At least for the systems at the perimeter of the production network we must allow for shorter innovation cycles. With Windows 8, Windows 10, and Windows Server 2012, new versions of the SMB protocol are used which are not affected by WannaCry. Don’t forget to deactivate the SMB V1.0 compatibility in the this versions.

This includes the technology used for data exchange. For example, the widely used Robocopy fosters the spreading of WannaCry because it is based on the SMB protocol.

• Increase the level of isolation.

Start with challenging the required M2M and H2M connections. Eliminate every connection without a business purpose. For the remaining, check whether the best available security technology is used.

Take care!