As a cybersecurity analyst,
a lot of times we have to deal with different
aspects of our environment that are critical in nature.
Critical infrastructure is one of those things that we're really
going to play if you're attributed to different it,
technologies that are outside the norm,
meaning that we're not just dealing with
windows servers or different routers or switches.
It's more with water departments or power departments or
different aspects that are in the public nature.
That's what we're going to cover in today's episode.
We're going to cover critical infrastructure, operational technology,
which coincides with critical infrastructure, industrial control systems or I CS
and finally SCADA or
Sada, depending on where you are in the world,
supervisory control and data acquisition systems.
It's important to know as you're going through these different episodes that this
aspect isn't necessarily something you may not see throughout your entire career.
But cys A requires that you have a basic understanding
of it as you move through the different exam objectives.
Critical infrastructure encompasses operational technology,
industrial control systems, of course,
ad CS and PL CS.
All this comes into play when we're looking
at critical infrastructure as a whole remember,
critical infrastructure is literally the
public facing infrastructure that we utilize
within our own government.
This is where if something were to go bad, the entire public faces a problem with it.
Or since the colonial,
the pipeline that we saw a while back was a lockdown of the
entire natural gas line or the gas line that was associated with it,
providing a problem within our communities on the east coast of the United States.
This was an attack against a critical infrastructure. Those pipelines provided
needed energy resources to the public at large.
And the FBI and major federal agencies were involved
to clear that up as quickly as possible.
When it comes to critical infrastructure.
All you really need to know as far as CYS A is concerned is that it has to
deal with public facing technologies that serve the greater
government or the greater good for the people.
Operational technology is the hardware and
software associated with that critical infrastructure.
These are usually the control boards or
the control systems that allow those pipelines
or those water companies to operate in which the ways in which they do.
Now,
there's different subsets of operational technology that
we will go into a little bit.
But what you really need to know about operational technology
is that it's the control systems that manage everything.
For instance, if I want the electric company,
I may have a control system that is specific to
the engineering of the electrical company or the electrical grid.
If I'm in the water company, I may have a different control system,
but it's all considered operational technology at that public facing series.
That could be oil gas, it could be hospital, it could be electrical,
it could be plumbing and water.
The bows are endless.
It's still part of that critical infrastructure
that we talked about industrial control systems.
Take it one step further.
This is the real time control or operation of those public facing works.
This is real time control and integrated into the sensors and actuators.
When we talked about colonial pipeline and how it affected.
We were talking about energy,
move from one point to another and the it systems that are associated with it
when it comes to operational technology more often than not.
We're talking about the actual control boards at a higher level.
If you look at a hierarchy,
those operational technologies,
maybe they face the interface between the it world
and the critical infrastructure,
the
CS, the industrial control systems.
That's where the real control comes into play outside of our normal it environment.
This is where we develop real control systems. That interface outside of
OT encompasses all of CS that really comes
into play how OT interacts with their is systems
with the integrated sensors and actuators.
We're really providing the access to those different
levers or mechanical functionality of those public works.
For instance, I want a water pipe opened.
I would go through the OT system to access the CS system.
And the CS system is what turns the little
to allow the water to flow.
If I want the water to stop,
I can again go through the OT system to interface with the CS system,
which then makes the flow stop.
This is where the interconnected systems come into play.
Now, I can have CS systems that interact with other
CS systems depending on how my network is laid out.
But a lot of times I want to put a clear
eliminator between what has online access and what does not.
A lot of times those ot systems that we talked
about earlier while they may be connected to the internet,
they're not truly connected to the internet.
That means that yes, you can access them,
but you're going through a critical it
system that is blocked off from everything else
and allows only someone with authorized authenticated user
privileges to interface with those it systems.
Those systems are then firewalled off and encapsulated in
such a way to make it highly secure,
but they're not 100% invulnerable as we
saw in the colonial pipeline ransomware attack.
We also know that ics
systems use a specialized communication.
We're not talking about basic binary that you see on a computer system.
It's not unusual to have ics systems talking in a way or
a function that isn't normal for regular computers to talk on.
Believe it or not. That's a security safeguard. We don't want our ics
systems to be able to talk by a Windows system
just connects to it
nilly.
It needs to have specialized communication protocols that
come into play so that your average everyday
user can interconnect with it and make it do things that it's not supposed to do
by having that specialized communication system in place.
We limit the vulnerabilities associated with the I CS
system through standard communication protocols.
We also might update those systems
on other pathways.
It's not unwise or unusual to have your
specialized communication only available through floppy drives.
If you're familiar with nuclear power plants,
a lot of those nuclear power plants don't actually take uh C DS or even blueray disk.
In fact, if you want to update the software on those systems,
you need a five and a quarter or a 3.5 inch floppy drive
and we don't even make those anymore.
But that's how they
to those systems and they refuse to upgrade those systems
because we don't want people to be able to access those
systems through regular means by keeping that system down to
a 3.5 inch drive or five and a quarter drive.
Even though it doesn't possess all the data
infrastructure that we see in modern communication,
we limit the attack vectors associated with their I CS systems
that a malicious actor may be able to utilize
the supervisory control and data acquisition,
Sada or Sata depending on where you're from,
provides those limited supervisory control over specific user machines.
What do I mean by that?
It's not uncommon to have a big machine that you interact with that
may have a lever or a limited functionality for pin or code utilization.
We provide data acquisitions back into our I CS machines through Scott
Thiss
Scada device then allows the human to interact with it
by either punching in a code maybe switching a live
or even providing limited remote access to it.
When you think about ot and then I CS realize that
SCADA or SKA
is really the man machine interface that interacts with it.
This data acquisition and supervisor control system allows
for things like power plants to remain operational,
utilizing older technology that would
n not be available to most people.
It's not uncommon to have a Scott A system that literally looks like it was
from the 19 nineties or even 19 eighties because it hasn't been updated that often.
And again,
we use that as a security safeguard against normal malicious attack
vectors that we may see on a day to day basis.
We also provide limited very limited remote access.
This is usually via command-line interface using
a proprietary software that allows somebody to access
that software or that machine interface device in such a manner to where again,
you have a very limited capabilities of it.
If I wanted, for instance to shut down an entire gas line for emergency control.
Then yes, I might write that into the code that allows me to have remote access.
However,
I would have to have a secure mechanism in place to
limit the availability for a malicious actor to get into play.
Be able to use that.
Now, within the colonial pipeline,
we saw that Scott was taken advantage of through a
known vulnerability that the malware was able to get into.
But they didn't really into the remote
access.
What they really did was provide a ransomware
which locked them out of the main systems.
For understanding how those systems react and the data flow within them.
They didn't really get into the scot A system.
They got into the controlling hierarchy system
that allowed them to see the data and then lock it out.
If you really look at it, the colonial pipeline was fine,
it just couldn't be operated because all the higher level systems and the
high point of the hierarchy were locked down because of a ransomware attack.
Within this episode,
we talked about critical infrastructure and how it interacted
with operations technology and again with industrial control systems.
And finally, the supervisory control and data acquisition systems,
it's important to understand you only need to have a high
level overview of what these systems represent and how they're utilized.
I would expect to see systems or questions that interface with
if the power plant is associated with a known attack.
Where does that ly into the overall infrastructure of the
operational system? Obviously, that would be a critical infrastructure.
I would not expect to see questions that relate back
to a specific control system or a make and model.
And I would not expect to see a lot of questions that go
into pure detail of a specific
technology when associated with critical infrastructure.
A lot of the questions that you're going to see really relate back to the high
level overview of what is critical infrastructure and
how does it interplay with different utility companies?
If you can answer most of those questions, you should be fine within this episode.