- In 10.6, we're gonna take a close look
at embedded systems.
Now, an embedded system is an electronic product
that contains a microprocessor
and software designed to perform a specific task.
Now, an embedded system
can either be fixed or it can be programmable
and embedded system applications have a wide range
from digital watches and microwaves
to hybrid vehicles and avionics.
And I think this is a fascinating statistic.
It's estimated that 98% of all microprocessors
manufactured are actually used in embedded systems.
So we think about the fact
that our PCs, our laptops, our desktops, you know,
proliferate all over the world, but in fact, right,
they're way, way outnumbered by embedded systems.
So let's look at some examples
of commercial embedded systems
in the medical field of vehicles, aircraft,
and smart meters.
In the medical field,
medical devices such as our digital flow sensors.
MRI, and CT scanners, sonography, wearables,
as well as biomedical applications to monitor patients
and to support telemedicine.
All use embedded systems.
Vehicles, things like adaptive cruise control,
airbags, telematics traction control,
emission control systems, parking systems,
navigation, collision sensors, climate control,
even our antilock braking systems.
In our aircraft,
temperature control, speed control sensors,
flight management systems, flight data recorders
and engine controls.
And smart meters, you know,
the energy use, consumption, integration and billing.
We are just surrounded by microprocessors
and embedded systems.
So we're gonna look through different types
of embedded systems, starting
with industrial embedded systems, and specifically looking
at industrial control systems and supervisory control
and data acquisition systems known as SCADA.
Now, I did introduce you to this type of system
earlier on when we talked about architecture
but now we're gonna dive in a little bit deeper.
So our industrial control systems or ICSs
are gonna be embedded systems that monitor
and control industrial processes that exist
in the physical world.
Now, ICSs can either be data-driven
or they can be operated remotely.
Our SCADA systems, supervisory control and data acquisition.
SCADA usually refers to a centralized ICS
or industrial control system, which monitor
very complex systems that are spread out over large areas.
So electricity, natural gas, gasoline,
water, waste treatment, transportation.
Top threats to our SCADA systems really include cyber attack
by politically motivated adversaries on one hand,
and then human error on the other.
And our big concern in terms of vulnerabilities
with the SCADA system is how long their life has to be,
which I mentioned to you before.
So we end up with serious vulnerabilities included
in outdated operating systems,
lack of or weak authentication mechanisms,
minimal visibility for monitoring.
And because they always have to be operating,
very limited maintenance windows.
An embedded system
generally has three closed loop components.
The first is an SoC that stands
for System-on-a-Chip, which is a microprocessor
or microcontroller with advanced peripherals, such as WiFi.
Second is a realtime operating system
or RTOS that defines the way the system works.
And third is the application software that is specific
to the device.
So three components, SoC, System-on-a-Chip
RTOS, the real-time operating system
and then the specific application software.
Now we do have some issues or some vulnerabilities
with specifically components of the embedded system,
the System-on-a-Chip, and the real-time operating system.
Generally, the chips are really inexpensive
and the profit margins are slim.
So what we find on those chips
is that there's little incentive
to maintain them or to update the chip firmware,
which means they can easily go out of date, right?
Vulnerabilities will be identified but not fixed.
And then there are a number of vulnerabilities
in the RTOS, the real-time operating system.
First, there's this very strong incentive
to use open source operating systems.
Now the RTOS may become outdated
and often patches are not available.
And even if they are available,
the expertise to install them is rare.
So we really wanna keep our eye on, you know,
what kind of chips are being used
and what is the operating system.
Now there are a whole host of embedded system attacks.
Network attack, active side channel,
memory and bus attacks, weak authentication,
and a steppingstone.
A network attack just exploits the protocol
or the implementation of the embedded system.
An active side channel attack uses a voltage glitch
on the power supply to cause a program malfunction.
Memory and bus attacks
are really when we're physically connecting
to the hardware and reading the contents of the memory.
When I say "we," I really mean the adversary.
Weak authentication, well that's using the known default
administrative password to gain access
because they come with a default password.
And what do we know about default passwords?
We know we can easily find them out on the internet
so we never wanna be using those default passwords.
However, there may be some situations
where that default password is hard coded
and you don't even have the opportunity to change it.
And very often, authentication
will have just single password.
And so the system might be subject to a brute force attack.
And then lastly, steppingstone.
Embedded devices such as HVAC systems, printers
multifunction devices and camera systems are often connected
to the network kind of in an unmanaged way.
We just put these devices on our network
but we're not really thinking about the security of them.
And so our adversaries can exploit those devices,
those embedded systems that aren't really being managed
and use them as a stepping stone
or a way to pivot to more secure systems.
So what's the best way to secure our embedded devices?
Well, we've got some best practices.
The best practices include researching our supply chain
including our chip manufacturer and operating system
researching available security controls
for the embedded system,
immediately change the default credentials
if that's a possibility.
Implement strong authentication controls.
Let's try to move away from just a single password.
Disable unneeded features and services,
that's our principle of least functionality.
We wanna disable clear text Telnet login.
Telnet is often used for managing devices remotely
but we don't wanna use Telnet.
Its login is clear text
and actually, it's full transmission of clear text.
And instead, we wanna use Secure Shell or SSH.
We wanna restrict remote access to devices
as much as possible,
so they can't be used as a stepping stone.
And of course, we definitely, definitely want to keep
our devices in our vulnerability management programs.
We wanna include them
in that vulnerability management program.
Now, if you're interested in exploring more
about embedded systems, I've got a option for you.
The Raspberry Pi is a series
of small single-board Linux embedded systems
that were developed by the Raspberry Pi Foundation.
And you can learn more about the foundation
at www.raspberrypi. that's P-I, not P-I-E, dot org.
To promote the teaching of basic computer science.
So you can go out there
and you can see all of the different options they have.
You can buy these small single-board Linux embedded systems.
They do all kinds of really cool things with them
and they're inexpensive and they're just a lot
of fun to play with.
So if you're thinking, I'd love to get my hands
on an embedded system and see how they really work,
go out to the Raspberry Pi site and just explore it,
you know and maybe purchase a couple of devices
and play with them.
All right, that my friends,
brings us to a three-second challenge
Five challenge questions, three seconds each.
You know how to do this.
The first one, contains a microprocessor
and software designed to perform a specific task.
One, two, three.
That's gonna be an embedded system.
Number two, a microprocessor with advanced peripherals.
One, two, three.
That's gonna be an SoC, a System-on-a-Chip.
Number three, an embedded system that monitors
and controls industrial processes.
One, two, three.
That's an industrial control system, or ICS.
Number four, a centralized ICS system
which monitors complex systems, spread out over large areas.
One, two, three.
That's gonna be our SCADA systems.
And lastly, number five,
a cryptographic telnet replacement.
I went over this really quickly.
So we don't wanna use Telnet, it's clear text.
It's very basic authentication.
What should you be using instead?
Hopefully you caught it.
One, two, three.
SSH or Secure Shell
which we'll be talking a lot more about
a little bit later on.
All right, that brings us to a security-in-action
so we can apply our knowledge,
and this one's about a SCADA system.
You work for a small gas and oil company.
The current SCADA system is 20 years old
and has never been upgraded.
You've been asked to brief the board of directors
on potential vulnerabilities
and why an investment in upgrading the system is critical.
So what are you gonna tell them?
Okay, so quick recap.
You're working for this small oil and gas company,
you've got a SCADA system, it's 20 years old,
it's never ever been upgraded.
That make you nervous?
Hmm, I think it should.
Okay, go ahead and put me on pause.
Write down some notes
about what are you gonna tell the board of directors
about potential vulnerabilities and why investment
in upgrading the system is so very critical.
All right, well here's what you might tell them.
A 20-year-old operating system is way past
both end of life for features and functionality, right?
So it's considered obsolete and end of support.
So no more support, no more patches.
The known and published vulnerabilities and exploits
with no new patches are being developed, right?
We know our adversaries are still looking closely
at those older systems, especially SCADA systems
which are such a high value target.
So they're going out there and they're finding, right,
these new vulnerabilities, they're publishing
they're sharing them, they're developing exploits.
But on the other side, we have no protection
because no new patches are being developed.
There's no new functionality, right?
So we're working with functionality
from 20 years ago.
And there's minimal, if any,
probably support for the current controls.
So we can't do multi-factor authentication
we're stuck with maybe single factor authentication.
Probably can't do any automated monitoring.
And we probably have very minimal options on reporting.
And then we wanna remind the board that the SCADA systems
have been increasingly become cyber targets
by politically motivated adversaries
and by cyber terrorists.
And there's a tendency to think,
"Well, I'm just a small company,
they're not gonna come after me."
But that's really a fallacy.
You know, they're gonna come after small companies
just like large companies.
They wanna cause fear, they wanna cause disruption, right?
They wanna, you know, introduce mayhem into the system
and you can do that regardless of the size of the company.
So having this conversation, having them understand
why a 20-year-old system really is vulnerable
and how the organization could easily be a target
of a cyber adversary,
that's a such an important conversation to have
and to be able to do it confidently.
That's what I want you to do.
And well, you know it is, right?
It's definitely security in action.
There you go.
There's your word cloud.
Not particularly big, but I wanna make sure
that you know everything on that word cloud
before you move on to our next lesson.
And when you're ready, I'll see you there.