Security Monitoring in Production Areas

Teses de mestrado, Segurança Informática, 2022, Universidade de Lisboa, Faculdade de CiênciasSince the late 1960s, a different set of technologies has been designed and implemented in parallel to assist in automating industrial and manufacturing processes. These systems, created parallel to IT (Information Technologies), became known as OT (Operational Technologies). Unlike IT technologies, these were developed with a different set of requirements. With a focus on resilience to adverse environmental conditions – such as temperature, humidity, and electromagnetic interference – and a need for high availability and near-real-time performance, these technologies took a back seat to other requirements. Such as information integrity and confidentiality. However, the need to automate processes has developed. Today, it is not only industrial areas – such as heavy manufacturing, oil and gas industries, electrical networks, water distribution processes, or sewage treatment – that need to increase their efficiency. The production areas of a manufacturing company also benefit from these two types of technologies – IT and OT. Furthermore, it is on the shop floor – i.e., in a production area – that the two meet and merge and interconnect the two networks to become a blended system. Often the requirements for the operation of one technology are the weak point of the other. A good example is an increasing need for IT devices to connect to the Internet. On the other hand, OT devices that often have inherent difficulty with authentication and authorization processes are exposed to untrusted networks. In recent years, and aggravated by the socio-political changes in the world, incidents in industrial and production areas have become larger and more frequent. As the impact of incidents in these areas has the potential to be immense, companies and government organizations are increasingly willing to implement measures to defend them. For information security, this is fertile ground for developing new methodologies or experimenting and validating existing ones. This master’s work aims to apply a threat model in the context of a production area, thus obtaining a set of the most relevant threats. With the starting point of these threats, the applicability and value of two security monitoring solutions for production areas will be analyzed. In this dissertation’s first part, and after reviewing state-of-the-art with the result of identifying the most mentioned security measures for industrial and manufacturing areas, a contextualization of what a production area will be performed—followed by an example, based on what was observed in the course of this work. After giving this background, a threat model will be created using a STRIDE methodology for identifying and classifying potential threats and using the DREAD methodology for risk assessment. The presentation of an attack tree will show how the identified threats can be linked to achieving the goal of disrupting a production area. After this, a study will be made on which security measures mentioned initially best mitigate the threats identified. In the final part, the two solutions will be analyzed with the functionalities of detecting connected devices and their vulnerabilities and monitoring and identifying security events using network traffic observed in an actual production area. This observation aims to verify the practical value of these tools in mitigating the threats mentioned above. During this work, a set of lessons learned were identified, which are presented as recommendations in a separate chapter