SCADA stands for Supervisory Control and Data Acquisition
System.
You may also see this referred to as Industrial Control
Systems, or ICS.
SCADA systems are large pieces of equipment, usually used
in manufacturing or in power distribution.
And we need some way to connect all of these devices
together so that you can control them from one central location.
And that's when we find a SCADA network.
It's a distributed control system.
There's real-time access to all of these systems.
And it allows for centralized control
of all of these very large industrial systems.
When you're talking about a SCADA system that
manages our power infrastructure,
there are some significant national security concerns.
And that's why most of the time you'll
see all of these SCADA systems around their own private
segmented network.
Normally there's no access to a SCADA network
if you're on the internet or somewhere outside
of that immediate network.
There's usually tight controls and a lot of security
to keep people away from these SCADA networks.
We've seen an increase in the number of available smart
devices that you can wear.
These wearable technologies might be smartwatches or health
monitors.
Since these devices are connected to you,
some of these devices will track exactly where
you happen to be during the day, the real question you might
have from a security perspective is where
is that information stored, and who has access
to all of that information?
We have similar concerns with what
we call the Internet of Things, that is, home automation
devices that we are connecting now to the internet.
We have video doorbells, garage door openers, our heating
and cooling systems, and almost everything in our home
is becoming connected to the internet.
These Internet of Things devices know when we're home,
they know when we're not home.
And if somebody does gain access to those systems,
they potentially can gain access to your entire house.
If somebody calls you with a question about the HVAC system,
they're referring to the heating, ventilation,
and air conditioning system.
These are usually very large and very complex
systems that are installed in large enterprises.
The HVAC infrastructure that's put
into these large installations is not
something that can be easily designed.
Normally you need an expert in thermodynamics in HVAC systems
to be able to properly design and implement such a system.
These HVAC systems aren't just standalone units,
they're integrated with other components
in the infrastructure.
For example, it's common to network
an HVAC system with the fire alarm system.
That way if a fire alarm does go off,
the HVAC system will not provide additional oxygen
to help feed the fire.
You can limit the impact of a fire
just by integrating those systems together.
There is usually a centralized PC or system
that manages all of these HVAC units.
This is not something that people commonly think about
from a security perspective.
But if someone did want to create a Denial of Service
situation, they simply need to turn off the air conditioning
or turn off the heating and make the temperature
in the building so uncomfortable that no one would
be able to stay and work.
One popular embedded system these days
is the System on a Chip, or the SoC.
A System on a Chip is one where most
of the activities for that particular system
take place inside of a single piece of silicon.
There is usually supporting devices around that chip,
but the chip is really handling the main focus
of the processing.
These SoC devices are usually a very small form factor.
Take for example this Raspberry Pi 2.
This Broadcom chip in the middle is the System on a Chip.
Everything else on this particular device
is an interface that gets you to the network USB interfaces,
or an HDMI video interface.
When all of the major components are collapsed down
into a single chip, it becomes difficult to provide
any type of security patches.
If you do need to upgrade or change this component,
it usually means that you will be replacing
the entire piece of hardware.
Here's a close up view of a System on a Chip.
This is the Raspberry Pi 3.
You can see this Broadcom BCM 2837
is the System on a Chip that is really controlling everything
about this Raspberry Pi.
The only other major component you see on this device
is this additional controller unit
for the USB and the ethernet interfaces.
Everything else on this particular device
is all done inside the System on a Chip.
A Real-Time Operating System, or RTOS,
is an operating system where the processes
running are deterministic.
That means there are certain processes in this operating
system that are guaranteed to be processed
in a particular amount of time.
We often see a Real-Time operating system
used on devices like industrial equipment and automobiles.
A good example of this is when you
need to break very quickly to avoid something in the road,
you don't want to have the processing system of your car
have to wait on another process to finish before it will begin
hitting your anti-lock brakes.
For example, if you hit the anti-lock brakes in your car,
you would like those brakes to engage immediately.
You don't want some other process occurring in the card
to take priority over those breaks.
The Real-Time operating system ensures
that those breaks will always be available
the instant you press them.
These are Real-Time operating systems are usually managing
a relatively important process.
These are nontrivial systems that
always need to be available.
And that's why security is so important with a Real-Time
operating system, you don't want something
to embed itself in the system and prevent
one of those Real-Time processes from being able to engage.
These days we'll often find connected to our networks
these devices called multifunction devices, or MFDs.
These are devices that aren't just a printer,
they're also providing scanning and faxing capabilities
all in one single unit.
Because of the complexities involved
in being able to manage all of these different types
of services, the firmware and operating system
that's running in these devices is relatively sophisticated.
But these devices can also be security concerns.
For example, if someone scans information
on one of these multifunction devices,
the image is often saved locally in the memory of that device.
That means somebody who does want
to retrieve that image could access that machine
and potentially gain information that they normally would not
have access to.
The same could be said for the faxes that
are sent from this device, since most of these devices
will initially scan the pages before sending them out
as fax images.
Those surveillance cameras that we use
are also embedded systems.
These are the cameras that we use for video monitoring
and security surveillance.
In most cases, these cameras are connecting back
to a central video recorder, and very often, we're
able to access that video recorder using an application
and communicating to it via TCP/IP.
Not only is the recorder an IP addressable device,
these days, the cameras themselves
communicate via TCP/IP.
So if someone was able to gain access
to these IP connected systems, they
would also be able to surveil your property
and know exactly when you were home, when you were not home,
and knew exactly what type of security
you would have in place at your facility.
We often see embedded systems used
for medical purposes, things like heart monitors and insulin
pumps.
And even if we don't have direct access to the operating
system in these devices, there's still
a security concern, especially given the importance
of these medical devices.
There are more and more embedded systems being
added to our vehicles as well.
Our cars and our trucks now have systems
that can be accessed external from the car,
allowing someone with the right type of access
to not only be able to see what's happening with that car,
but to be able to control the components inside the vehicle,
as well.
Some security proof of concepts have even
found that it's possible to control and disengage
the engine in these devices, all from someone
who's located far away from the actual car.
And there's also embedded systems inside
of these flying devices, these aircrafts and UAVs,
these Unmanned Aerial Vehicles.
These UAVs and the cameras attached to them
provide some amazing pictures from the sky.
But if someone does perform a Denial of Service
to this device, it's one that could fall out of the sky
and potentially be a danger to the people on the ground.