The dark side of remote access to ICS/SCADA systems
You have probably experienced, too, how convenient it is to connect to industrial systems from the comfort of your own armchair at home.
Some people may think that using software such as TeamViewer or Microsoft RDP, or even connecting to the SCADA system’s web management page through an Internet browser, is a correct and safe practice.
They may not know, however, that the risks linked to remote access have been responsible for 80% of all breaches of IT systems.
What is remote access?
Remote access is the set of hardware and software that makes it possible to access computers or networks that are physically far apart.
When remote access is used
There are cases in which remote access is very convenient, and others in which it is necessary:
- Support on devices supplied by the manufacturer
- Support on software present in the systems
- Urgent changes to the plant’s operating parameters
- Supervision by the end customer
Continuous support from the supplier is necessary for real-time verification that components and software are working correctly.
It proves very useful, instead, for updating software and making minor changes to configurations.
How do you interact with the systems?
Before going back to read about and understand the problems and risks of remote access, it is worth knowing how IT and OT systems are configured.
There are several ways of interacting with the devices in the ICS chain (SCADA, SIS, PLC, RTU, etc.):
- Web interface of the devices (through a browser)
- Application (desktop or mobile)
- Command line (SSH, Telnet, etc.)
The maintenance technician or support team uses these tools to interact with the machine systems and make the necessary changes, whether to solve problems or for normal interaction with the systems, such as changing the speed of a motor, opening or closing a valve and so on.
What are the risks?
Thanks to remote access systems, a plant can be reached through a variety of devices (PCs, laptops, smartphones, etc.), including many outside the organisation’s control.
The remote environment in which these devices are used can bring risks.
For example:
- lack of physical security controls, creating a risk of the device being lost or stolen
- interception while information travels over the public Internet
- unauthorised access to systems or data
- monitoring and manipulation of data if someone gains access to the device
Direct access with Port Forwarding
ICS devices are almost always connected to a router/firewall that allows or denies their access to the Internet. These systems can therefore open connections towards the Internet, but not the other way round unless further configuration is done.
By configuring Port Forwarding it is possible to expose a service of the device – such as its web configuration page – directly to the Internet.
Why not expose services?
Configuring Port Forwarding is a terrible idea!
Such vulnerabilities can easily be detected through specialised search engines such as Shodan.io (we could call it the hackers’ Google) or through scans of active services.
Many protocols – such as Microsoft RDP – have known vulnerabilities, while others are attacked with Brute Force methods.
Exposed services often keep their default passwords or require no authentication at all.
In other cases the vulnerability lies in the means of interacting with the device: configuration through a web interface is much more convenient than the old command line, but it brings with it all the vulnerabilities of browsers.
Attacked devices do not always directly damage the system they are connected to.
Often botnets are installed on them, used for large-scale DDoS (Distributed Denial Of Service) attacks such as Mirai.
Is it a good idea to use TeamViewer or similar systems?
Here too you could run into very serious security problems!
TeamViewer is a very attractive tool in the eyes of a malicious actor, who, once access is obtained, is able to administer the entire PC or system.
It is software to be used only at the request of a support team and not left running all the time, remembering always to update to the latest available version.
Solutions for secure remote access
How can ICS/SCADA plants be controlled remotely? How can support on plants be given or received remotely?
Industrial firewalls
It is important to choose next-generation firewalls of the industrial type, able to recognise protocols such as Modbus, Profibus, 104, etc. Then use the UTM features (such as IPS, ATP, etc.) to protect against any vulnerabilities in the systems.
Enterprise-grade VPN clients
Use VPN client software able to ensure robust encryption of the connection. Only when the VPN is enabled is it then possible to use remote control software such as TeamViewer in LAN mode.
Enterprise-grade VPN client software can guarantee that the PCs being used to connect are free of malware and vulnerabilities that could be carried into the target plant.
Multi-factor authentication
In addition, to prevent unauthorised access, two-factor authentication systems can be used, entrusting security to more than a simple password.
You have surely used tokens, apps or codes sent by SMS to access your bank’s website. It would be desirable to use these methods to access production systems.
Someone will surely say that “the token is a pain!”, but would you agree today to access your bank account by simply entering a username and password? Better an extra step than seeing your account at zero!
Limit access to the necessary systems
It is very important to give different credentials to the different people who connect to the systems, and it is essential to assign the right privileges according to the resources they actually need to consult.
Conclusions
Choosing today not to allow remote access to industrial systems is anachronistic and economically unwise. Choosing to allow it with due care and by following the simple guidelines described in this article could be even more economically advantageous!
