(in my best accent)Now click on recommendations

“No Recommended Practices Identified”

Suprising, perhaps even shocking. It seems like this would be the first item to be completed. If nothing else, why not a link to NISSC Good Practice Guide on Firewall Deployment for SCADA and Process Control Networks.

Now click on Associated Attack Methodologies

We get:
- SQL Injection Attack
- OPC/DCOM
- Back Door Attack Through Internet
- Man in the Middle Attack

So now I’m confused. These attack methodologies are what the “control system firewall” are supposed to mitigate. Or are they ways of penetrating or bypassing the node we clicked on? I assume the latter.

I’m not sure what “man in the middle attack” is doing here or why. But IMHO, MITM (or “monkey in the middle” as I’ve heard some folks call it) is one of the most often cited but least important attacks one should be concerned about, based on my experience analyzing and conducting them against protocols.

In many SCADA protocols you don’t have to get “in the middle” you just send the command to the endpoint!

But I’ll agree they “sound” scary. And I’m torn about the value of adding “SCADA Plugins” to Ettercap

Now on each of the attacks. There is an image file and a PDF. The image file is a lot more interesting and shows how the attacks happen (with lots of red arrows). I would link to them but they are using frames and JavaScript to pull up the docs, so it isn’t worth the time.

Some other observations about the “Secure Architecture Design” page:

- The links to the “control system” and “corporate firewall” and “firewall” are exactly the same.
- There are blue dots for IDS everywhere, but I didn’t ever find any content for them. Given that is one area where commercial security products have actually made some progress, I thought that might be mentioned.
- Many of the control system components have no “attack methodologies.” For example the PLC/IED/RTU.

Despite all these nits, I think this site has been sorely needed and there is good content here, even if the presentation is sometimes “eye candy.” This also took a lot of work to pull off. I don’t want to think how many hours of web development alone. I hope it continues to be developed and fleshed out.

I also really like the idea of a clickable architecture document with threats and countermeasures and rumor is my friends back at Cisco are working on some cool threat modeling tool written in ruby on rails but I haven’t seen it yet.