Assessing and improving SCADA security in the Dutch drinking water sector

Abstract

International studies have shown that information security for process control systems, in particular SCADA, is weak. Many of the critical infrastructure (CI) services critically depend on process control systems. Therefore, any vulnerability in the protection of process control systems in CI may result in serious consequences for citizens and society. In order to understand their sector-wide security posture, the drinking water sector in The Netherlands benchmarked the information security of their process control environment. Large differences in the individual security postures of the ten drinking water companies were found. Good Practices for SCADA security were developed based upon the benchmark results. This paper discusses the simple but effective approach taken to perform the benchmark, the way the results were reported to the drinking water companies, and the way in which the SCADA information security good practices were developed. Apart from some high-level indications of areas requiring more security attention, no actual security posture results are presented in this paper since the study data contain company and national sensitive information. For the same reason, the figures in this paper are based on artificial data.

Introduction

In the digital world, we want to be able to work securely. The right level of protection is the key to this. Certainly there is a need to investigate and prosecute cybercrime, but a reactive response alone is not the complete solution. Only when government, investigatory authorities, and the private sectors join forces and exchange information about new threats, society will be able to keep up with the cyber criminals. In 2006, the Dutch government and the private sectors took the first steps toward developing a successful strategy against cybercrime with the establishment of the National Infrastructure against Cybercrime programme (‘Nationale Infrastructuur ter bestrijding van Cybercrime’) or NICC³. The NICC embraced the principle of ‘learning by doing’. The NICC infrastructure consists of several components: a contact point, reporting unit, trend watching, monitoring and detection, information distribution, education, warning, development, knowledge sharing, surveillance, prevention, termination, and mitigation. The NICC further strengthens this infrastructure by hosting the Cybercrime Information Exchange, in which public and private organizations share sensitive information, and by developing and supporting practical projects and trials that both solve concrete problems and generate knowledge about cybercrime.

The Cybercrime Information Exchange information-sharing model is based on the one designed by the UK’s Centre for the Protection of National Infrastructure (CPNI). The NICC Information Exchange function can be pictured as a ‘flower’. The heart of the flower is made up of government bodies, like the police, intelligence services, GOVCERT.NL and the NICC itself. Critical infrastructure (CI) sectors and some other major industrial communities that heavily rely upon information and communication technologies (ICT) can be thought of being the petals of the flower. The different sectors chair their own ‘petal’, decide which parts of the meeting can be attended by the government bodies and decide upon which information is sharable outside their sector ‘petal’. The confidentiality of the information exchanged is governed by the set of protection and dissemination rules of the Traffic Light Protocol [1].

The current Dutch drinking water sector originates from extensive mergers of local municipally utilities. In 1952, The Netherlands society was serviced by 198 drinking water companies, a number that has reduced to ten companies by 2007 [2]. After 9/11 2001, the Dutch drinking water sector collaboratively undertook major efforts to increase the physical security of their drinking water plants and systems. When the NICC programme was established in 2006, the drinking water sector was one of the first CI sectors to sign up as a sector petal to address their ICT risk. One of the information security issues the sector put onto the NICC agenda concerns process control system/SCADA security. SCADA means Supervisory Control and Data Acquisition, a term which is used in this paper as an overarching term for all process control systems and networks that are used to monitor and control the intake of raw water, the purification process, the quality control process, and the transport and distribution process. Together with the NICC, the drinking water sector decided for a project that had to (1) investigate the current sector-wide state of SCADA information security, (2) analyze and report the results, and (3) develop a set of good practices which provides a sector-wide information security baseline for the SCADA/process control environment.

In Section 2, we discuss the development of a questionnaire that has been used to investigate the SCADA security posture of the ten companies comprising the Dutch drinking water sector. In Section 3, we highlight the analysis approach and the way the results were reported to the drinking water sector while maintaining anonymity. The individual company information and the sector-wide results are sensitive and classified. In Section 4, however, we are able to present a high level overview of the main areas of SCADA security concernsthat were identified in the Dutch drinking water sector. As requested by the drinking water sector NICC-petal, a SCADA Security Good Practices report has been developed addressing these security weaknesses. Its development is described in Section 5. Section 6 shortly discusses the use of the same questionnaire and method in other CI sectors. Section 7 contains the conclusions.