Kibernetska sigurnost procesnih upravljačkih sustava temeljenih na PCVue SCADA sučelju

master's thesis

• Title (english): Cyber security of process control systems based on PCVue SCADA
• Author: Filip Katulić
• Mentor: Damir Sumina (mentor)
• Committee member: Damir Sumina (predsjednik povjerenstva)
• Committee member: Igor Erceg (član povjerenstva)
• Committee member: Martina Kutija (član povjerenstva)
• Granter: University of Zagreb; Faculty of Electrical Engineering and Computing; Zagreb
• Defense date and country: 2021-07-02, Croatia
• Scientific / art field, discipline and subdiscipline: TECHNICAL SCIENCES; Electrical Engineering

Abstract

Unutar ovog rada napravljeno je eksperimentalno industrijsko postrojenje za pročišćavanje vode temeljeno na PcVue SCADA sučelju te industrijskom komunikacijskom protokolu Modbus TCP. Nakon implementacije eksperimentalnog postrojenja za pročišćavanje vode, provedena je analiza sigurnosti industrijskog komunikacijskog protokola Modbus TCP te proces analize rizika postrojenja temeljen na normi IEC 62443. Rezultatima analize rizika definirane su kritične ranjivosti eksperimentalnog postrojenja te su u nastavku istraživanja pruženi prijedlozi za rješavanje navedenih ranjivosti, s posebnim naglaskom na tehničke mjere za dostizanje željene razine štićenja. Politike i procedure unutar postrojenja temelje se na normama IEC 62443-2-1: Zahtjevi upravljačkog sustava sigurnosti IACS-a te IEC 62443-2-3: Upravljanje zakrpama unutar sustava IACS-a, dok se tehničke mjere temelje na normi IEC TR 62443-3-1: Sigurnosne tehnologije za IACS sustave. Kao prvi izdvojeni tehnički alat za povećanje sigurnosti postrojenja predstavila se implementacija upravljivog preklopnika s postavkama podešenim u svrhu povećanja kibernetske sigurnosti SuC-a. Drugi istaknuti alat jest sustav za detekciju upada u komunikacijski sustav (IDS) pomoću kojeg je moguće uz ispravno podešavanje ispuniti dio zahtjeva za kibernetsku sigurnost predstavljenih normom IEC 62443-3-3:2020. Svojstva svakog od tehničkih alata implementiranih unutar postrojenja ispitana su kroz provedbu jednostavnih napada kod napadača na mreži. U konačnici, dan je osvrt na provedenu analizu, metode za povećanje sigurnosti te izvještaj o specifikaciji sigurnosnih zahtjeva (CRS).

Abstract (english)

In this paper, an experimental industry plant for water purification was created based on the PcVue SCADA interface and the Modbus TCP industrial communication protocol. After implementing the experimental water purification industry plant, an analysis of the Modbus TCP industrial communication protocol security was conducted, as well as the process of risk analysis of the plant on the basis of the IEC 62443 Standard. The results of the risk analysis define critical vulnerabilities of the experimental plant, and in the later parts of the research there is a list of suggested solutions for the given vulnerabilities, paying special attention to the technical measures needed to achieve the desired protection level. The policies and procedures within the plant are based on the Standard IEC 62443-2-1: Establishing an industrial automation and control system security program, and the Standard IEC TR 62443-2-3: Patch management in the IACS environment, while the technical measures are based on the IEC TR 62443-3-1: Security technologies for IACS systems. As the first technical tool used to increase the plant's security, the implementation of the managed switch with settings adjusted in order to increase cybernetic security of SuC is pointed out. Another tool which stands out is the intrusion detection system (IDS) for the communication system, which enables meeting the requirements of cybersecurity presented in the Standard IEC 62443-3-3:2020, if adjusted correctly. The features of each of the technical tools implemented in the plant were assessed by carrying out simple attacks of attackers located within SuC perimeter. The final part of the paper consists of a review of the conducted analysis, methods for increasing security and a report on the security requirements specifications (CRS).

• Keywords: Kibernetska sigurnost; Analiza kibernetskog rizika; Norma IEC 62443; Industrijski upravljački sustavi (IACS); IT te OT sustavi; Postrojenje za pročišćavanje vode; Industrijski komunikacijski protokol Modbus TCP; PcVue SCADA; Programirljivi logički kontroler (PLC) S7-1500; Sustav za detekciju upada u komunikacijski sustav (IDS) Security Onion; Upravljivi preklopnik
• Keywords (english): Industrial automation and control systems (IACS) cybersecurity; Cyber risk analysis; IEC 62443 Standard; IT and OT systems; Water purification facility; Modbus TCP industrial communication protocol; PcVue SCADA; Programmable logical controller (PLC) S7-1500; Security Onion intrusion detection system (IDS); Managed switch
• Language: croatian
• URN:NBN: urn:nbn:hr:168:509636
• Study programme: Title: Electrical Engineering and Information Technology; Study programme type: university; Study level: graduate; Academic / professional title: magistar/magistra inženjer/inženjerka elektrotehnike i informacijske tehnologije (magistar/magistra inženjer/inženjerka elektrotehnike i informacijske tehnologije)
• Type of resource: Text
• File origin: Born digital
• Access conditions: Closed access
• Created on: 2023-01-13 15:16:37