Вы находитесь на странице: 1из 110

Schneider Electric

36

Schneider Electric
Schneider Electric .

,
Schneider Electric ,
, .
,

,
Schneider Electric.
,

, ,
, ,
.

.
.


, ,
.
,

,

36

36, 2011 .




,
, .
, , ,
/System Technical
Note (STN).
STN .

STN
: ,
, , .
,
: System Technical Guide (STG) /
/ System Technical Note (STN) / /.
(STN)
.
:
.

,
. ,
, ,

STG STN . ,
STN,
STG.


PlantStruxure
,


.

Schneider Electric

36


1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
1.1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
1.2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
1.3. ? . . . . . . . . . . . . . . . . . . . . . . . . . . 5

2. -? . . . . . . . . . . . . . . . . . . . . . . 6
2.1. - . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
2.2. . . . . . . . . . . . . . . . . 7
2.3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
2.4. . . . . . . . . . . . . . . . . . . . . . . . . . . 14

3. -
. . . . . . . . . . . . . . . . . . . 30
3.1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
3.2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
3.3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
3.4. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
3.5. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
3.6. " " (Device Hardening) . . . . . . . . . . . . . . . . . . . . . 63

4. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74
4.1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74

5. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
5.1. , . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
5.2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82

6. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90
7. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106

36

Schneider Electric

1.
1.1.
(STN)
, ,
.
, ,
Ethernet.
, , ,
, .

1.2.
PlantStruxure ,
,
.
, ,
.
,
,
. ,
:
p Hirschman
, VPN DMZ.
/ ;
p
ConneXium VLAN ,
;
p PAC Ethernet

;
p VPN RTU.

Web
-

VPN
DMZ

SCADA


./.

VPN

Remote
sire

Schneider Electric

36

,
-, -
, Schneider Electric .
: , .

1.3. ?

.
, , ,
. ,
,
, Microsoft
Ethernet TCP/IP. Ethernet ,
. :
p ;
p WEB-;
p ;
p ;
p ;
p ;
p -, ,
, ...
, :
p NERC;
p PUC;
p ;
p ;
p ;
p ;
p ;
p .
, Ethernet,
-, ,
.

, :
p ;
p
;
p .

36

Schneider Electric

2. -?
-
. -
, , ,

. - , ,
. .

2.1. -
- :
p (, ):
o ;
o /;
o /.
p ():
o ;
o ;
o .
p ():
o
o
o
o

;
;
;
.

p - :
o c
;
o , ,
,
;
o , ,
,
;
o
;
o ( , ,
);
o ,
.
-
, .

Schneider Electric

36


WAN &

VPN

Telco

2.2.

, ,
, .
:
p RTU;
p ( );
p IT- ;
p VPN;
p ;
p ;
p .

36

Schneider Electric

2.2.1. RTU
,
. RTU ,
.

INTERNET


,
.

RTU
.

RTU, , .

RTU, ,
.

2.2.2.
,
VPN .
,
.

Schneider Electric

36

2.2.3. ,
()
. -
, , ,
.

.

2.2.4. VPN
VPN -,
.
VPN
.

VPN

36

Schneider Electric

2.2.5.
, ,
.
,
- SQL ,
.

2.2.6.
,
. ,
.

10

Schneider Electric

36

2.3.
,
. ,
, . ,
, ,
.
:
p ;
p /SCADA.
,
, , ,
(.. pump1, breaker1,...).
( ). ,
.

. ,
, .

2.3.1.
,
.

, PAC ( -
). ,
, ,
.

36

Schneider Electric

11

2.3.2.
,
.
. , ,
, , .

2.3.3.

.

2.3.4.
,
( 1),
( 2), . ,
, .

12

Schneider Electric

36

, ,
.
.


US-CERT (www.us-cert.gov):

36

ARP,
, ARP,
.

ARP
,
(,
).

ARP ,
/ .


ARP ( ARP). ARP

MAC /Media Access Control ( )/.
.

,
,
: .

-.

ARP
. ,
.

,
.


,
.

Schneider Electric

13

,
. ,
/

.

10


, .
, -
,
, .

11

, ,
.
,
. ,
,
.

12


, ,
,
.

13

,
-
, .
,
.
,
,
.
,
.

2.4.
/North American Electric
Reliability Corporation/ (NERC) 10
:
1.
:
p
-;
p
;
p ,
;
p ;
p
;
p .

14

Schneider Electric

36

2. ,
:
p
. ,
;
p
/ .
3. :
p ;
p ;
p
(LAN);
p
.
4.
:
p (
) ;
p ;
p ;
p ;
p .
5. :
p COTS (Commercial Off-The-Shelf)

;
p
.
6. /

, :
p ,
(Supervisory Control And Data Acquisition - SCADA).
p /,
:
p ;
p .
7.
:
p ;
p ;
p (Intrusion
Prevention Systems - IPS).

36

Schneider Electric

15

8. ,
:
p
;
p ,
, , ;
p - ;
p ;
p USB;
p , PDA
(Personal Digital Assistant - PDA).
9. :
p ;
p ,
;
p , ,
.
10. ,
:
p (UPS)
;
p / /
(HVAC);
p ;
p ;
p ;
p ;
p .

2.4.1.
NIST (National Institute of Standards
and Technology)
(),
. :
p ;
p ;
p .

.

- ,
, .

, .
,
:

16

Schneider Electric

36



,
-
. ,
.


, ,
.


,
.


. ,
,

.

, ,

.


.

.
,
,
/
.




DRP (Disaster Recovery
Plan)

DRP
,
,
.

.

,
,
. ,
,
,
.
,
.

36

Schneider Electric

17



365 .

, ,
. - ()
,
, .
,
,
.
:
p ;
p ;
p ;
p .

18


()

,




.



.


.


.
,
.




.

.



: ,
.




,

.

.

Schneider Electric

36

(, ,
)
, ,
..,

. ,
.

,
,

.


.




.


.

:
p (
);
p (
);
p (

).


.

36


.
:
p
;
p

;
p
(
""
(,
));
p
.

Schneider Electric

19



,
.
:
p (,
),
.

.
p ,

.
p
.


,

. :
p
,
.
p
,

.


.

20

,
,
,

.

, ,
,
.

,
.


.

,
,
, .

:

Schneider Electric

36

o ;
o
;
o
(, ,

, / );
o ;
o (
).

36

,


,
,
.


NIC
(Network Interface Card)


NIC
,

.

,

.

.



()



().


.


,

,
.

.


.

;

, ;
.

Schneider Electric

21

22

, ,
;

.

,
, ,
.

(Denial of
service - DoS)


(DoS),

.


,
,
.

OPC (OLE
(OLE for Process
Control OPC))
RPC
(Remote Procedure
Call - RPC) DCOM


(Distributed Component Object
Model - DCOM)

, OPC
RPC/DCOM.

DNP 3.0
(Distributed Network Protocol - DNP), Modbus,
Profibus
.

, .



,
.


,
.

.



IT (Information Technology -
)
Black Hat,
-.
,
.

.

Schneider Electric

36


, ,
,
.
/

, DoS,

,
.
/
,
,
.


, ,

.


,



.

36


,
, ,
. , ,
,

.

Schneider Electric

23



, ,
.
: IT
. ,
.
IT :

IT


,

.


,
,
,
.



IT ,

.



(, ,

).



IT.



(,
)
, ,

.




,
.

24


,

.


.



.

Schneider Electric

36

IT



,



.




,


, ,
.

,


, ,


,

.

.
.
,


,


.
(
IT.
).


.

36





.
.




,
,

.


/.

,

.

3-5 .

15-20 .


, ,

.

Schneider Electric

25

:
p ;
p ;
p ;
p ;
p ;
p .

26





. ,
.
,
.

, ,
ACL (Access Control List),
,

. ,

.


.




, ,
.

ACL
.



,

.


.


,
,

.

.

Schneider Electric

36


,
,

.

.

36


(USB) PS/2

,
, ..


.

;
,
;
.



,

.

:
p ;
p
;
p
(, ACL,
).
p
;
p
.

Schneider Electric

27


,
,

.
,
.


,

,
. -
,
,
,

,
.

,
, ,
,
.
,
,
. ,
, , ,
,
,
.

IT,
DNS (Domain Name System -
) / DHCP (Dynamic Host
Configuration Protocol -
),
IT.
IT,
,
.

28

,
,

/ .

,
.

Schneider Electric

36

/

.


,

,
Telnet,
FTP (File Transfer Protocol) NFS
(Network File System - ).


.


.
, ,
.



.
.
,

(, IPsec),
.

36



,
,
, ,

.




,

.

Schneider Electric

29

3. -
Schneider Electric
Schneider Electric " ".
, .
,
.
PlantStruxure:


2.
1.

DMZ

3.
4.
5. " "
6. /

1.

.
, , :
.
, .
2.
,
.
3.

,
, VPN (IPsec) .
.
4.
VLAN

.
5. " "
" " -
. ,
.
6.
, 100%, - .
,
.
30

Schneider Electric

36

3.1.

.
,
, IT-, ,
.
:
p , ;
p , ;
p .

:
p ;
p ;
p ;
p ;
p .

FEP//ETC .

/RTU/DCS

36

Schneider Electric

31


, ,
.
, :
p ;
p -;
p -;
p .
= % * %
* ()
, ,
CISSP, IT-
:
p -
.
, ,
.
p -
-,
.
p - ,
.
p -
. ,
.
p -
,
.

3.2.

.
,
, (DeMilitarized Zone DMZ). (DMZ)
. (DMZ) :
p , , Citect Historian,
;
p ;
p ;
p -;
p ;
p .
DMZ. .

32

Schneider Electric

36

Web
-

VPN
DMZ

SCADA


./.

VPN

3.2.1. (DMZ)
p DMZ.
p .
DMZ.
p
.
p
.
p ,
IP- DMZ.
p IP-,
IP- DMZ .
p
.
p DMZ .
.

3.3.
() ,
, . (
) , , ,
- ( )
, .
.
, ,
, .
,
.

36

Schneider Electric

33

Web
-

VPN
DMZ

SCADA


./.

VPN

:
p :
. ,
, IP .
- ,

p - -
,
(, ) (, FTP). ,
, ,
.
p Stateful Inspection - Stateful Inspection
, , .
Stateful Inspection , ,
, .
Stateful Inspection ,
. Stateful Inspection
,
.

3.3.1. .

:
p : ;
p

.
, , ,
;
p "" IP- TCP / UDP;
p IP-
;
34

Schneider Electric

36

p
. DMZ;
p , DMZ,
DMZ ( );
p

;
p DMZ ,
IP- ,
DMZ ;
p
;
p ,
, .

3.3.2. .
DOS
.
p :
p spoofing ();
p ;
p ;
p ;
p ;
p /.
:
p
;
p ;
p ;
p ;
p , ;
p ;
p ;
p ;
p ;
p - ;
p ;
p .

3.3.3.


, .
- , ,
:
p IP-;
p IP- ;
p ;

36

Schneider Electric

35

p IP- ;
p .
, ,
.

NOE

10.10.10.10

80

192.168.10.10

80

OK

10.10.10.10

69

192.168.10.10

69

, ,
:

IP

TCP

Telnet

23

TCP/UDP

HTTP

80

TCP/UDP

SNMP v1&v2

161

TCP

FTP

20-
21-

UDP

TFTP

69

TCP/UDP

DNS

53

TCP

POP3

110

TCP/UDP

SMTP

25

.
.

36

Schneider Electric

36



.
SCADA.
(Flood Protection)
,
, , DoS- . DoS-
c
.
, ,
. DoS-
,
, ,
.

36

Schneider Electric

37

3.3.4.
- Domain Name System (DNS)
Domain Name System (DNS) ,
DNS IP- . -
DNS ,
IP-. Schneider Electric
,
(IP- DNS ).

DNS
()
( NHog.com)

2
: IP-
some-webserver.com?
1
: IP-
some-webserver.com?
,
IP-

.
IP-
.

8
: IP-
some-webserver.com.

3
: , .com NameSpace
.


somewebserver.
com

4
: IP-
some-webserver.com?
.com Namespace

Primary DNS
Server (
)

7
: IP-
some-webserver.com.

5
: Primary DNS Server,

some-webserver.com .

6
: IP-
some-webserver.com?

Primary DNS Server


some-webserver.com

38

Schneider Electric

36

1. DNS.
(DNS).
:
p DNS IP-

, -, ,
;
p DNS DoS, .
DNS
( Kiriog.com)
.com Namespace

3
:
IP- somewebserver.com?


some-webserver.com

4
:
, .com
NameSpace

.

?
5 - m
IP r.co

e
erv


bs

:
6

e
w
S-
e y DN com
som
ar er.

7
rim erv
IP-
: P ebs

-w
: rver.com?

me

bse

so
e-we
som

8
-
IP r.com
:
ebserve
some-w

Primary
DNS- (
)

2
: IP-
some-webserver.com?
,
IP-

Primary
DNS-
some-webserver.com

som : 8

e-w
ebs IP-
erve

r.co
???
m

.
IP-

(
)

2. DNS
p DNS
, .
p DNS- .
p DNS DNS.
DNS IP-, mGuard.
.

36

Schneider Electric

39

- Hypertext Transfer Protocol (HTTP)


Hypertext Transfer Protocol ,
World Wide Web : ,
.
HTTP -
. - Schneider Electric HTTP
-.

1. http
2. -
3. -
4.
-
5.

Hypertext Transfer Protocol Secure (HTTPS) Hypertext


Transfer Protocol . HTTP HTTPS
- (80 HTTP 443 HTTPS). HTTPS
HTTP .
:
p -Transport Layer Security (TLS);
p - Secure Sockets Layer (SSL) .
1. HTTP
HTTP ,
, ,
. .

1.
2.

40

Schneider Electric

36

2. HTTP
p HTTP , , ,
HTTPS HTTP, ,
.

p HTTP ,
.

DHCP
() - Dynamic Host
Configuration Protocol (DHCP)
BootP, (DHCP ),
. DHCP
. DHCP DORA
(Discover, Offer, Request and Acknowledgment) (, ,
)

36

Schneider Electric

41

1.

DHCPDISCCOVER

2.

IP-,
DHCPOFFER

3.
DHCPREQUEST

IP-

4.
DHCPPACK
IP-

5.

IP-

6.
ACK

IP-

DHCP 67/UDP DHCP 68/UDP DHCP.


Schneider Electric DHCP
Faulty Device Replacement (FDR).
1. DHCP
DHCP:
p DHCP - DHCP
MAC . DHCP-
IP-
IP-;
p DHCP - , DHCP,
DHCP , IP-,
.
2. DHCP
DHCP:
p
;
p DHCP , ;
p Schneider Electric. Ethernet NOE ETY,
DHCP-, MAC-
(FDR) , IP-
.

42

Schneider Electric

36

FTP - Trivial Transfer Protocol (TFTP)


File Transfer Protocol (FTP) Trivial File Transfer Protocol (TFTP)
. Transparent Ready FTP
, -,
.. TFTP
( ).
1. FTP
FTP .
TFTP .
FTP .
FTP ,
.
FTP, "".
FTP, PORT ,
IP- TCP-.
V

4. ;
IP- "V",
X

1. ;
IP- "V",
X

FTP


3. :
IP- "A",
X

2. :
IP- "A",
X

FTP

2. FTP
p FTP

.
p , ,
Secure FTP (SFTP) Secure Copy (SCP).
p .
p , FTP-.

36

Schneider Electric

43

p FTP- . IP, FTP-,


, .
, .

Telnet
Telnet
. Telnet
23. , ,

.

1. Telnet
,
Telnet, ,
.
2. Telnet
p Telnet
, .
p Telnet
(, VPN) ( " ).
44

Schneider Electric

36

,
(Simple Mail Transfer Protocol (SMTP) & Post Office Protocol (POP3))

,
.
PlantStruxure .
, , ,
, . ,
.
Simple Mail Transport Protocol (SMTP) ,
Mail Transfer Agents (MTA),
. SMTP- :
p ,
;
p
. ,
.
Post Office Protocol 3 (POP3) Internet Message Access Protocol (IMAP)

. POP3
. POP3 110.
A

1. SMTP & POP3


Directory harvesting attack
(DHA).
, ,
SMTP , Delivery Status
Notification (DSN) .
, .
DSN ,
.
:
p : ,
- ;
p : ,
.

36

Schneider Electric

45

1. SMTP POP3
p
.
p SMTP
.
PlantStruxure .
p . ,
.
p , IP- ,
, FTP,
.

(Simple Network Management Protocol (SNMP))


PlantStruxure Ethernet SNMP
. PlantStruxure SNMP v2,
, . ConneXium
SNMP v3, :
p ;
p ;
p .
SNMP .
p : , SNMP
, ,
. :
, , , , , ,

p : ,
. .

46

Schneider Electric

36

p (Network management system (NMS)):


,
.

SNMP

SNMP

1. SMNP
p SNMP . 1 2 SNMP
.
. 3 ,
.
p SNMP Public
("") Pravite ("") .

.
p SNMP ,
.
2. SNMP
p - SNMP3, .
p SNMP V1 V2 /
,
.
p IP-
SNMP .

36

Schneider Electric

47

(Network Address Translation (NAT))


NAT ,
. IP-
.
NAT
IP-. NAT ,
.
,
IP- .
, IP-
.
NAT ,
, NAT PlantStruxure . NAT
,
.
.
NAT IP-.
IPv6. NAT , IP-.

1. NAT
p
2. NAT
p NAT, . NAT (EtherNet/IP ).

NAT, , ,
IP-forwarding , :

48

Schneider Electric

36

3.3.5.
- .
.
(Remote Authentication Dial In User Service (RADIUS))
, .
RADIUS

Web
-

VPN
DMZ

SCADA


./.

VPN

RADIUS :
p ,
;
p ;
p .
RADIUS
.
MD5. RADIUS
. RADIUS
(VPN), ,
Ethernet, Digital Subscriber Line (DSL)
.

.

36

Schneider Electric

49

RADIUS-

1.

2.

3.
4.

5.

6.

7.

8.

9.


p
RADIUS.
p , 16
,
.

RADIUS
. IPsec,
.

50

Schneider Electric

36


RADIUS .

RADIUS RADIUS- .

3.3.6.

,
.
-,
.
(Virtual Private Network (VPN)). VPN
,
.

Web
-

VPN
DMZ

IP SEC

SCADA


./.

VPN

36

Schneider Electric

51

VPN
p ( Protocol Security (IPSec)): IPSec
, IP
IP-. IPSec :
o
o
o
o

;
;
;
.

IPsec .

p Secure Socket Layer (SSL): SSL ,


. SSL
.
, SSL -(TCP)
.
IPsec
VPN
IP- (IPsec). IPSec
, .
IPSec
, . IPsec
:
p - (Internet Key Exchange (IKE IKEv2)): ,
(SA)
, , . Key Exchange

IPsec. ,
IKE Diffie-Hellman ;
p (Authentication Header (AH)):
IP-
-, MD% SHA-1;
0 - 7

8 -15

16-23

24 - 31

(Security parameters index (SPI))



()
p (Encapsulating Security Payload (ESP)): ,

, ().
ESP IP- ( ),
IP-, .
IP- ,
.

52

Schneider Electric

36

0 - 7

8-15

16 -23

24-31

(Security parameters index (SPI))



()
(0-255 )

()
IPsec .
p : ,
. IP- ,

.
IP

ESP

ESP

ESP


ESP

p : -. (
) IP- / .
IP

ESP

IP

ESP

ESP


ESP

VPN-
. :
p (AES (Advanced Encryption Standard)):
128- ,
. ,
, ;
p DES: 64- , 56-
. ,
DES ;
p Triple-DES (3DES): 3DES 56- DES .
3DES DES, 64-
. 3DES ,
56- . 3DES 56- DES.
, ,
. -
, ,

. -
IKE, AH ESP .
.
p Message Digest 5 (MD5): 160- .
p Secure Hash Algorithm 1 (SHA-1): 160- (20 ) .
SHA-1 , MD5,
.
36

Schneider Electric

53


p , , ,
.
p
.
p , .
p .
p .
p ,
, ,
IPSec.
p ,
,
,
.
p

.
p ,
.
p .
p :
o

:
;
;
, .

p , .
p , VPN-
.
p
.
1.
p
.
p .
p , .
p (
).
p , .
p , /
.
p ,
:
o , ,
;
o ,
,
.

54

Schneider Electric

36

2.

VPN .
.

X.509 ,
- IPsec ( S/MIME).

SHA-1. MD5 .

36

Schneider Electric

55

3.4.
,

, .
, .

. VPN IP Sec
( ).

Web
-

VPN
DMZ

SCADA


./.

IP SEC

VPN

3.4.1.

:
p
,
, .
,
,
.
,
;
p , ,
IEEE 802.1x
(, Extensible Authentication Protocol [EAP] TLS [EAP-TLS]),

(RADIUS) .
p

(, ) ICS.
p
(SSID), SSID, MAC- .
p , Microsoft Windows ICS,
- Windows.

56

Schneider Electric

36

p
.
.
2 OSI, 3,
.
.
p

2 OSI, .

, ,
. ,
.

.

.

3.4.2.

p ,
.
p .
p .
p .
p .
p , ,
.
p - ,

.

/ San Francisco Chronicle - -2009

36

Schneider Electric

57

3.4.3. .
FactoryCast ETG302x VPN
. ETG
RTU .
, , ETG302x:
p ;
p PlantStruxure, ();
p 3DES
SHA-2.
VPN ETG302x .

VPN ETG, IP- GPRS .

58

Schneider Electric

36

3.5.

.
, , Ethernet .
:
p (, , , , )
;
p
;
p ,
;
p , .
p
VLAN;
p .
Ethernet -
, .
, , VLAN,
- ,
, .
.

3.5.1. VLAN
(VLAN) .
VLAN
, ,
.

VPN

Co

nn

SCADA


./.

eX

ium

LA

VPN

36

Schneider Electric

VLAN1

VLAN3

VLAN4

59

VLAN - ( 2),
Ethernet, --,
VLAN.
VLAN, -
.

VLAN :
p :
, ;
p : :
, , , ;
p : .

p VLAN ,
.
p VoIP VLAN.
p , DMZ ,
VLAN, ,
DMZ.
p VLAN.
p QoS ACL,
.
p Telnet SSH .
p ,
.
p VLAN.

60

Schneider Electric

36

VLAN
VLAN Hopping - VLAN.
,
VLAN. VLAN Hopping
"" ()
, VLAN.
VLAN :
p MAC flooding ( VLAN);
p ISL 802.1Q;
p VLAN Double-Encapsulated 802.1Q;
p ARP ;
p VLAN;
p (Multicast Brute Force Attack);
p Spanning-Tree;
p (Random Frame Stress Attack).
VLAN
ConneXium VLAN
/ .
, , ,
A & B . C
. .
VLAN 0 .
, VLAN.

36

Schneider Electric

61

p
.
:
VLAN.

p ,
.

62

Schneider Electric

36

3.6. " " (Device Hardening)


Device hardening - ,
.

Web
-

VPN
DMZ

SCADA


./.

VPN

Device hardening ,
, , SCADA PAC.
:
p , ;
p ;
p ;
p NIDS (Network intrusion detection systems);
p .

Schneider Electric.

3.6.1.
Device Hardening,
, .
.

(, ,
).

36

Schneider Electric

63


p , , :
o
o
o
o

;
;
& ;
.

p .
p , .
p .
p 8 :
o (: A, B, c, d);
o (: 1, 2, 3);
o - (: !, $, #, %).
p .
p , .
p ,
.
p ,

,
.
p ,
, (,
).
p ,
.

p ,
, .
p , ,
.
p .
p
.
p (,
FTP, SMTP ...).
p .
p

.
p .
p , ,
.

64

Schneider Electric

36


1. SMTP Email Server
: NOE, ETY

2. FTP
FTP.
FTP.

36

Schneider Electric

65

3.6.2.
(Device Hardening)
Schneider Electric . ,
IP- , ,
.
.

p : ,
.

p PAC, ,
.

, , ,
TCP :

3.6.3. Ethernet ConneXium



,
Ethernet ConneXium:
p SNMP;
p (Telnet/ );
p Ethernet Switch Configurator;
p IP MAC-.

66

Schneider Electric

36

SNMP

(Simple Network Management Protocol (SNMP)). SNMP IP-
- , .
SNMP IP- -
MIB . ,
, IP- - ,
.
,
Public ( ) Private
( ) .
1. SNMP.
Ethernet "" () MAC-,
, spanning tree protocols,
.
2. SNMP
p SNMP v3, .
p .
p
.

36

Schneider Electric

67

Telnet/-
Telnet, ,
( ).
ConneXium -.
.
1. Telnet/
, .
2. Telnet/
p Telnet -, .

Ethernet Switch Configurator


Ethernet Switch Configurator IP -. Ethernet Switch Configurator 2.

1. Ethernet Switch Configurator


.

68

Schneider Electric

36

2. Ethernet Switch Configurator


Ethernet Switch Configurator IP-
.
p Ethernet Switch Configurator "
Ethernet " , , " ".

Ethernet

Ethernet. :
p ;
p MAC- - MAC-
Ethernet;
p IP- IP-
Ethernet. .
1. Ethernet
,
, ,
.
Ethernet Content Address Memory (CAM),
MAC- ,
. MAC flooding
, MAC-
, CAM.
CAM, Ethernet Ethernet
.
(, Wireshark),
(, ,
), , ,
.

36

Schneider Electric

69

2.
p VLAN.
p ,
( 10 ).

3.6.4. SCADA
SCADA .
, SCADA:
p ;
p -
;
p ;
p , ;
p MS Windows.
70

Schneider Electric

36

SCADA
p ,

.
p , DMZ,
.
.
p .
p
.
.
p .
p -.
p CD-ROM .
p .
p , .
p .
SCADA
SQL- - ,
. SQL,
,
.
URL.
SQL- /
,
.

1. SQL-

2.

3.


B,

4.

36

Schneider Electric

71

SCADA
1.

,
.
. ,
.

2. -
- (Internet Display Client (IDC))
FTP. , FTP ,
. - CitectSCADA
IDC

72

Schneider Electric

36

3.
, , .
, , ,
.

36

Schneider Electric

73

4.
.
, -
. ,
,
.

:
p ;
p ;
p IDS (Intruder Detection System).
IDS , ,
, , ,
, ..
IDS:
p NIDS (Network Intruder Detection System)
/ ;
p HIDS (Host Intrusion Detection System)
.

4.1.
4.1.1.

.

74

Schneider Electric

36

4.1.2.
, ,
.

MS
Windows Event Viewer (Control Panel/Administrative tools/
Event Viewer/Application Log).

36

Schneider Electric

75

4.1.3.

.

4.1.4.
, . :
p (, Quantum PAC);
p (, PAC);
p (, ConneXium Switch).

76

Schneider Electric

36

5.
5.1. ,
Quantum
SNMP

FTP

SNMP(v1) SNMP(v2) SNMP(v3) MIB-II

TFprivate-MIB

14OCPU65150

14OCPU65160

140CPU65260

140NOE77101

140NOE77111

140NWM10000

FDR
X

140CPUE5160

140CPU65260

140NOE77101

140NOE77111

140NWM10000

14QCPU65150

TFTP

Telnet

36

FDR

14OCPU65150

140CPU65160

140CPU65260

140NOE77101

140NOE77111

140NWM10000

14OCPU65150

1
X

X2

14OCPU65160

X2

140CPU65260

X2

140NOE77101

X2

140NOE77111

X2

140NWM10000

X2

Schneider Electric

77

Premium
SNMP

FTP

SNMP

FTP

78

SNMP(v1) SNMP(v2) SNMP(v3) MIB-II

TFprivate-MIB

TSXP571634M

TSXP572634M

TSXP573634M

TSXP574634M

TSXP575634M

TSXP576634M

TSXETY4103

TSXETY110WS

TSXETY5103

TSXWMY100

TSXP571634

FDR
X

TSXP572634M

TSXP573634M

TSXP574634M

TSXP575634M

TSXP576634M

TSXETY4103

TSXETY110WS

TSXETY5103

TSXWMY100

SNMP(v1) SNMP(v2) SNMP(v3) MIB-II

TFprivate-MIB

TSXP571634M

TSXP572634M

TSXP573634M

TSXP574634M

TSXP575634M

TSXP576634M

TSXETY4103

TSXETY110WS

TSXETY5103

TSXWMY100

TSXP571634

FDR
X

TSXP572634M

TSXP573634M

TSXP574634M

TSXP575634M

TSXP576634M

TSXETY4103

TSXETY110WS

TSXETY5103

TSXWMY100

Schneider Electric

36

M340

36

SNMP

SNMP(v1)

BMX NOE 01x0

MIB-II

TFprivate
MIB

BMX P34 2030/20302

BMX P34 2020

FTP

Firmware

BMX NOE 0100

BMX NOE 0110

BMX
P342020/2030/20302

TFTP

FDR

BMX NOE 01x0

BMX
P342020/2030/20302

Schneider Electric

SNMP(v2)

SNMP(v3)

FDR
x

x
x

79

, TSX Micro
FTP

TSXETZ410

FDR
X

TSXETZ510

, Momentum
SNMP

FTP

Telnet

MIB-II

TFprivate-MIB

170ENT11001

170ENT11001

171CCC96020

171CCC96030

171CCC98020

171CCC98030

170ENT11001

, Advantys STB
SNMP

FTP

SNMP(v1) SNMP(v2) SNMP(v3) MIB-II

TFprivate-MIB

STBNIP2212

STBNIP2212

, Advantys STB
SNMP

FTP

80

SNMP(v1) SNMP(v2) SNMP(v3) MIB-II

TFprivate-MIB

EGX200

EGX400

EGX200

EGX400

Schneider Electric

36

, ConneXium
SNMP

SNMP(v1)

174CEV20040

SNMP(v3)

MIB-II

TSXETG100

TCSESM*

FTP

174CEV20040

TSXETG100

TCSESM*

36

SNMP(v2)

TFTP

FDR

174CEV20040

TCSESM*

Telnet

174CEV20040

TCSESM*

Schneider Electric

81

5.2.
5.2.1 IP- IP "" IP Spoofing
IP "" ,
, IP-,
, ,
. IP "" IP-.
- IP (Internet Protocol) ,
. IP-,
, .
IP, ,
, ,
,
, .

8
IHL

15 16

31

IP-
IP-

IP-.
IP IP- . IP, .
IP- .
:
p c ,
. : 80 ,
-. Telnet,
-.
- ;
p . TCP

.
. ,
.
p ,
, ,
. ,
.
.

82

Schneider Electric

36

5.2.2. DoS ( )
DoS ( )
.

,
. :


, .

, , ,
.
.

DoS.
:
p Flood TCP SYN (TCP SYN Flood);
p Land attack;
p ARP Spoofing - ARP - ARP;
p ICMP smurf;
p the PING of Death - " ";
p UDP Flood;
p Teardrop.

5.2.3. Flood TCP SYN


TCP SYN DoS ( ),
SYN
.
TCP SYN, TCP- ,
:

, SYN ()
.

, SYN-ACK .

ACK .

TCP.

36

Schneider Electric

83

.
, .
, .
,
, , ,
.


SYN

84

Schneider Electric

36

5.2.4. Land Attack


Land Attack TCP SYN, IP-
IP- . ,
-.

SYN: 10.205.30.40
SYN: 10.205.30.40

SYN: 10.205.30.40
SYN: 10.205.30.40

10.25.30.40

SYN: 10.205.30.40
SYN: 10.205.30.40

10.25.30.40

5.2.5. ARP Spoofing - ARP - ARP)


ARP (Address Resolution Protocol)
, IP-
MAC-, (- ARP).
10.10.10.10

10.10.10.20

10.10.10.5

10.10.10.30

10.10.10.30

ARP


10.10.10.30
MAC
00.1A.28.3C.40.5E

10.10.10.40

36

ARP ARP
. ,
.

Schneider Electric

85

, ARP
(: ,
, ,
IP- ). ARP
IP- .
255.255.255.255
( ).

,
ARP ARP ,
IP-.

ARP, ARP ,
.

ARP flood spoofing ARP , ,


ARP ARP , ARP .
MAC- (,
) ARP ,
.

APR

86

Schneider Electric

APR

36

5.2.6. ICMP Smurf


Smurf IP- , ICMP
- (ping) .
, ,
. ICMP Smurf
ICMP Flood, Smurf-
.

ICMP

Smurf

Ping

Ping

5.2.7. The PING of Death - " "


TCP/IP
IP- . ,
IP , IP
. IP.

8
IHL

15 16

31

IP-
IP-

(3 )
unset

DF

1-

36

Schneider Electric

MF

0
1

87

ICMP - ()
, IP
(63, 535 )
ICMP - , IP,
.

Ping

5.2.8. UDP Flood


UDP Flood ICMP flood. , UDP
. UDP Flood
UDP . UDP,
, , .
, (ICMP Destination
Unreachable) IP-. UDP
,
.
UDP 768

UDP 61

UDP 456

UDP 4045

UDP 388

UDP 88

UDP 45

UDP 92

UDP 161

UDP 761

UDP 32768

UDP 444

UDP Flood ,

.

88

Schneider Electric

36

5.2.9. Teardrop
Teardrop .
.
, ,
.

20

IP

700

= 0
= 720
= 1
20

IP

530

= 800
= 550
= 0

Teardrop
.

36

Schneider Electric

89

6.
,
.
www.sans.org.
, http://www.sans.org/resources/glossary.php

A
Access Control
Access Control , ,
.
Access Control List (ACL)
,
, .
Access Matrix -

, .
Account Harvesting
Account Harvesting - .
ACK Piggybacking - ACK
ACK ACK ,
.
Activity Monitors -
Activity Monitors
,
.
Address Resolution Protocol (ARP) - .
Address Resolution Protocol (ARP) ,
- ,
. ,
ARP, MAC
IP-. ARP-
.
Advanced Encryption Standard (AES) -
, NIST.
, .
Auditing -

.
Authentication -
Authentication - .
Authorization -
Authorization -
- .
Autonomous System -
, .
.
,
(Autonomous System Number (ASN)).

B
Backdoor
Backdoor - , ,

, .

90

Schneider Electric

36

Banner -
Banner - , ,
. ,
, .
Basic Authentication -
Basic Authentication - - ,
.
Bastion Host - -
Bastion Host , (hardened)
, .
Block Cipher -
Block Cipher .
Boot Record Infector -
Boot Record Infector - ,

Brute Force -
,
.
Buffer Overflow -
,
( ),
. ,
,
, .
Business Continuity Plan (BCP) -
Business Continuity Plan ,
,

.

C
Cache -
.
,
.
: .
Cache Cramming -
Cache Cramming - Java
, ,
.
Cache Poisoning

[Cached] .
DNS .
Call Admission Control (CAC) - (CAC)

.
Certificate-Based Authentication -
SSL
HTTP .
Challenge-Handshake Authentication Protocol (CHAP)

Challenge-Handshake Authentication Protocol
, .
Cipher -
.
Ciphertext -
Ciphertext - , .

36

Schneider Electric

91

Competitive Intelligence -
Competitive Intelligence - , , , ,
.
Computer Emergency Response Team (CERT) -
, (INFOSEC) ,
,
, , ,
.
Countermeasure -
,
, .
(Intrusion Prevention Systems (IPS)) , ,
, ,
. :
(patches), .
Cryptanalysis -
, ,
, , ,
. ,
, .
Cryptographic Algorithm or Hash -

, , ,
,
.
Cut-Through - " "
Cut-Through - , ,
.

D
Data Encryption Standard (DES) -
,
() . 72 000 000 000 000 000 (72 )
, .
.
,
, ,
.
Data Mining -
Data Mining - , ,
.
Day Zero - " " " "
"Day Zero" "Zero Day" , .
, " " ,
. (" "- ,
).
Decryption -
Decryption -
.
Defacement -
Defacement - - ,
- ""
.
Defense In-Depth -
Defense In-Depth - ,
.
Demilitarized Zone (DMZ) -
, Demilitarized Zone (DMZ)
( ) (),
,
. DMZ ,

92

Schneider Electric

36

,
.
,
- . , ,
, ,
DMZ
Denial of Service -

.
Dictionary Attack -
, ,
. Dictionary Attack
, " " (brute force),
.
Diffie-Hellman -
, 1976 Whitfield Diffie ( )
Diffie-Hellman ( ). Diffie-Hellman ,
. , , ,
,
.
Digest Authentication -
Digest Authentication - MD5,
, .
Digital Certificate -
Digital Certificate - " ",
, .

. , ,
, ( ,
),
,
.
Digital Envelope -
Digital Envelope - .
Digital Signature Algorithm (DSA) -
,
. , ,
,
.
Digital Signature Standard (DSS) -
, Digital Signature
Algorithm (DSA), .
Disaster Recovery Plan (DRP) -
Disaster Recovery Plan - IT-
.
Domain Hijacking -
Domain Hijacking - ,
DNS- ,
.
Domain Name System (DNS) -
Domain name system (DNS) - , -
( ) .
- ""
-.
DumpSec C
DumpSec - , ""
, , ,
, .
Dumpster Diving -
Dumpster Diving -
, .

36

Schneider Electric

93

E
Eavesdropping -
Eavesdropping - ()
, .
Egress Filtering -
.
Encapsulation -
,
.
Encryption -
( " ")
( ""), ,
, .
Extensible Authentication Protocol (EAP) -
,
PPP (Point to Point Protocol- ),
, .

F
Filter -
, , ,
.
(), , ,
, , .
Fingerprinting -
, ,
, .
Firewall -
,
.
Flooding -
( ) ,
.
, ,
.
Fork Bomb -
Fork Bomb fork(),
.
.
Form-Based Authentication -
Form-Based Authentication - ,
:
.

H
Hardening -
Hardening -
.
Hash Function - -
, ,
, .
Hash Functions - -
() - , "
" ,
. - ,
, ,
. - MD5 SHA1.

94

Schneider Electric

36

Hijack Attack
, ,
.
HTTP Proxy HTTP
HTTP Proxy - ,
HTTP .
HTTPS
URL (,
), HTTP,
, SSL.
Hybrid Attack -
Hybrid Attack ,
.
Hybrid Encryption -
, ,
.
Hypertext Markup Language (HTML) - (HTML)
, ,
.
Hypertext Transfer Protocol (HTTP) - (HTTP)
(IP),
.

I
Identity -
Identity - , , , ,
.
Incident , , , ,
Incident -
.
Ingress Filtering -
.
Input Validation Attacks
Input Validation Attacks ,
, .
Internet Control Message Protocol (ICMP)
(ICMP)
-,
IP-
IP-.
Internet Protocol Security (IPsec) -

.
Intrusion Detection System (IDS)
. Intrusion Detection System
(IDS)
, ,
( )
( ).
IP Flood - IP
, ("ping"), .
IP Forwarding IP - IP-
IP Forwarding - ,
. ,
, IP-
, , .
IP Spoofing IP - IP
, IP- .
36

Schneider Electric

95

K
Kerberos - Kerberos
, 1980-
MIT,
( ) ,
,
, -
( DES RFC 1510). Kerberos Microsoft
Windows 2000. Kerberos - .
,

L
Layer 2 Forwarding Protocol (L2F) - 2
( Cisco),
PPP IP,
,
.
Layer 2 Tunneling Protocol (L2TP) - 2
Layer 2 Tunneling Protocol (L2TP)
-, ,
VPN .
List Based Access Control -
List Based Access Control
.

M
MAC Address MAC- MAC-
, ,
, ,
.
Malicious Code -
(, ), ,
,

.
Malware - -
.
Masquerade Attack -
, ,
( ).
Md5
-. . "" "sha1".

N
Network Address Translation (NAT) - .
,
IP- .
IP-, ""
IP-. NAT,
IP- DLS .
NAT ,
.

96

Schneider Electric

36

National Institute of Standards and Technology (NIST) -



National Institute of Standards and Technology - .
, NIST
. ,
.
Network Address Translation -
, IP-,
. , ,
- .
Network-Based IDS
Network-Based IDS .

, , .
(,
) . Network-Based IDS
, .
, ,
. ,
.
.

.
, ,
,
.

P
Packet -
, .
, .
IP, .
Packet Switched Network -
Packet Switched Network - ,
.
Password Authentication Protocol (PAP) -
Password Authentication Protocol - ,
,
.
Password Cracking -
Password Cracking - , .
Password Sniffing -
, ,
.
Patch - "" -
Patch - ,
, .
Penetration -
, .
Penetration Testing
,
.
Permutation -
,
.
Personal Firewalls -
,
.

36

Schneider Electric

97

Pharming -
MITM -.
,
. ,
,
, .
DNS- ,
URL
IP- -. URL,
www.worldbank.com IP (192.86.99.140).
, , ,
www.worldbank.com
.
Phishing -

,
.
- ,
, .
Ping of Death
, ICMP ("")
, .
Ping Scan -
- , ICMP Echo .
Ping Sweep -
, ICMP - ("") IP, ,
.
Point-to-Point Protocol (PPP) - "-"
,
, , .
IP-, ,
.
Point-to-Point Tunneling Protocol (PPTP) - "-"
"-" , ""
, .
Poison Reverse
Split horizon Poison Reverse ( , )
,
. , ,
.
Polyinstantiation -
Polyinstantiation -
. , inference
().
Polymorphism
Polymorphism - ,
, .
Post Office Protocol, Version 3 (POP3) - POP, 3 (POP3)
-,
,
, .
Pretty Good Privacy (PGP)TM
Trademark of Network Associates, Inc, (
), ,
.
Private Addressing -
IANA
. ,
RFC 1918.
: 10.0.0.0 10.255.255.255 (10/8 ) 172.16.0.0 172.31.255.255
(172.16/12 ) 192.168.0.0 192.168.255.255 (192.168/16 ).

98

Schneider Electric

36

Promiscuous Mode -
, , .
, ,
, (
).
Proxy Server - -
,
, ,
. -
, ,
, .
Public Key -
- ,
.
Public Key Encryption -
" ".
Public Key Infrastructure (PKI) -
PKI (Public Key Infrastructure)
, ,

,
.
,

.
Public-Key Forward Secrecy (PFS) - ,

,
, , ,
, ,
.

R
Race Condition -
Race Condition
.
Reconnaissance -
Reconnaissance - ,
.
Reverse Address Resolution Protocol (RARP) -

RARP (Reverse Address Resolution Protocol) - ,


IP-
Address Resolution Protocol ( ), .

, (Media Access Control MAC) Internet Protocol (IP-).
, RARP- RARP-
, IP- .
, RARP IP-
, .
Reverse Lookup -
, IP-,
Reverse Lookup, IP- .
Reverse Proxy -
Reverse Proxy HTTP , , , .
Risk -
Risk - .
.

36

Schneider Electric

99

Risk Assessment -
Risk Assessment - ,
.
Risk Averse
, . ,
( )
, ,
.

S
S/Key S/
, -,
64-
. ,
- MD4, .
, -
.
Scavenging - ( )

.
Secure Electronic Transactions (SET) -
Secure Electronic Transactions - ,
, (, ) ,
,
.
Secure Shell (SSH)
,
.
Secure Sockets Layer (SSL) - SSL
, Netscape .
SSL , , ,
SSL-.
Security Policy -
, ,
,
.
Segment -
Segment - TCP .
Session -
Session - ,
.
Session Hijacking
.
Session Key -
,
. ,
Session Key
,
, , ,
.
SHA1
-. "MD5"
Shadow Password Files -
, ,
,
.
Signature -
Signature - ,
.

100

Schneider Electric

36

Simple Integrity Property -


Simple Integrity Property
, .
Simple Network Management Protocol (SNMP) -
, ,
. .
Smurf - , Smurf-, - ( ,
- - , ;
)
Smurf- ping-
, ping ,
.
Sniffer
Sniffer - , ,
.
Sniffing -
" ".
Social Engineering -
- , ,
, , , ,
.
Spam - ""
.
Split Horizon
Split horizon - ,
, .
Split Key
,
,
, .
Spoof -
,
.
SQL Injection - SQL
SQL Injection - ,
, SQL
.
Stack Mashing
Stack Mashing -
.
Stateful Inspection
. Stateful Inspection -
, .
,
, Stateful Inspection ,
, ,
.
Static Host Tables -
Static Host Tables - ,
.
Static Routing -
Static Routing , , ,
.
Stealthing
Stealthing - , ,
, .
Steganalysis
Steganalysis - , steganography.

36

Schneider Electric

101

Steganography C
.
, ,
. - ""
.
Stream Cipher -
Stream Cipher ,
.
Subnet Mask
Subnet Mask , ,
. 32-
,
.
Switch -
Switch - ,
(MAC-), .
,
.
Switched Network -
, ,
,
.
.
Symbolic Links -
, .
Symmetric Cryptography -
, ,
, ,
. Symmetric Cryptography
" -" ( ),
.
Symmetric Key -
,
.
SYN Flood SYN
DoS TCP
SYN- ( ,
), .

T
TCP Fingerprinting - TCP
TCP Fingerprinting - TCP ,
.
TCP Full Open Scan - TCP
TCP Full Open Scan - ,
, ,
, .
TCP Half Open Scan - TCP
TCP Half Open Scan
, ,
.
TCP Wrapper - TCP
,
;
.
TCPDump TCP
TCPDump - Unix,
.

102

Schneider Electric

36

TELNET
- TCP,
.
Threat - - ( )
, , ,
, ,
.
Threat Assessment -
Threat Assessment - ,
.
Threat Model -
Threat Model ,
, .
Threat Vector
, , .
Time to Live -
-, ,
.
Tiny Fragment Attack - ,
IP-
. ,
TCP TCP ,
, ,
.
, ,
. , STD 5 RFC 791, :
- 68
. - 60 ,
8 .
Transport Layer Security (TLS) -
,
. , TLS ,
. TLS
Secure Sockets Layer.
Triple DES - DES
, DES, 64-
, Data Encryption Algorithm ,
, 112 168 .
Triple-Wrapped
S/MIME: , ,

Trojan Horse -
, , ,
,
, ,
.
Trust
Trust ,
.
Trusted Ports -
Trusted Ports - 1024.
.
Tunnel -
,
,
, . ,
-, , 2
2 (, TCP),
( IP),
. ,
,
.
36

Schneider Electric

103

U
UDP Scan - UDP
UDP , , UDP .
Unicast -
.
User Contingency Plan -

User Contingency Plan -


, - .
User Datagram Protocol (UDP) -
, TCP, IP-. TCP /
IP, UDP / IP ,
IP.
. UDP
-, ,
() .
, UDP .

V
Virtual Private Network (VPN) -
VPN - , (,
) ,
(.. ) (, ),
( ),
. ,
,
,
VPN () ,
()
. VPN, , ,
,
, .
Virus -
,
, , , ,
- ,
.
, , (, ),
.
Voice Firewall -
Voice Firewall -
,

(Call Admission Control ()).

.
Voice Intrusion Prevention System (IPS) -

IPS ,
/
,
, ,
.
Vulnerability -
,
,
.

104

Schneider Electric

36

W
War Chalking -
War Chalking , , ,
,
.
War Dialer
War Dialer - ,
, , ,
,
.
War Dialing -
War Dialing , ,
,
.
War Driving
War Driving -
.
.
Web of Trust -
Web of Trust - , ,
, .
Wired Equivalent Privacy (WEP)
,
802.11b IEEE.
Worm -
, ,

.
Wrap -
,
.

36

Schneider Electric

105

7.
:
http://www.us-cert.gov/control_systems/
:
-2008
Guide to Industrial Control Systems (ICS) Security -National Institute of Standards and
Technology (NIST), Keith Stouffer, Joe Falco, Karen Scarfone 2008
Common Cyber Security Vulnerabilities Observed in Control System Assessments by the INL
NSTB Program -U.S. Department of Energy Office of Electricity Delivery and Energy Reliability,
National SCADA Test Bed (NSTB) -2008
Control Control Systems Cyber Security: Defense in Depth Strategies Idaho National
Laboratory May 2006
The Instrumentation, Systems and Automation Society (ISA):
Intrusion Detection and Cyber Security Monitoring of SCADA and DCS Networks
2004
Mitigations for Security Vulnerabilities Found in Control System Networks -2006
2008 CSI Computer Crime & Security Survey -Robert Richardson, CSI Director
Design Secure Network Segmentation Approach -SANS Institute InfoSec Reading
Room 2005
VLAN Best Practices White paper FLUKE networks -2004
OPC Security Whitepaper #3 Hardening Guidelines for OPC Hosts -Digital Bond,
British Columbia Institute of Technology, Byres Research 2007
http://www.vicomsoft.com/knowledge/reference/firewalls1.html

106

Schneider Electric

36

Schneider Electric

220006, . , 15, 9
.: (37517) 226 06 74, 227 60 34, 227 60 72




.

www.MyEnergyUniversity.com

050009,  , 151/115
-
.: (727) 397 04 00
: (727) 397 04 05

010000, . , 18
 2002
402
.: (3172) 91 06 69
: (3172) 91 06 70

060002, . , 2
 , 407
.: (3122) 32 31 91, 32 66 70
: (3122) 32 37 54

400089, . , 15
12
.: (8442) 93 08 41

394026,  , 65, 227


.: (4732) 39 06 00
./: (4732) 39 06 01

620014, . , 28, 11
.: (343) 378 47 36, 378 47 37

664047, . 1 , 3 , 312
./: (3952) 29 00 07, 29 20 43

420107, . , 6, 7
./: (843) 526 55 84 / 85 / 86 / 87 / 88

236040, ., 15
.: (4012) 53 59 53
: (4012) 57 60 79

350063, . , 62 /
. , 13, 224
.: (861) 278 00 62
./: (861) 278 01 13, 278 00 62 / 63

660021, . , 3 , 302
.: (3912) 56 80 95
: (3912) 56 80 96

129281, . , 37, . 1
.: (495) 797 40 00
: (495) 797 40 02


.: 8 (800) 200 64 46 ()
.: (495) 797 32 32, : (495) 797 40 04
ru.csc@ru.schneiderelectric.com
www.schneiderelectric.ru

183038, . , . 5/23

739
.: (8152) 28 86 90
: (8152) 28 87 30

603000, . , 10 , 8
./: (831) 278 97 25, 278 97 26

630132, . , 35
 , 1309
./: (383) 227 62 53, 227 62 54

614010, , 98, 11
./: (342) 290 26 11 / 13 / 15
!!
344002, . , 74,
.: (863) 200 17 22, 200 17 23
: (863) 200 17 24

443096, . , 27
./: (846) 266 41 41, 266 41 11
!
196158, , 40, . 4,
-
.: (812) 332 03 53
: (812) 332 03 52

354008, . , 20 , 54
.: (8622) 96 06 01, 96 06 02
: (8622) 96 06 02

450098,  , 132/3 ( )
 3, 9
.: (347) 279 98 29
: (347) 279 98 30

680000, . , 23, 4
.: (4212) 30 64 70
: (4212) 30 46 66

49000, . , 17, 4
.: (380567) 90 08 88
: (380567) 90 09 99

83087, . , 1
.: (38062) 385 48 45, 385 48 65
: (38062) 385 49 23

03057, . , 3133, . 29
.: (38044) 538 14 70
: (38044) 538 14 71

79015, . , 72, . 1
./: (38032) 298 85 85

54030, . , 25
 , 5
./: (380512) 58 24 67, 58 24 68

65079, . , 1, 213
./: (38048) 728 65 55, 728 65 35

95013, . , 43/2, 11
.: (380652) 44 38 26
: (380652) 54 81 14

61070, . , 1
 Telesens, 569
.: (38057) 719 07 79
: (38057) 719 07 49

MKP-TECHCOL36-11
04/2011