SCADA Security and Privileged Access Management (PAM)

Industrial plants and power utilities commonly employ the well-established Supervisory Control and Data Acquisition (SCADA) framework to manage their Operational Technology (OT) systems. In recent years, SCADA’s cyber risk exposure has increased with the advent of the Internet and the IP-enabling of traditionally isolated SCADA system elements.

The SCADA Cybersecurity Framework recommends controls to counteract the risk of cyber attack on SCADA systems—attacks that can wreak havoc and even result in the loss of life. Access controls, including Privileged Access Management (PAM), figure prominently into SCADA security, defending industrial systems against malicious actors.

SCADA is the framework in place to manage and prevent cyber-attacks on operational technology systems like industrial plants and power utilities.

What is SCADA?

SCADA is a mature technology framework that comprises many different devices and software applications. Collectively, SCADA-driven technologies form a sort of industrial nervous system. They are found in factories, power plants, and hospitals. They also run heating and air conditioning systems in buildings. Combining sensors with supervisory computers and Remote Terminal Units (RTUs), they both monitor and control physical processes. For example, a steel mill’s SCADA system can detect when molten steel is hot enough to pour and then trigger actuators that make the steel flow into molds. SCADA also encompasses machine-to-human interfaces for reporting and control input.

SCADA Security in the Internet Age

Traditionally, SCADA security had not been a major concern for managers of SCADA systems. Using proprietary communication protocols and running on isolated networks, SCADA systems were hard to reach and challenging to hack. Security architects could point to the “air gap,” the complete separation of SCADA networks from the outside world, as an extremely robust countermeasure to potential threats.

That said, the potential impacts of attacks on SCADA systems are significant. They range from inconveniences like a power outage to outright catastrophes like a nuclear core meltdown, a dam failure, or industrial workers’ death or injury. Once remote possibilities, such potentially dire consequences are now more likely.

Two factors are increasing the risk profile of SCADA systems. First, the air gap may never have been as effective a protection layer as people thought. A number of high-profile hacks, such as the Stuxnet attack on Iranian nuclear facilities, revealed that hackers can access air-gapped systems using human engineering, USB drives, and comparable techniques.

The more important development, though, is the trend of enabling SCADA technologies with Internet Protocol (IP). This is an entirely understandable move, given how widespread and convenient IP has become. Now, SCADA systems can be completely Internet-accessible, with all the flexibility and reach that implies. Yet, from a security perspective, it’s a disaster.

The move to IP-enabled SCADA systems presents a whole new realm of possibilities for potentially catastrophic breaches.

IP-enabled SCADA systems are now just as vulnerable to attack as any other device on the Internet, if not more so. Unlike conventional IT systems like servers and databases, SCADA has been hidden behind air gaps and organizational barriers for decades. OT is not IT. SCADA entered the Internet era more or less unprepared for cyberattacks. In contrast, IT has had several challenging decades in which to learn how to defend itself from hackers. OT is usually a separate organization from IT and did not have the same kind of security mandate facing IT departments. The industry has had to rise to the occasion and devise security measures for IP-enabled SCADA systems.

The SCADA Security Framework

Industry uses NIST Special Publication 800-82 as the definitive guide on SCADA security. Revision 2, published in 2015, contains a “Guide to Industrial Control Systems (ICS) Security” as well as “Supervisory Control and Data Acquisition (SCADA) Systems, Distributed Control Systems (DCS), and Other Control System Configurations such as Programmable Logic Controllers (PLC).”

The NIST standard covers ICS risk management and assessment, security program development and deployment and security architecture. It offers extensive guidance on applying security controls to ICS. At nearly 250 pages in length, it’s beyond exhaustive. A useful, concise discussion of its controls can be found in an article published by ISACA.

PAM and SCADA Security

What’s the most important element of the NIST standard for SCADA and ICS? It’s hard to say, of course. They’re all important. To keep a SCADA system secure, security managers must perform the assessments and implement the controls recommended in the standard. One area of control, however, is foundational to the success of virtually every other aspect of the standard. This is access control, particularly control over privileged access.

Privileged Users

A privileged user is someone (or a machine) who can perform administrative functions on the back ends of critical systems. They can set up, modify, or delete user accounts. Their privileges may include the ability to configure systems, update software, and access or even delete data.

Privileged Access

Privileged Access Management (PAM), refers to a collection of practices and tools that allow administrators to oversee and govern the use of privileged user accounts. A PAM solution is software designed to control and monitor this privileged access. It also typically logs privileged account sessions for use in security incident response and investigation. In some cases, PAM solutions issue alerts for violations of privileged access policy.

PAM and the NIST Standard

The term “Privileged Access Management” does not appear in the NIST standard, but PAM principles are contained throughout. Section 5.6 of the standard, which discusses the need for “Defense in Depth,” recommends that OT security managers understand and defend against “attacks on privileged and/or shared accounts.” The standard includes a recommendation for “Restricting ICS user privileges to only those that are required to perform each person’s job (i.e., establishing role-based access control and configuring each role based on the principle of least privilege).”

NIST 800-82 also advises restricting physical access to the ICS network and devices. This recommendation relates to PAM. After all, it is nearly impossible to restrict access to physical devices yet allow them to be administrated without some sort of intermediate protection layer like a PAM solution.

Although the term “privileged access management” or “PAM” does not appear in the NIST standard, the principles PAM is able to enforce are included throughout.

The Need for a PAM Solution in SCADA

PAM provides the tools security teams need to effectively manage privileged access in complicated SCADA environment.

The standard further warns against taking a distributed approach to authentication and authorization, where each system stores its own user credentials, “Is problematic in that it does not scale well as the size of the system increases.” It notes, “For example, if a user leaves the organization, the corresponding user account must be removed from each system individually.” With centralized control over privileged users, PAM can switch off user access when the user leaves the organization. The PAM solution answers the need suggested by the standard, which states, “Authorization is enforced by some access control mechanism.”

The WALLIX Bastion PAM Solution

The WALLIX Bastion, for instance, gives SCADA managers such a mechanism. The WALLIX Access Manager consists of a centralized locus of control for all privileged access across the entire SCADA ecosystem. Privileged users log into Access Manager in order to perform privileged account operations on SCADA devices. With the WALLIX Password Manager, privileged users do not need to know the actual, physical device password. This prevents users from accidentally or maliciously breaching a physical device used in industrial control.

The WALLIX Session Manager records privileged account sessions. It makes logs and videos of sessions available to Security Operations (SecOps) teams in the event of a security incident. Session Manager provides answers to the most urgent questions that arise at such a time: Who did what, when, and to what system. Without this type of session recording, SecOps can waste precious response time trying to figure out such basic causal factors in a breach or act of sabotage.

PAM is Critical in Enforcing the SCADA Framework

SCADA security is a weighty and complex subject. The stakes are high, though, with the public at risk if threats are not properly mitigated. PAM emerges as a critical element of a SCADA security strategy. It is directly necessary to safeguard sensitive administrative access to SCADA systems. PAM is also indirect support of many other controls mandated in the NIST standard. Patching, for example, only works when PAM is in effect. Otherwise, it would be impossible to track patching effectively. PAM is a key success factor for robust SCADA security.

Interested in learning more about how the WALLIX Bastion is able to enforce the SCADA framework using robust PAM features? Get in touch for more information.