Slide 1: Batten down the hatches: Cyber threats facing DP operations
Batten down the hatches: Cyber threats facing DP operations Andy Davis, Research Director NCC Group
Slide 2: Agenda
Agenda • What are the threats? • Incidents that could have been caused by cyber attack • Short and longer term solutions to increase cyber security • The importance of security awareness
Slide 3: The threats
The threats • Control systems are becoming more complex • Older, less secure control protocols are being wrapped in IP • There is more of an expectation of remote access • Attackers are becoming more interested in non-conventional IT • The technical competence of attackers is increasing Image: www.g
Slide 4: Control system failure
Control system failure • IMCA Safety Flash 02/13 - Serious DP Diving Incident: • Loss of all analogue and digital RBUS Input / Output (I/O) signals • Loss of positioning references and environmental signals • Subsequent loss of DP control, resulting in a vessel position drift-off • Problem was conta
Slide 5: Unconfirmed cyber security anecdotes
Unconfirmed cyber security anecdotes • “An attacker managed to tilt a floating oil rig to one side off the coast of Africa, forcing it to shut down” • “One rig was so riddled with computer malware that it took 19 days to make it seaworthy again” • Attacks could “do damage to an offshore drilling rig
Slide 6: Short term solutions
Short term solutions • The active threats to DP systems should be identified through threat modelling • If software/firmware can easily be fixed to mitigate vulnerabilities this should be done • More complex design-related vulnerabilities need to be contained using segregation technologies Image: ww
Slide 7: Longer term solutions
Longer term solutions • DP systems developers need to implement an SDL (Secure Development Lifecycle) • System components and fully integrated solutions should be security regularly tested • The “bigger picture” should be considered when remote connectivity to any component is required Image: www.tr
Slide 8: Raising security awareness
Raising security awareness • Effective cyber security starts with security awareness • Understanding the fundamentals can make a huge difference: You don’t need to be an expert to spot potential security risks • Processes need to be implemented to enable people to raise potential security issues/ris
Slide 9: Questions?
Questions? UK Offices North American Offices Australian Offices Manchester - Head Office San Francisco Sydney Cheltenham Atlanta Edinburgh New York Leatherhead Seattle London Milton Keynes European Offices Amsterdam - Netherlands Andy Davis, Research Director NCC Group Munich – Germany andy.davis@ncc