A security checklist for SCADA systems in the cloud

Given the critical nature of operations that supervisory control and data acquisition (SCADA) systems manage, an article containing the words “cloud,” “SCADA” and “vulnerabilities” together should raise the hair on the necks of information security professionals.

Traditionally, SCADA applications used to control critical infrastructure have been hosted within an organization’s IT infrastructure and have relied on the protection offered inside the infrastructure perimeter. In some cases, organizations have “air gapped” their SCADA applications from the broader network and particularly from the Internet. 

Today, organizations have recognized the advantages of cloud-based computing and are migrating their SCADA applications into the cloud environment to reduce costs, gain efficiencies and increase reliability. Because it is still relatively new, we have yet to see many cyberattacks on cloud-based SCADA systems, but that is sure to change with time. More troubling, however, is that attacks against cloud-based SCADA applications can be disproportionately harmful because of their criticality.

Considering the risks

Before moving SCADA applications to the cloud, the security risks must be considered with eyes wide open. Although cost reduction and increased efficiency are significant business drivers, so too is security. The impacts of data loss/compromise, loss of organizational control and denial of service should be balanced against the advantages of cloud-based SCADA hosting. Organizations must establish their risk tolerance and their level of comfort with giving up the control they may currently exercise through internal IT infrastructure hosting.

The importance of vulnerability management with cloud-hosted SCADA systems is paramount. So is consideration of the security flaws inherent in current SCADA protocols. For instance, Modbus and DNP3 – today’s most common SCADA protocols – do not support or perform authentication and encryption.

Correction: DNP3 does support support authentication.  See comments below for additional details.

Consequently, organizations must be able to continually monitor vulnerabilities in security controls protecting SCADA applications and ensure their ongoing remediation. SCADA systems need to be treated differently than most other IT systems, and the timeframe for mitigation of vulnerabilities is much shorter. Acceptance of risks in SCADA system controls should approach zero.

The results of this risk assessment should provide the data needed for a sound decision about moving SCADA applications to the cloud. If information security risk is evaluated the same way as cost, efficiency and reliability needs, then a cloud migration decision will be on solid footing.

After an organization decides to proceed to the cloud, it will need to identify a service provider.

Any cloud provider must be able to satisfy security controls requirements. For SCADA applications, there must be high assurance that the provider can demonstrate the ability to provide and maintain strong security mechanisms and processes. The following areas should be considered when evaluating cloud provider capabilities.

1. Data separation. Confirm that the provider can segregate customers’ data and applications from each other.
2. Infrastructure control. Determine how much control customers have over changes to the provider’s infrastructure. For instance, clients should be alerted when updates to the back-end infrastructure are made and when new third-party connections are initiated.
3. Encryption. Ensure the cloud provider can encrypt data at rest.
4. Patching. Determine the provider’s ability to automatically patch known vulnerabilities at a rate consistent with organizational policy.
5. Reporting. Determine if the provider is able to provide standard and ad hoc reports that satisfy business needs.
6. Continuous monitoring. Confirm that the provider has a continuous monitoring capability that includes automated and manual near-real-time assessments of the effectiveness of security controls.
7. Situational awareness. Ensure there is a capability for capture and analysis of all log data and real-time detection, response and analysis of events, incidents and suspicious or abnormal activities.
8. Remediation. Understand the provider’s commitment to immediate corrective action of all vulnerabilities identified.
9. Staffing. Determine the availability of sufficiently trained, dedicated security staff.

The most effective means of ensuring the protection of a cloud-based SCADA application is to negotiate an effective, measurable service level agreement that covers the above areas. Paying a premium for delivery of secure cloud-based services at this level is probably justified, considering the risks involved.

Migration of SCADA applications to the cloud is a relatively new business strategy that warrants caution. While increases in savings and efficiency are undeniable, the criticality of SCADA systems justifies a “go slow” approach until there is assurance that the cloud provider can secure critical business data.