Enhancing SCADA System Security

Moustapha Fall, Chris Chuvalas, Nolan Warning, Max Rabiee, and Carla Purdy
Department of Electrical Engineering and Computer Systems
University of Cincinnati
Cincinnati, OH, USA
[email protected],[email protected],[email protected],[email protected],[email protected]

Abstract- Today’s Supervisory Control and Data environment. However, as systems become more complex,
Acquisition (SCADA) networks manage power grids, water managing system security also becomes more difficult.
and sewer systems, automated factories, and many other Figure 1 [2] shows an example of a SCADA network.
complex systems. As these systems have evolved, so have the From this figure, we can clearly see that there are
security challenges they face. We describe our research in opportunities, both human and cyber, for network intrusions.
strengthening SCADA security through development of a A system could be attacked through the business enterprise
test bed for experimentation, formal system modeling, network, at some vulnerable point on the shop floor,
efficient implementation of security protocols, and wirelessly through an email or web link, going, for example,
consideration of human factors impacting system security. to an HMI or PLC, or even through a WAN or through a side
channel attack from a van outside of a building. A famous
Keywords: cyber-physical security, automated early example of such an intrusion was the STUXNET attack
manufacturing, automated resource management, SCADA launched on the supposedly secure air-gapped Iranian
systems, human factors impacting security, trusted centrifuge facility in 2007 [3], where the malicious code was
systems. introduced via a flash drive carried into the facility. This
attack eventually infected many similar systems in other
I. INTRODUCTION facilities around the world. Another widely studied successful
A typical supervisory control and data acquisition attack is the December 2015 attack on the Ukrainian power
(SCADA) network contains sensors, conversion units, grid, which used multiple entry points and relied on a number
interfaces, and network communications. Sensors collect data, of common computer hacking tools, including some targeting
which conversion units then convert into digital information. the enterprise software, as well as others targeting the SCADA
The most common conversion units are remote terminal units infrastructure itself. [4].
(RTUs) and programmable logic controllers (PLCs). An RTU
is a microprocessor-controlled device that interfaces with
sensors and sends data to the master unit, typically using
telemetry. A PLC is a hardened industrial computer that is
specialized for processing outputs. Interfaces can be either
software programs or human machine interfaces (HMIs) that
allow the user to interact with collected and processed data.
Common HMIs include graphical user interfaces, computer
monitors, and touchscreens. The final part of a typical
SCADA system is the communications network. This is the
method of communication between other parts in the system.
Communication networks can be broken up into two groups:
wired (Ethernet, telephone lines) or wireless (radio, cellular,
satellite). In 1993 MacDonald described the advantages of Fig. 1. Part of a SCADA network [2].
SCADA management [1], which can include improved The continuing possibility of attacks on SCADA systems
efficiency and response time. Today’s SCADA networks can managing infrastructure and manufacturing motivate our
perform many additional tasks, including managing multi-pronged approach to enhancing security for these
performance degradation in electrical distribution during systems. Our approach includes developing a database of
power outages or severe weather, smart resource allocation, known attacks, formal system modeling, efficient
and scheduled maintenance tasks. With added AI capabilities, implementation of security protocols, and research into human
SCADA networks can also manage “smart” allocation of factors (as described by Stewart [5]). All of these components
resources in a network such as the electrical grid, for example, are critical for building secure, trustworthy SCADA systems.
contributing to reduced use of resources and improving the In this paper we focus on the system infrastructure and the

978-1-7281-8058-8/20/$31.00 ©2020 IEEE 830

Authorized licensed use limited to: MEHRAN UNIV OF ENGINEERING AND TECHNOLOGY. Downloaded on October 04,2021 at 17:54:51 UTC from IEEE Xplore. Restrictions apply.
 testbed we are building to enable protection of the SCADA light bulb turning on and off. The water impeller and drain
network itself. We outline some of the work that has been pump require more than just an on or off signal. They also
done in this area and we describe the work in progress on our need an operating frequency to control the motor’s speed. This
testbed. The testbed also provides training and research signal is supplied by a variable frequency drive (VFD) and is
projects for our graduate and advanced undergraduate students used to control the motors. These outputs can connect to a
in the areas of security and trust for cyber-physical systems. PLC which will manage and monitor the entire process.
What’s the purpose of creating such a small SCADA
II. PREVIOUS WORK system like this dishwasher example? The answer is testing.
In 2008 Ten et al. [2] proposed an automated probabilistic SCADA systems are used in both industrial processes
approach that recurrently tests a SCADA system at 3 levels-- (manufacturing, fabrication, refining), and infrastructure
overall system, scenarios, and access points. This method, processes (water treatment, oil and gas pipelines, power
which would be especially useful when a system is being generation and distribution). Down time in these systems can
designed or modified, provides an assessment of security result in profit loss, physical damage, and even loss of life.
needs but does not give specific ways to address those needs. This means that some SCADA systems have little to no down
In 2009 Queiroz et al. [6] described a modular testbed design, time after installation. And, even if a system does have
which can be configured to mimic different architectures, downtime, that time is used for maintenance instead of
protocols, and attacks, including DoS and DDoS attacks. upgrading and security testing. This is where a SCADA
Their system includes a variety of devices common to testbed comes in handy. A testbed is an accurate model of a
SCADA systems at that time. The testbed we are building real-world process and is modular, reconfigurable, and able to
will be similar to this one but will include up-to-date simulate a large network with few hardware devices.
components and communication paths and will also consider Important uses for a SCADA test bed are vulnerability
additional attack scenarios that are continually being assessment and penetration testing. [4] Penetration testing is
developed by today’s clever hackers. In the last few years, an authorized simulated cyber-attack against a computer
many researchers have considered the issues involved in system to check for exploits and vulnerabilities.
guaranteeing security in SCADA systems. Examples of In building our SCADA testbed, we broke up the
attacks and/or method for defending against attacks are given construction into several different parts to ease the learning
in [7-23]. Projects using model checking, machine learning, process along the way. First, we set up our hardware, and
and game theory are described in [24-28]. These typically try installed the latest version of firmware. Specifically, we used
to build in defenses as the SCADA system is developed, as an Allen-Bradley 1756-A7 PLC, and an Allen-Bradley
recommended for system development in general by Kocher et PanelView 5310 HMI. Once both systems were up to date, we
al. [29]. In the system we are building we are aiming to integrated them together using Ethernet on a simple LAN
incorporate many of the techniques described in these earlier network. Next a basic program was programmed into the PLC,
papers, including design for security, use of formal system using Studio 5000 Logix Designer, to demonstrate the
specification, and AI techniques for detecting malicious connection. This setup is shown in Figure 2. In this case we
attacks. Unlike some of the work done previously, we are used the dishwasher example from above and had the outputs
aiming to develop general modeling and security techniques in displayed on a custom HMI screen, as shown in Figure 3.
order to provide general defense strategies that can be applied The network setup is show in Figure 4.
to any SCADA system.

III. A TESTBED FOR SCADA RESEARCH

To explain our current system we use a simple example of
a SCADA system, based on a dishwasher. Upon start up, soap
is released using a solenoid. Next water is added by opening
the hot water valve. Then the washer impeller is activated to
Fig 2. PLC/HMI Network Fig. 3. HMI Output Screen
mix the soap with hot water. After that the rainwater valve is Lockheed-Martin has created a “Cyber Kill Chain”, which
opened to rinse off the dishes. Next, the drain pump is turned is a model to demonstrate how an intruder would attack a
off to remove all the water from the system. Finally, the system or process in the digital realm, and actions that can be
heating element is activated during the drying cycle. taken to prevent them. [30] The kill chain phases include
Typically, a panel displays the current dishwasher status to the reconnaissance, weaponization, delivery, exploitation,
user. This simple example can be turned into a SCADA installation, command and control, and action on objective.
system. Sensors could be used to monitor the system, but to For this example we are going to execute the reconnaissance
keep it simple the electric outputs to the devices will be phase. The goal of this phase is to research and identify
monitored. Simple outputs include the solenoid, valves, and vulnerabilities of the target. Using Nessus Essentials by
heating elements that require a signal to activate. Monitoring Tenable Inc. we were able to identify important information
of these outputs is displayed as on when given a signal and off about the testbed we set up that could be used for further
without one. These devices can be represented by a simple exploitation. By default, the PLC is set up to supply the end

831

Authorized licensed use limited to: MEHRAN UNIV OF ENGINEERING AND TECHNOLOGY. Downloaded on October 04,2021 at 17:54:51 UTC from IEEE Xplore. Restrictions apply.
 user with as much information as possible. This is extremely production environment. So this test is simulated what is
helpful for PLCs set up in remote locations where physical happening in real life. The code allows us to read and write
access is limited after installation. With the default the state of the tag from the Allen Bradley 1756-L81ES
configurations, the PLC responds to ARP request, service ControlLogix 5580 controller. This demonstrates that
scans, TCP port scans, and ping request. This provides someone with bad intentions could have access to this code
information like MAC address, applications running on the from the local network and could change some values inside
PLC, and the devices operating system. In addition, from the the code. We list some potential values that could be changed
scan we learned that the PLC is also hosting a website that has and their impact:
information about the program running, firmware version, • Changing a value of a motor could stop a motor from
controller mode, controller status, and fault status, as shown in running or start a motor that was not supposed to be
Figure 5. This is all valuable information that could be used to running.
further exploit the system, either internally, through the MAC • Changing the frequency value or the speed of a
address, or externally, through the website itself. variable frequency drive (VFD) could accelerate a
motor or accelerate a motor while in the middle of
production.
• Changing a value of any digital output to a zero or to
a one while the system is running can be damaging if
the initial plan was to let the system run without
changing anything.
We can now write Pycomm code to do the following:
1) Open communication to the PLC controller using the IP
address
2) Read the tag value of the word
3) Print that value
4) Write a value to the PLC tag
5) Close the connection
This will now allow us to easily create malware to cause
our dishwasher example to act incorrectly. We use the
system’s Sequencer Output (SQO) to simulate correct and
Fig. 4. Network diagram of final SCADA testbed setup incorrect (hacked) dishwasher operation.
Correct operation: Create operation scheme for using
output matrix in sequencer--Ladder Logic Summary:
Output Labels: Solenoid (soap release), Input Valve (hot
water), Washer Impeller, Rainwater Valve, Drain Pump and
Heating Element.
a. Rung01: Timer_SQO is used and it is triggered by
the My_Control.EN bit and the Timer_SQO.DN bit.
b. Rung02: Test_Bit to Control the first SQO on
Rung03.
c. Rung04: Second SQO is being controlled by the
Timer_SQO.DN bit
d. Rung05: Both sequencer output control bits reset
e. Timer_SQO.ACCUM and Timer_SQO.PRE values
change according to what output is being triggered.
Now we can define a Data Array to properly sequence the
Fig. 5. Homepage of local server hosted by the PLC.
dishwasher activities and define the length of each:
IV. EXAMPLE EXPERIMENTS 1. Energize the soap solenoid first for four seconds
2. Energize the input valve for hot water for five minutes
To access the PLCs in the system, we used Pycomm,
3. Energize the washer impeller for twelve seconds
which is available at https://pypi.org/project/pycomm/. This
4. Open the rainwater valve for one second
version works with Python 2.7 and has a module ab-comm
5. Open the drain for three seconds
which can interface with our Allen Bradley PLCs using the
6. Turn on the heat for six seconds.
Ethernet/IP protocol.
But it is easy for a hacker to write Pycomm code. Using
We downloaded the Pycomm software in one laptop, we
the Pycomm code, it is possible to change the event orders by
plugged the laptop to the switch and gave it access to the local
simply changing the values on the Data_Array tags, so that the
network so that it can communicate with the PLC. This type
dishwasher functions are done in the wrong order, and thus the
of connection or wireless connection is exactly how an
dishwasher will not work corrrectly. This is only one simple
engineer would communicate with his PLC controller in a real

832

Authorized licensed use limited to: MEHRAN UNIV OF ENGINEERING AND TECHNOLOGY. Downloaded on October 04,2021 at 17:54:51 UTC from IEEE Xplore. Restrictions apply.
 example of how a hacker could disrupt the system functions. [9] Z. El Mrabet, N. Kaabouch, H. El Ghazi, and H. El Ghazi, “Cyber-
security in smart grid: Survey and challenges,” 2018.
This could be prevented by requiring authentication of
[10] A. Ghaleb, S. Zhioua, and A. Almulhem, “On PLC network security,”
messages, e.g. Similarly, a hacker could change the VFD Int. J. Crit. Infrastruct. Prot., vol. 22, pp. 62–69, 2018.
speed, since the PLC will accept unauthenticated messages. [11] T. Alves and T. Morris, “OpenPLC: An IEC 61,131–3 compliant open
source industrial controller for cyber security research,” Comput. Secur. vol.
V. CONCLUSIONS 78, pp. 364–379, 2018.
[12] E. N. Ylmaz, B. Ciylan, S. Gönen, E. Sindiren, and G. Karacayilmaz,
These simple examples illustrate the need for better “Cyber security in industrial control systems: Analysis of DoS attacks against
security in our system. Currently we are unable to implement PLCs and the insider effect,” Proc. 6th Int. Istanbul Smart Grids Cities
specific security options due to losing access to our lab during Congr. Fair, ICSG 2018, pp. 81–85, 2018.
[13] J. Stranahan, T. Soni, and V. Heydari, “Supervisory control and data
the ongoing pandemic. Once we regain access, we will apply acquisition testbed for research and education,” 9th Annual CCWC, 2019.
one or more of the strategies outlined in the references to fix [14] R. L and P. Satyanarayana, “Vulnerability analysis and enhancement of
this problem. We will also examine additional examples of security of communication protocol in industrial control systems,” HELIX
security problems in this and similar systems. vol. 9, no. 4, pp. 5122–5127, Aug. 2019.
[15] H. Hui, P. Maynard, and K. McLaughlin, “ICS interaction testbed: a
platform for cyber-physical security research,” 6th International Symposium
VI. FUTURE WORK
for ICS & SCADA Cyber Security Research, 2019.
The work outlined here forms the basis for our continued [16] H. Lan, X. Zhu, J. Sun, and S. Li, “Traffic data classification to detect
efforts to improve SCADA security. Our program for future man-in-the-middle attacks in industrial control system,” 6th Int. Conference
on Dependable Systems and Their Applications (DSA), 2020, pp. 430–434.
work includes: [17] A. A. Letichevsky, O. O. Letychevskyi, V. G. Skobelev, and V. A.
• continued development of our testbed platform once lab Volkov, “Finger printing for cyber-physical systems,” Cybern. Syst. Anal. vol.
work is again permitted at our university; 53, no. 6, pp. 821–834, 2017.
[18]S. Adepu, N. K. Kandasamy, and A. Mathur, “EPIC: An electric power
• development of a database of SCADA attacks and methods
testbed for research and training in cyber physical systems security’”,
to prevent these attacks. Many of the papers cited in the Computer Security, 2018, Springer.
section on previous work provide examples that can be [19] J. M. Hamamreh, H. M. Furqan, and H. Arslan, “Classifications and
included in our database; applications of physical layer security techniques for confidentiality: a
comprehensive survey,” IEEE Commun. Surv. Tutorials, vol. 21, no. 2, pp.
• construction of efficient AI-based tools to detect and 1773–1828, Apr. 2019.
protect against attacks. We will use methods similar to [20] R. Negi, P. Kumar, S. Ghosh, S. K. Shukla, and A. Gahlot,
those in [31] to develop these tools; “Vulnerability assessment and mitigation for industrial critical infrastructures
• use of formal and practical methods to model SCADA with cyber physical test bed,” Proceedings 2019 IEEE International
Conference on Industrial Cyber Physical Systems, (ICPS 2019), pp. 145–152.
systems and to further enhance our ability to detect and [21] Y. Li, W. Huo, R. Qiu, and J. Zeng, “Efficient detection of false data
defend against attacks. Here we will use tools such as injection attack with invertible automatic encoder and long-short-term
UML, SysML, and TLA+ [32] memory,” IET Cyber-Physical Syst. Theory Appl 5 (1), pp. 110–118, M2020.
[22] J.-M. Lee and S. Hong, “Keeping host sanity for security of the SCADA
• identification of strategies to reduce malicious behavior by
systems,” IEEE Access, March 2020.
users of SCADA systems, starting with the methods [23] A. Bichmou, J. Chiocca, L. Hrnandez, R.W. Hoffmann, B. Horsham, H.
suggested in [26] and [32]. Lam, V. McKinsey, and S Bibyk, “Physical cybersecurity of SCADA
systems,” IEEE NAECON, 2019.
ACKNOWLEDGMENT: The authors would like to thank [24] R. Shrestha, H. Mehrpouyan, and D. Xu, “Model checking of security
Rockwell Automation for providing equipment and guidance properties in industrial control systems (ICS),” Proc. 8th ACM Conf. Data
Appl. Secur. Priv., pp. 164–166, 2018.
and Automation Plus for for assistance in this project. [25] T. Alves, R. Das, and T. Morris, “Embedding encryption and machine
learning intrusion prevention systems on programmable logic controllers,”
REFERENCES IEEE Embed. Syst. Lett., vol. 10, no. 3, pp. 99–102, 2018.
[1] J.D. McDonald, “Developing and defining basic SCADA system [26] H. Zhang, S. Merz, and M. Gu, “Specifying and verifying PLC systems
concepts,” 1993 Rural Electrical Power Conference, April 1993. with TLA +:A case study,” Comput. Math. with Appl. 60, pp. 695–705, 2010.
[27] L. Reuter, O. Jung, and J. Magin, “Neural network based anomaly
[2] C.-W. Ten, C.-C. Liu. And G. Manimaran, “Vulnerability assessment of
detection for SCADA systems,” 23rd Conf. Innov. Clouds, Internet Networks,
cybersecurity for SCADA systems,”, IEEE Transactions on Power Systems
pp. 194–201, 2020.
23 (4), November 2008.
[28] T. Zheng, Q. Hong, L. Xi, S. Yizheng, and D. Jie, “A security defense
[3] R. Langner, “STUXNET: discussing a cyberwarfare weapon,” IEEE
model for SCADA system based on game theory,” ICMTMA 020.
Security and Privacy 9 (3), May-June 2011.
[29] P. Kocher, R. Lee, G. Mcgraw, and A. Raghunathan, “Security as a new
[4] ICS-CERT, Cyber-Attack Against Ukrainian Critical Infrastructure (IR-
ALERT-H-16-056-01), 2016. dimension in embedded system design,” Proc. 41st Annual Design Automation
[5] A. Stewart, The Community Defense Approach: A Human Approach to Conference, June 2004, pp. 753-76.
Cybersecurity for Industrial and Manufacturing Systems, M.S. Thesis, [30] E.M. Hutchins, M.J. Cloppert, and R.M. Amin, “Intelligence-driven
University of Cincinnati, 2019. computer network defense informed by analysis of adversary campaigns and
[6] C. Queiroz, A. Mahmood, J. Hu, Z. Tari, and X. Yu, “Building a SCADA intrusion kill chains”, Lockheed Martin Corporation, 2011.
security testbed,”, Third IEEE International Conference on Network and [31]K. Al Rawashdeh, Toward a Hardware-Assisted Online Intrusion
Systems Security, 2009. Detection system Based on Deep Learning Algorithms for Resource-Limited
[7] G.P.H. Sandaruwan, P.S. Ranaweera, and V.A. Oleschuk, “PLC security Embedded Systems, Ph.D. Dissertation, University of Cincinnati, 2018.
and critical infrastructure protection,” Eighth IEEE International conference [32] N. Obeidat and C. Purdy, “Modeling a smart school building system
on Industrial and Information Systems, December 2013. using UML and TLA+,” 3rd Internatioa Conference on Information and
[8] Y. Wang, J. Liu, C. Yang, L. Zhou, S. Li,, And A. Xu, “Access control Computer Technologies, 2020.
attacks on PLC vulnerabilities,” Journal of Computers and Communications
6, pp. 311-325, Nov. 2018.

833

Authorized licensed use limited to: MEHRAN UNIV OF ENGINEERING AND TECHNOLOGY. Downloaded on October 04,2021 at 17:54:51 UTC from IEEE Xplore. Restrictions apply.