Cyber security platform and method
A method of providing cyber security to an industrial control system is described. The method includes detecting an anomaly and recording and reporting the detected anomaly to a control system within a network associated with the industrial control system. Detecting the anomaly may include recording all unauthorized attempts to connect to a communication port in the network, capturing identifying information associated with the unauthorized attempts, detecting scanning activity of a hacker in the network, detecting an attempt to manipulate a log file to conceal malicious activity in the network; and recording and reporting the detected anomaly to a controller within the network
1 . An industrial control system comprising:
a controller configured to operatively couple to at least a sensor and an actuator device on a network, the controller including one or more computer processors and one or more computer-readable storage media; and
a cyber security platform for detecting network intrusions and/or anomalous behavior on the industrial control system, the cyber security platform comprising program instructions stored on the one or more computer-readable storage media for execution by at least the one or more processors, the program instructions including:
program instructions to keep out unauthorized users from changing a mode of the controller based on a virtual key lock;
responsive to detecting a second controller or a communication point attempting to connect to the network, program instructions to record at least one of: an Internet Protocol version 4 (IPv4)/Internet Protocol version 6 (IPv6) address of an initiating host, a Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) port number, a subject name in a certificate provided by the initiating host, a certificate thumbprint, or a status indicating a success or failure to connect to the network;
responsive to detecting open port scanning activity on the network, program instructions to record information associated with the open port scanning activity including a source Internet Protocol (IP) address, a destination port, a network protocol (TCP or UDP), or incoming packet rates;
responsive to detecting a system time change, program instructions to record an IP address that initiated the system time change and at least one of: a time change or a current system time; and
responsive to detecting either the second controller or a communication point attempting to connect to the network, open port scanning activity on the network, or a system time change, program instructions to initiate an alert on an alert device connected to the controller, wherein the alert indicates an intrusion is detected.
2 . The industrial control system of claim 1 , wherein the program instructions to keep out unauthorized users from changing a mode of the controller based on a virtual key lock includes program instructions to log all access and changes of the virtual key lock.
3 . The industrial control system of claim 1 , further comprising program instructions to protect communication within the industrial control system based on integrated authentication keys.
4 . The industrial control system of claim 3 , wherein the integrated authentication keys are authenticated by a known root of trust.
5 . The industrial control system of claim 4 , where the known root of trust is included in a certificate of authority.
6 . The industrial control system of claim 1 , further comprising program instructions to establish communication protocol with legacy Programmable Logic Controllers (PLC) and Distributed Control Systems (DCS).
7 . The industrial control system of claim 1 , further comprising program instructions to establish communication protocol between legacy Programmable Logic Controllers (PLC) and Distributed Control Systems (DCS) and secure Supervisory Control and Data Acquisition (SCADA) platforms.
8 . The industrial control system of claim 6 , wherein the program instructions to establish communication protocol with legacy Programmable Logic Controllers (PLC) and Distributed Control Systems (DSC) further comprises:
program instructions to introduce an Open Source Automation (OSA) controller and a secure gateway module into an existing control network;
program instructions to collect and translate data from legacy PLC protocols into a secure messaging format;
program instructions to encrypt the data using integrated authentication keys;
program instructions to transmit data via electromagnetic signals across a pin-less backplane to the OSA controller; and
program instructions to transmit data to secure Supervisory Control and Data Acquisition (SCADA) platforms.
9 . The industrial control system of claim 1 , further comprising:
a status Light Emitting Diode (LED) configured to provide smart indication locally when an intrusion is detected,
wherein the program instructions to initiate an alert on an alert device include initiating the status LED.
10 . An industrial control system comprising:
a sensor;
an actuator device;
a controller operatively coupled to the sensor and the actuator device on a network, the controller including one or more computer processors;
one or more computer-readable storage media;
a cyber security platform for detecting network intrusions and/or anomalous behavior on the industrial control system, the cyber security platform comprising program instructions stored on the one or more computer-readable storage media for execution by at least one of the one or more processors, the program instructions including:
program instructions to keep out unauthorized users from changing a mode of the controller based on a virtual key lock;
responsive to detecting a second controller or a communication point attempting to connect to the network, program instructions to record at least one of: an Internet Protocol version 4 (IPv4)/Internet Protocol version 6 (IPv6) address of an initiating host, a Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) port number, a subject name in a certificate provided by the initiating host, a certificate thumbprint, or a status indicating a success or failure to connect to the network;
responsive to detecting open port scanning activity on the network, program instructions to record information associated with the open port scanning activity including at least one of: a source Internet Protocol (IP) address, a destination port, a network protocol (TCP or UDP), or incoming packet rates;
responsive to detecting a system time change, program instructions to record an IP address that initiated the system time change and at least one of: a time change or a current system time; and
responsive to detecting either the second controller or a communication point attempting to connect to the network, open port scanning activity on the network, or a system time change, program instructions to initiate an alert on an alert device connected to the controller, wherein the alert indicates an intrusion is detected.
11 . The industrial control system of claim 10 , wherein the program instructions to keep out unauthorized users from changing a mode of the controller based on a virtual key lock includes program instructions to log all access and changes of the virtual key lock.
12 . The industrial control system of claim 10 , further comprising program instructions to protect communication within the industrial control system based on integrated authentication keys.
13 . The industrial control system of claim 12 , wherein the integrated authentication keys are authenticated by a known root of trust.
14 . The industrial control system of claim 13 , where the known root of trust is included in a certificate of authority.
15 . The industrial control system of claim 10 , further comprising: program instructions to establish communication protocol with legacy Programmable Logic Controllers (PLC) and Distributed Control Systems (DCS).
16 . The industrial control system of claim 15 , wherein the program instructions to establish communication protocol with legacy Programmable Logic Controllers (PLC) and Distributed Control Systems (DSC) further comprises:
program instructions to introduce an Open Source Automation (OSA) controller and a secure gateway module into an existing control network;
program instructions to collect and translate data from legacy PLC protocols into a secure messaging format;
program instructions to encrypt the data using integrated authentication keys;
program instructions to transmit data via electromagnetic signals across a pin-less backplane to the OSA controller; and
program instructions to transmit data to secure Supervisory Control and Data Acquisition (SCADA) platforms.
17 . The industrial control system of claim 10 , further comprising a status Light Emitting Diode (LED) configured to provide smart indication locally when an intrusion is detected,
wherein the program instructions to initiate an alert on an alert device include initiating the status LED.
18 . A cyber security program product for detecting network intrusions and/or anomalous behavior on an industrial control system, the industrial control system having a controller operatively coupled to at least a sensor and an actuator device on a network, the cyber security program product comprising:
one or more computer-readable and non-transitory storage media and program instructions stored on the one or more computer-readable and non-transitory storage media, the program instructions configured to be performed by the controller of the industrial control system, the program instructions including:
program instructions to keep out unauthorized users from changing a mode of the controller based on a virtual key lock;
responsive to detecting a second controller or a communication point attempting to connect to the network, program instructions to record at least one of: an Internet Protocol version 4 (IPv4)/Internet Protocol version 6 (IPv6) address of an initiating host, a Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) port number, a subject name in a certificate provided by the initiating host, a certificate thumbprint, or a status indicating a success or failure to connect to the network;
responsive to detecting open port scanning activity on the network, program instructions to record information associated with the open port scanning activity including at least one of: a source Internet Protocol (IP) address, a destination port, a network protocol (TCP or UDP), or incoming packet rates;
responsive to detecting a system time change, program instructions to record an IP address that initiated the system time change and at least one of: a time change or a current system time; and
responsive to detecting either the second controller or a communication point attempting to connect to the network, open port scanning activity on the network, or a system time change, program instructions to initiate an alert on an alert device connected to the controller, wherein the alert indicates an intrusion is detected.