How to detect or prevent SCADA protocol commands activity on specific time or date

[Eyal_Rashelbach]

Hi Everyone,

Time determined activities in ICS network are common in use. An anomaly can be devastating and as a result might be a threat to the ICS network. Even a simple fuzzing attack can trigger a time determined activity, harming the ICS network normal behavior. As a consequence it is required to detected or even prevented improper triggering of such activities. Logic protections on the PLC side can prevent this risk, however in most cases OT people don’t implement the required protection.  
Following we will see how we can create an application based on SCADA protocol command and address which trigger the proper ICS activity , link it with a policy and detect and prevent it based on time configuration

Let consider that we manage an Industrial Control system based on Modbus protocol. The process requires a daily machinery backwash sequence at a specific time of the day. During the rest of the day we want to be advised or even to block any attempt to start the backwash sequence, as it can damage or even cause production to stop.

How we can solve this necessity with Check Point ICS solution:

1. In the application control blade, we will create an application to monitor the Modbus write function command for a single address in the PLC, which is responsible for the activation of the backwash sequence.
   
2. In addition we will create a new policy and link it with application we created. As the sequence activation out of the required time might harm the process, we will rank the policy as high risk.
   
3. Now we can modify the policy time configuration to meet our operational requirements, restricting the command execution out of the permitted hours. The application control blade allows us to configure the time on daily based, days of the week and days of the month. This provide us wider flexibility while required to configure policy time restrictions. Any attempt to start the backwash out of the required time, would be blocked and will not arrive to the destination PLC address.  
   

 

For further information please contact .

Shlomi Feldman

ICS Solution Expert

Direct line: +972-73-2265136

Cell:           +972-54-5583040

[Shlomi_Feldman]

Thanks Eyal

[Iain_King]

I'm very curious to know how this is going to work in R80.20.. I see that the application control for Modbus was just removed in R80.20.

Do you have any information on that?

[Sunny_Gill]

Hi Iain,

SCADA Protocols, Functions & Commands are still available in Application Control blade in R80.20. What has been (re)moved is Deep Protocol Inspection of Modbus and three other protocols that allowed 'value-based' policy i.e. the ability to do a policy not only on the protocol, function/command but the value too. This ability is now available as an API rather than a GUI function of Application Control. You can find more details in the ICS user guide