surviving the digital storm - cyber summit...

1©2019 Check Point Software Technologies Ltd.

Joel Hollenbeck, Director of EngineeringOffice of the CTO

Surviving the Digital StormIoT Security DELUGE


Shadow/ Unmanaged Devices

ENTERPRISE IoT/OT ENVIRONMENT HAS GROWN INCREASINGLY COMPLEX

Smart Building/Office Devices

Operational Technology (OT)

Medical Devices

General IoTMany types of devices & vendors

Different protocols and behaviours

YOUR ORGANIZATION

?

?

?

?

?

?


ATTACK LANDSCAPE

•Triton –Tampering with SIS systems (ME)

Dec/2017

•Industroyer –High voltage station shut down using backdoors and IEC protocol flaws (Ukraine)

2016

•Black Energy –Cut off electricity via HMI remote control (Ukraine)

2015

•Energetic bear – 3 SCADA software suppliers infected (US/Europe)

2014

•Stuxnet –Uranium production centrifuges sabotaged by compromising SCADA system (Iran)

2009

•Slammer –Attacks SIS in nuclear plant (US)

2003

Nation states heavily involved


IoT/OT DEVICES ARE VULNERABLE AND EASY TO HACK

June 19: Attacker can remotely manipulate infusion pumps, either to withhold meds or dispense too much.

BD Alaris Gateway Workstation

Infusion Pump

Rockwell Energy Smart MeterFeb. 19: Power monitors used by energy companies worldwide can be remotely manipulated by hackers.

Industrial Smart Meter

Chinese-Made CamerasAug. 19: Millions Of Chinese-Made Cameras Can Be Hacked To Spy On Users.IP Camera


IoT/OT DEVICES ARE VULNERABLE AND EASY TO HACK

Weak Password

No Built-in Security

Difficult to Patch

Risk to IoT Devices Damage, manipulation, or Downtime

Risk to NetworksLateral movement infecting other systems


TRADITIONAL SECURITY SOLUTIONS DON’T CUT IT…

YOU CAN’T PROTECT WHAT YOU CAN’T SEE,

OR UNDERSTAND…

Limited Visibilityinto IoT devices and their vulnerabilities

of IoT device behavior and security Needs Insufficient Knowledge

IoT specific threat intelligence is missingNo Threat Prevention


IoT DEFENSESmart Security for Smart Devices

See All your Devices, their Attributes and Risk Level

IOT DISCOVERY & VISIBILITY

Minimize Attack Surfaces Without Disrupting Critical Processes

ZERO TRUST IOT

Block IoT Related Attacks

IOT THREAT PREVENTION


DISCOVER DEVICES CONNECTED TO YOUR NETWORK

Smart Office

Printers TV VOIP Phone

Smart Building

IP Camera Smart elevatorSmart Thermostat

Operational Technology (OT)

HMI PLC Barometer

Healthcare

MRI Infusion Pump Patient Monitor


Dynamically Calculated Risk Score

[Internal Use] for Check Point employees

CLASSIFY DEVICESUSING UNIQUE IDENTIFIERS

Granular Device Attributes

Communication Patterns


Weak Password 1111

Functionality & SeverityCritical

Legacy Operating SystemWindows 95

CVECVE-2018-10601

Patient Monitor

No. Name Source Destination Service & Application Action

1 High Risk RISK=HIGH Any Any High Risk

2 Patient Monitor Patient Monitor External Zone Any Drop

IDENTIFY HIGH RISK DEVICES AND PROTECT THEM WITH RISK BASED ACCESS POLICY

Prevent From High Risk Patient Monitor To Communicate With The Internet


ONVIF Protocol VMS

IP Camera

Smart Office IoT

IDENTIFY AND CONTROLIOT/OT PROTOCOLS AND COMMANDS

ModbusProtocol

Limited to only 4 specific

CommandsSCADA Server/HMI

PLC

OT

DICOMProtocol

MRI

PACS

Medical Devices

Source Destination Service & Application

IP CAM VMS ONVIF protocol


MRI PACS DICOM protocol


HMI PLC Modbus protocol - read input register

Modbus protocol - read holding registers

Modbus protocol - write multiple coils

Modbus protocol - write multiple registers


A POLICY FOR EVERY IOT DEVICE ENTERPRISE IoT EXAMPLE

Application Authorized Traffic

IP Camera Video Management System

No. Name Source Destination Service & Application Action

1 IP CAM to VMS IP CAM VMS ONVIF Protocol Accepted


Virtual Patching 300+ IPS Signatures

against IoT related Threats

Powered by

PROTECT VULNERABLE DEVICES WITHOUT THE NEED FOR PHYSICAL PATCHING

Infusion Pump IP Camera PLC


Smart Office & Smart Building Protect your business from

corporate spying

IoT DEFENSENeeds to be Tailored to various IoT/OT Environments

Industrial Ensure Reliable and

safe operations

HospitalsEnsure patient safety and

data confidentiality


SECURITY GW

IP Camera

IDENTIFY AND BLOCK UNAUTHORIZED ACCESSTO AND FROM IoT DEVICES

BlockxServer Update

V Allow

Video Management Server

V Allow

Internet


POLICY ENFORCEMENT

zone 2zone 3

zone 1

§ Check Point security gateways are being deployed inside the network in order to enforce the IoT policy

§ Threat prevention engines including IPS, APPI and Anti-Bot are activated inside the security gateways in order to identify and block malicious traffic and malicious intents

North-south policy can be enforced through perimeter security gateway

East-west policy can enforced through internal segmentation security gateways

surviving the digital storm - cyber summit...

Documents