SCADA ICSIP ENGR General Modbus DNP 3 CIP

SCADA/ ICS的基於IP的協議和相關應用控制中心 ENGR General Modbus DNP 3 CIP Ethernet HIST SCADA 遠程/子站/加區 Electric Utilities IEC 60870 -5 -104 IEC 61850 -3 /MMS Synchrophasor Elcom 90 OPC Server Bridge/Service OPC DA/UA Apps Cygnet – Oil & Gas SCADA PI - Historian ICCP MMS Elcom 90 ENGR RTU / PLC / IED HIST SCADA OPC Server DNP 3: Distributed Network Protocol 3 CIP Ethernet: Common Industrial Protocol Ethernet OPC: Open Platforms Communication, formerly OLE for Process Control ICCP: Inter Control Center Protocol MMS: Manufacturing Message Specification 控制中心 § Common IP-based Protocols and Applications for SCADA/ICS are shown. – Serial protocols also in use (e. g. Serial Modbus) – Other vendor specific implementations exist § Modbus, DNP 3, and OPC are the most widely used within the energy sector 5 © 2006 Opsware Inc. All rights reserved. Proprietary and confidential. © 2015 Kinmax Technology Inc. All rights reserved. KINMAX

IT 與 ICS 特徵的比較 6 © 2006 Opsware Inc. All rights reserved. Proprietary and

SCADA/ICS Vulnerabilities & Exploits OPC Server (CVE-2011 -1914) Historian Server (CVE-2012 -2516) SCADA Master / HMI (CVE-2012 -0233) Multiple Vectors for Exploitation Internet / Support Network Removable Media Example CVE numbers for different types of SCADA/ICS system components Portable Computing PLC / RTU / IED (CVE-2010 -2772) § 許多的系統的已知弱點和漏洞都沒有被修補, 最常見的原因是 : § § 網際網路的威脅雖然對較封閉的網路不構成太大的威脅, 但是有很多的威脅都來自於內部, 不論是故意還是非故意造成 § § 7 “如果沒有發生問題就不需要修正它””修正通常只針對比較新的系統版本, 所以不要管它了” 舉例來說, 病毒透過內部筆記型電腦的USB設備連結而感染惡意軟件可以造成系統停機和影響資料完整性, 更嚴重的情況下會造成生產線設備和人員的安全 © 2006 Opsware Inc. All rights reserved. Proprietary and confidential. © 2015 Kinmax Technology Inc. All rights reserved. KINMAX

CHECK POINT’S 安全解決方案用於業控制系統 & SCADA CYBER DEFENSE 能感知SCADA 威脅並進行預防保護 © 2016 Check

即時的SCADA網路流量監視 Control 分析網路流量 SCADA Historian Control Center Network Traffic Control Network Industrial Control Systems (PLC) Sensor Data Field Devices Pressure Flow Temp. Voltage State

完整的SCADA流量報告 SCADA協定詳細內容 VIEWED by Check Point SMARTLOG & SMARTEVENT

提供超過300個 ICS/SCADA 專用的虛擬弱點修補阻止已知弱點遭受利用並檢測異常流量 PROTECTED by Check Point IPS NSS Labs Highest Rating

Check Point 5800 n 2 Slot n LOM (option) n LCD面版項目 5800 防火牆效能 22 Gbps VPN效能 10 Gbps IPS效能 3. 05 Gbps NGFW效能 2 Gbps 威脅防禦 1. 035 Gbps 同時連線數 3. 2 M / 6. 4 M n 10 G / 40 G support n RDP support

Check Point Smart-1 Appliance n Smart-1 管理主機提供： ü Network and endpoint policy management ü Device management ü Compliance ü Log management & Smart. Log ü Smart. Event ü Security Workflow management ü LDAP User Directory

採購建議設備/型號數量位置說明 1. CPAP-NGSM 225 1 維運中心統一管理平台安全分析平台 • Smart-1 225 Next Generation Security Management Appliance for 25 gateways (Smart. Event & Compliance 1 year) 1 • Extended Slide RAILS (24 inch-36 inch) 1 2. CPAP-SG 1200 R-NGTP • 待評估程師站及 OPC伺服器前控閘道區域閘道控制系統及業交換機前邊界閘道 1200 R Next Generation Threat Prevention Security Appliance 3. CPAP-SG 5600 -NGTX 2 • 2 5600 Next Generation Threat Prevention & Sand. Blast (NGTX) Appliance Solution

Q&A