Matthias H. van Doorn, FreeWave Technologies
Thinking about critical infrastructure conjures up various services and assets: the water supply, heating, transportation, telecommunication, fuels and, especially, electricity. With the introduction of computer technology, the proliferation of networks has enabled data exchange between computers and given birth to the Internet, impacting all of those critical bits of infrastructure.
In the Internet-enabled world, automation and data communication systems—such as modern supervisory control and data acquisition (SCADA) systems—have enabled the integration of command and control functions for critical infrastructure into cyberspace. The evolution of cyberspace, however, has made it more vulnerable to exploitation. There has been an increase in attacks, stealing, corruption, harm and destruction to those critical systems.
Wireless Data,Security Threats
The flexibility of wireless data communication comes at a price. Electromagnetic waves are nondiscriminatory when it comes to access. While a wired connection requires physical access to the cable, wireless connections can be made anywhere along the path on which the electromagnetic waves propagate. It’s impossible to make radio waves stop at the edge of one’s property with a split-rail fence; the physics are a little more complicated than that. Consequently, security, as in secure access, becomes much more important for wireless data communication.
The two most common threats to data communication networks are denial of service (DoS) and intrusion.
DoS is an attempt to make a computer resource or network unavailable to its intended users. It could be as simple as jamming an electric signal or as sophisticated as saturating a system or network with traffic intended to overwhelm and keep legitimate data from getting through. The consequences of DoS attacks can range from being irritating, as when services are unavailable or slow to respond, to dire, as when critical control signals don’t reach intended destinations.
Second, penetrating and intruding into a network or computer resource requires a different level of sophistication. Consequences can range from spying or stealing information to corrupting data or intentionally causing harm by taking over networks, computers and control systems.
Sophisticated command and control attacks, packet spoofing, hijacking sessions, replay attacks, worms, trojans, viruses, anti-forensic techniques and attacks on domain name system (DNS) infrastructure must be addressed as part of part of an overall information technology security strategy.
In 1941 Hedy Lamarr, an Austria-born actress, together with George Antheil co-patented a secret communication system that allowed radio control of torpedoes that could not be easily discovered, deciphered or jammed. Her secret? Frequency hopping. Coordinated, rapid changes in radio frequencies would hop in the radio spectrum, evading detection and potential interference being suppressed or jammed.
Even though her idea was ahead of its time and not implemented in the U.S. until 1962 when it was used by U.S. military ships during a blockade of Cuba after the patent had expired, it is now the basis for modern Frequency Hopping Spread Spectrum (FHSS) wireless communication systems. These systems are resilient to impairments such as interference, deliberate or coincidental, and jamming. Chances are that the signal does not land at the interfering frequency, thereby successfully evading the jamming signal. This makes a DoS attack on FHSS systems difficult if not impossible.
A resilient wireless system, however, needs more than a rugged transmission system. It also needs access control, privacy and defined security policies.
Access Control,Other Issues
There are many positive attributes of industry standards-based wireless devices. One of the negative aspects is that the only requirement to connect this wireless device is a standards-based device. Proprietary systems and devices, instead, offer more security. Access control is one of the most important security features to prevent unauthorized access and intrusion.
Access control in cyberspace is the equivalent of a security guard at the main door of an office building who makes sure only people with a correct badge enter. The goal of access control is to allow only network access to authorized devices and to disallow access to all others. Access should be authorized and provided only to devices whose identity has been established—authenticated—and whose placement on the network is approved in accordance with network plans, designs or policy.
Identity verification is based on the presentation of unique credentials to that system. The unique serial number of a wireless device for example may be such a unique credential. Remote authentication dial-in user service (RADIUS) is a popular method to provide centralized authentication, authorization and accounting (AAA) to manage access to wireless networks.
A good network security strategy should go further than access, though, and protect data in transit as well. Even if an unauthorized device gains access to the network, it doesn’t necessarily gain access to the data without passing another security layer.
For thousands of years, cryptography provided this extra layer and maintained the privacy of the data between the sender and recipient, even if others had access during transmission. Methods of encryption and deciphering have come a long way. Today, the Advanced Encryption Standard (AES) is the industry standard for encryption. As a federal government standard, it can be trusted to protect sensitive information and maintain data privacy.
The aforementioned are only a few, basic features that can help create a resilient, wireless data communication system for critical infrastructure.
A good network security strategy, however, must address and implement policies that serve as safeguards, which make it difficult to circumvent security measures and limit the potential impact of a wireless network security breach. Consider one added security layer: limited permitted activity. One method to implement safeguards is to limit permitted activities on the wireless network to only those absolutely required on the network. Such a limitation of permitted activities can be achieved through:
- Firewalls and packet filters that separate the information needed on the wireless network from that available on other parts of the network.
- Virtual Local Area Networks (LANs) that separate the wireless network infrastructure and its management from the production network, devices, communication endpoints or both. Using virtual LANs introduces another level of security, especially if combined with quality-of-service mechanisms.
- User level access (password protected) can provide access to wireless infrastructure and devices to maintenance personnel, but limited to monitoring system health or performance without opening the system to misuse or sabotage because configuration and other privileges are reserved for a different user level and password.
- Access limitation of local ports can make it impossible or at least hard for someone who gained physical access to a network infrastructure and devices to get connected and gain access to the network.
- Audit logs provide a trail of access and activities and can be a useful tool in auditing and tracing potential security breaches and issues.
This is not a complete list to secure a data communication network. It does, however, provide a good baseline and should be considered if wireless data communication equipment and devices support these advanced features. Security should come first and not be treated as an afterthought. Security never should be compromised for convenience. If we don’t start building and properly implementing adequate protections for our wireless data communication networks—especially for critical infrastructure such as electricity—malicious hackers can’t be kept at bay.
van Doorn is the product manager for Ethernet and licensed radio systems at FreeWave Technologies Inc. He has more than 15 years of experience in the telecommunications industry and has previously worked for companies such as CalAmp Corp., ADC Telecommunications, Digi International and Siemens.
PowerGrid International Articles Archives
View Power Generation Articles on PennEnergy.com