BSides DC 2015 - Network Reliability Monitoring for ICS – Going beyond NSM and SIEM

Determining the overall health and security of an industrial control system (ICS) network is currently done by looking at the negative case. If the network infrastructure devices indicate that all the devices are connected and communicating, then the network must be operating correctly. If the controllers indicate that they are able to communicate with the other devices in the system, then the system must be operating correctly. If the network security monitoring (NSM) or security information and event management (SIEM) system are not indicating any security events, then the system must be operating correctly.

In each of these cases, the assumption is that the system is operating correctly if there are no errors or events being indicated by any of the devices. In reality, the actual health and security of the system can only be determined by positive conditions. The communication streams need to be measured to determine that they are operating within certain limits based upon a desires set of conditions, like rate and maximum latency. Many controllers keep track of these factors for real-time communications, however they are often only recorded as averages and not high-fidelity measurements.

This talk presents an approach to analyzing the real-time network traffic performance of an ICS by measuring the jitter and latency associated with individual network traffic streams in the system. By using statistical and mathematical analysis of the high-fidelity jitter and latency data, a network reliability factor can be determined and used to indicate the health of those traffic streams. This talk will present a method to combine the individual network reliability factors into a network reliability monitoring system. Lastly, the talk will discuss how network reliability monitoring can be used to indicate potential security problems by observing the network traffic patterns.

Jim Gilsinn (Senior Investigator at Kenexis)
Jim Gilsinn is a Senior Investigator at Kenexis. He is responsible for conducting network and security assessments, designing networks and security systems for industrial control systems, and developing network reliability monitoring tools and techniques. He is the lead developer of the Dulcet Analytics network reliability monitoring software. Jim received an MSEE from Johns Hopkins University in control theory and a BSEE from Drexel University specializing in control theory, robotics, and advanced electronics.