Eaton Network-M3, User Manual

Page: 204 / 294

Cybersecurity considerations for electrical distribution systems
Securing the Network Management Module – 204
•
•
•
•
•
•
•
•
•
•
5.1.4.1 Paths to the control network
The paths in above figure include:
External users accessing the network through the Internet
Misconfigured firewalls
Unsecure wireless routers and wired modems
Infected laptops located elsewhere that can access the network behind the firewall
Infected USB keys and PLC logic programs
Unsecure RS-232 serial links
The most common malicious attacks come in the following forms:
Virus—a software program that spreads from one device to another, affecting operation
Trojan horse—a malicious device program that hides inside other programs and provides access to that device
Worm—a device program that spreads without user interaction and affects the stability and performance of the ICS network
Spyware—a device program that changes the configuration of a device
5.1.5 Defense in depth
While there are differences between traditional IT systems and ICS, the fundamental concept of “defense in depth” is applicable to
both. Defense in depth is a strategy of integrating technology, people, and operations capabilities to establish variable barriers
across multiple layers of an organization. These barriers include electronic countermeasures such as firewalls, intrusion detection
software/components, and antivirus software, coupled with physical protection policies and training. Fundamentally, the barriers are
intended to reduce the probability of attacks on the network and provide mechanisms to detect “intruders.”