Tales From The OT Trenches #3 - Rebooting A Prison

In the realm of Operational Technology (OT), the principles of Availability, Integrity, and Confidentiality (AIC) are paramount. However, in unique environments like prisons, the priority shifts to Containment, Availability, and Integrity (CAI), where “Containment” ensures that inmates remain securely within the facility. This article delves into a real-world scenario where a Building Management System (BMS) in a Dutch prison faced recurring failures, leading to automatic door locks and security concerns.

You Should Know:

1. Network Analysis in OT Environments:

Command: Use `tcpdump` to capture network traffic.
```
sudo tcpdump -i eth0 -w prison_network.pcap
```
Purpose: This command captures network traffic on the `eth0` interface and saves it to a file for later analysis.

2. PLC Configuration and Troubleshooting:

Command: Use `ping` to check network connectivity to the PLC.
```
ping 192.168.1.10
```
Purpose: Ensures that the PLC is reachable on the network.

3. EMC Interference Mitigation:

Command: Use `ethtool` to check network card status.
```
sudo ethtool eth0
```
Purpose: Verifies the health and configuration of the network interface card (NIC).

4. BMS Restart and Manual Control:

Command: Restart the BMS service.
```
sudo systemctl restart bms-service
```
Purpose: Restarts the BMS service to apply configuration changes or recover from failures.

5. Cable Management Best Practices:

Command: Use `lsblk` to list block devices and ensure proper cable connections.
```
lsblk
```
Purpose: Helps in identifying and managing physical connections to devices.

What Undercode Say:

In OT environments, especially in high-security facilities like prisons, the stakes are incredibly high. The story highlights the importance of thorough network analysis, proper cable management, and the need for robust contingency plans. The use of tools like tcpdump, ping, and `ethtool` are essential for diagnosing and resolving network issues. Additionally, understanding the physical layout and potential sources of interference, such as high-voltage cables, is crucial for maintaining system integrity and security.

For further reading on OT security and network management, consider the following resources:
– ICS Cybersecurity
– OT Network Best Practices
– PLC Programming and Troubleshooting

By adhering to these practices and utilizing the provided commands, OT professionals can ensure the reliability and security of critical systems in even the most challenging environments.