SCADA and Smart Grid

SCADA Security Assessments

IOActive's SCADA security assessment is built on information gained form direct penetration testing and architectural code review of utility and power control systems, and related third-party technologies. Our innovative methodologies and toolsets—built from expert reverse engineering, advanced control logic threat modeling, and in-depth control protocol analysis—allow IOActive to detect weaknesses and anticipate exploits quickly.

Under the guidance of leading SCADA security experts, IOActive provides customized security services for both SCADA vendors and asset owners. We help ensure the security of SCADA vendors' products by performing white- and black-box assessments of their software and hardware.

Services for SCADA vendors include:

  • Application Code Reviews
  • Black-box Reverse Engineering and Protocol Fuzzing
  • Threat Modeling
  • Secure Code Training
  • Security Development Lifecycle

IOActive also works with SCADA asset owners to ensure their regulatory compliance and the security of their SCADA systems. We conduct infrastructure and vulnerability assessments of critical components as well as CIPS compliance gap assessments and evaluations.

Services for asset owners include:

  • Vulnerability Assessments
  • Architecture Assessments
  • CIPS Assessments
  • Penetration Testing

At the completion of an engagement, IOActive provides a detailed report that defines assets and vulnerability data. Using this information, we help our customers create a roadmap to address existing security issues and protect against future vulnerabilities.

Lights on Alpha Demo

This demonstrates a hypothetical attacker performing a denial-of-control attack. In the video, a remote field device controls power to a pair of lights that can be turned on or off remotely by a pair of physical toggle switches over a network using Modbus. In the movie, the attacker is able to not only control the lights remotely, but is able to deny local control. At the end, the physical toggle switch is unable to turn off one of the lights. If this were a real attack, personnel at the physical location would be unable to control the system as the attacker had remotely overridden the physical controls.

Download this ZIP file to view the demo.