The Weissian Level 0/1 Issue

ICS security industry pioneer and legend Joe Weiss PE CISM CRISC ISA Fellow has been on a crusade to raise awareness on Purdue Level 0/1 security and reliability issues. It’s generally focused on the integrity and accuracy of sensor data that is communicated from the sensor, through a PLC/controller/Level 1 device, and to the operator or program at Level 2 and above.

From a security standpoint, there is almost always no logical security in the Level 0 to Level 1 communication. It lacks authentication. It is insecure by design. If an attacker can gain access to either side of this communication or the communication channel itself, they can spoof or alter the data. Most in the ICS security community know this, but Joe correctly points out that executives and others outside the community don’t know this. They are often shocked when they learn this.

To the degree this Level 0/1 communication is rarely using Ethernet or IP, or any other commonly routable protocol, it has some physical security. An attacker needs physical access to the endpoint or communications channel. If the attacker has physical access to the PLC, or logical access via an Ethernet port connecting from Level 2, then they don’t need to bother with altering or spoofing the Level 0/1 communication.?

This is why my focus, my annoying drumbeat, is to get security into the PLC/controller/Level 1 device. Signed firmware, signed logic/application changes, authentication of commands through ICS protocol security, and other controls. In a perfect world, we would have security down to the sensor or actuator. In terms of risk reduction achieved for resources required (efficient risk reduction criteria), this Level 0/1 security is far down the list of possible risk reduction activities. This will change some, but not a lot, as we deploy more sensors and actuators with IP addresses.

Joe and I have had a friendly disagreement on the importance of addressing the Level 0 security issue. Recent presentations and calls have led me to reframe Joe’s issue, and it seems to be much broader than security. To be fair, Joe has always said this and frequently points to the NIST definition of a cyber incident. Bad decisions and actions based on bad sensor data is what I hear him saying now.

Joe has given me multiple examples where a closer look at the accuracy of sensor data has shown it to be inaccurate by measures that could lead and have led to incidents. None of this bad sensor data was due to a cyber attack. It was a sensor failure. He claims this is a larger problem then most in the community realize. This is well outside my area of expertise, or even basic knowledge. Is it true? How widespread is this problem? I would believe the accuracy and precision required by sensor data is a well worn subject, and there have been examples where well worn subjects have led to unfounded confidence.

The issue of the accuracy and precision of sensor measurements will not be solved by security. Even if the Level 0/1 communication was authenticated. Even if all ICS communication was authenticated. We would only have false sensor readings sent without modification through the system.

When I hear Joe Weiss communicate about Level 0/1 I now break it into two issues. 1. Do we have an issue with Level 0 sensors recording and sending accurate data with the required precision? 2. Is the lack of authentication in Level 0/1 communication a security risk that needs to be prioritized and addressed in the next 1 to 3 years? I have no idea on the answer to question 1. My answer to question 2 is and has been no.