# SCADA, Zero-Trust, Content-Security-Policy

- Link: https://www.agilicus.com/scada-zero-trust-content-security-policy/
- Published: 2021-05-19T12:35:08+00:00
- Author: Don Bowman

A Florida water treatment plant breached. People nearly poisoned. A SCADA device
exposed via Windows & Team Viewer. Not where we want to be. How did it happen, how
do we prevent systematically? Read On!

Earlier I [wrote](https://www.agilicus.com/zero-trust-scada-secure/) about the attack
on a Florida water treatment plant. A remote site had an old Windows 7 PC with Team
Viewer and shared passwords, and, well, the rest wrote itself.

A new blog [post](https://www.dragos.com/blog/industry-news/a-new-water-watering-hole/)
out gives some more details about a ‘watering hole’ attack that occurred just in
advance. In a nutshell, a (legitimate) related industry site was compromised and
served a wee bit of malicious JavaScript. Someone from the target opened a page 
there.

As we can see in the screen shot, a script is present that probably the original
author did not wish. WordPress is particularly hard to secure for Content-Security-
Policy, but, a script-src directive in the CSP would have prevented this issue. 
The browser would have rejected loading the malicious script.

[⌊SCADA Zero Trust Content Security Policy: Water site injected with malicious code.
Source: Dragos. Illustrates a SCADA system vulnerability and the importance of zero
trust security measures and content security policies in protecting critical infrastructure.⌉⌊
SCADA Zero Trust Content Security Policy: Water site injected with malicious code.
Source: Dragos. Illustrates a SCADA system vulnerability and the importance of zero
trust security measures and content security policies in protecting critical infrastructure
.⌉[

source: dragos

I’ve written a lot about Content-Security-Policy ([and](https://www.youtube.com/c/Agilicus/videos)
[some](https://www.youtube.com/watch?v=zWx85Dl4Ioo) [videos](https://www.youtube.com/watch?v=pKlN2tp4mvs)!).
In particular, I [showed](https://www.agilicus.com/stop-injected-malware-on-your-sit/)
how it protected my personal site (well the users of it) from malicious content 
injected by some malware extension they had installed. Its a great seat belt. Head
on over to the [Mozilla Observatory](https://observatory.mozilla.org/) and check
your site.

Now, let’s assume that either a) we didn’t prevent with Content-Security-Policy,
or b) the attacker worked around. What would be our next step ([Defense In Depth](https://www.agilicus.com/blog/defense-in-depth/)!).
Well, Zero-Trust. If we assume that we can’t fix human behaviour, that people are
going to need remote access to things, we may as well make it safe and convenient.
A simple single-sign on, Zero-Trust Network Access model, we could have made that
SCADA device safely usable remotely, removing the value of the attack.