Content area
Full Text
Cyberattacks are an emerging threat for Industrial Control Systems (ICS) that, given the tight coupling between the cyber and physical components, can have far-reaching implications. It is typical for contemporary ICS components to utilize Commercial-Off-The-Shelf (COTS) hardware and software, rendering them prone to vulnerabilities and exploitation techniques that afflict IT systems (Figure 1). In an effort to demonstrate the ICS cyber threat landscape, we discuss a comprehensive methodology for designing an Advanced Persistent Threat (APT), which is a stealthy and continuous type of cyberattack with a high level of sophistication suitable for the complex environment of ICS. Retracing the steps and studying the objectives an attacker would take into consideration when designing
a cyberattack enables us to demonstrate the potential impact of these attacks and identify critical entry points, vulnerable flows, and services of ICS. Finally, leveraging the generated intelligence, we discuss defensive strategies that can assist in thwarting such attacks.
ICS are systems that monitor and control physical processes in industrial environments. Over the past decade, components used in ICS are under modernization with the inclusion of Information and Communication Technologies (ICT), towards increased efficiency and controllability, reduced downtime, and lower costs. The vision for the future of industrial automation is interconnected cyber-physical systems of systems, where components communicate with each other, have computational capabilities and are able to make decisions in a decentralized manner [1].
Despite the numerous benefits of this modernization trend, an immediate and pressing consequence is its negative impact on the cyber-security posture of ICS and the underlying physical processes. In order to enable the transition of ICS into the information age, contemporary ICS components utilize COTS hardware and software, such as ARM or Intel microprocessors and real-time versions of commercial operating systems [2]. Figure 2 depicts the internals of an industrial controller, which include an ARM processor, COTS integrated circuits for control and communication, RJ45 sockets (Ethernet) for communication over common ICT protocols, as well as several memory chips.
The use of COTS components facilitates development and reduces commissioning time, but at the same time enables malicious actors to readily port ICT vulnerabilities to ICS environments, rendering ICS prone to the same vulnerabilities and exploitation techniques that plague ICT. ICS systems often control national critical infrastructure such as critical...