An evaluation framework for industrial control system cyber incidents

Industrial control systems (ICS)- the backbone of any modern nation's critical infrastructure (CI) such as the water, energy, transportation and information and communication technology (ICT) sectors-have been subjected to considerable cyberattacks in recent times. This is exacerbated by the gradual convergence of the information technology (IT) and operational technology (OT) domains. This paper sought to establish the basic cyber hygiene practices to stop malicious cyber activities against connected OTs. Cyber hygiene practices refer to knowledge, attitudes and behaviours consistently put into practice to eliminate a few root causes responsible for many cyber incidents. A scoping technique was adopted to review ICS security studies conducted in the past ten years (2012-2022). The key findings indicate that many CI operators have poor password and access control policies for onsite and remote access to networks, do not perform system updates and patching as and when it is necessary to do so, do not actively restrict, segregate and/or separate access to ICS networks and devices, and do not conduct cybersecurity awareness training as frequently as they should. Lastly, due to legacy ICS networks, threat intelligence tools such as extended detection and response and similar others to monitor and detect, in real-time, anomalous behaviour on the networks are rarely utilised for cyber risk assessment on OT networks.

The oil and gas industry, a vital lifeline fueling the global economy, find itself at a pivotal juncture where the convergence of operational technology (OT) and information technology (IT) has ushered in unprecedented opportunities and challenges. As digital transformation sweeps across this sector, the imperative to fortify cybersecurity defenses against ever-evolving threats has become paramount. Innovative and forward-looking oil and gas organizations across the globe are adopting the Cloud in many forms because of their digital transformation initiatives. Data lakes, edge technology, machine-to-machine communication, and machine learning (ML) algorithms have been enabling this industrial digital transformation. This transformation is also driving changes to the OT landscape, and as these environments continue to evolve, OT environments are leveraging well proven IT solution patterns to improve the productivity and efficiency of production operations. Industrial customers often start their digital transformation journey by sending OT data to the cloud for analysis and analytics without sending commands back to the industrial automation and control systems (ICAS). This process is often called "open loop" operations, since there is one-way communication from edge to cloud. Customers generally find this relatively easy to secure and manage. However, more often we are witnessing requirements to optimize operations by generating an automatic or operator-initiated response in the oil and gas production operation, rig management based on insights gained from cloud analytics. This process is often referred to as "closed loop" operations with two-way communication between edge and cloud. The security and compliance practices for closed loop operations are more rigorous because closed operations manipulate OT devices remotely. Developing these practices should be rooted in a cyber risk assessment to help businesses understand and prioritize security concerns. In this paper we propose how strengths of Cloud computing can become key enabler for oil and gas organizations in helping them enhance their overall security posture and manage risks within OT environments. We have deployed solution patterns described in this paper as the foundational pillar of several Oil and Gas organization's overall OT system architecture to unlock both "open loop" and "closed loop" operations in a secure, reliable and cost-effective manner. The specific scope items we will cover in this paper focus on a custom security uplift framework having four foundational components – 1) Cloud led architecture patterns to provide next generation network segmentation strategies in OT De-militarized Zone 2) OT asset inventory and vulnerability management 3) Centralized security monitoring and incident response with help of Artificial Intelligence and most recently providing Generative AI based virtual assistant to query security event data from OT systems. For organizations to plan their industrial digital transformation safely and securely, it is recommended that a multi-layered approach to secure the Industrial Control Systems (ICS)/OT and Cloud environments be implemented as captured in ten security golden rules in the following paper [1]. In addition to this, in the paper we propose a comprehensive architecture framework that aligns with established cybersecurity framework (CSF) such as NIST. The use case studies discussed in the paper will highlight how customer have been able to remediate critical security vulnerabilities within weeks post implementation by deploying a comprehensive asset inventory discovery and vulnerability assessment. This has help reduce mean time to identify and mitigate vulnerabilities from months to days with automated testing in pre-production environments, ensure quick detection and response towards security incidents with help of advanced security monitoring and incident response playbooks, covering 100% of the OT assets through this capability and leverage advanced data analytics, machine learning to perform log mining, data cleansing, data validation, log mining and analysis through natural language processing such as conversational AI assistants powered by large language model (LLM) in the Cloud.

Existing cyber security training programs for Critical Infrastructures (CI) place much emphasis on technical aspects, often related to a specific sector/expertise, overlooking the importance of communication (i.e. the ability of a stakeholder to gather and provide relevant information). We hypothesise that the achievement of a secure and resilient society requires a shared protocol among CI stakeholders, that would facilitate communication and cooperation. In order to validate our hypothesis and explore effective communication structures while facing a cyber incident and during recovery, we developed a discussion-based exercise using an Industrial Control System (ICS) incident scenario, and implemented it in pilot workshops where a total of 91 experts participated. Results suggest there are three possible incident communication structures centered around the IT department, the production department, and management, respectively. In future, these structures can be used as the framework to build an ICS-Security Incident Response Team (ICS-SIRT), which would strengthen cooperation among CI stakeholders.

Cybersecurity for industrial control systems: A survey

Ensuring the integrity of Ethernet-based networks is a challenging and constantly evolving domain. This problem is exacerbated for those operational technology (OT) networks supporting industrial control systems (ICS) since much of that equipment was originally designed to be on a network that was isolated and generally considered free of malefactors. Increasing pressure to bridge these systems with traditional information technology (IT) networks has introduced a bevy of new threats. In response, both academia and industry have responded with security solutions tailored to ICS environments. Deploying these protection systems often involves several configuration choices. While some of these choices are clear (e.g., block/enable protocol X) others are far more subjective (e.g. alert threshold == 3.43). Further complicating the situation, while often similar to IT networks, OT networks have unique challenges and characteristics that make the task of protecting them simultaneously more difficult and straight forward.Extant solutions for quantifying the relative security of intrusion detection systems fail to effectively support the operators of said systems with understanding the impact of various configuration changes. Further, they assume that the attacks are static and not subject to manipulation or alteration in the face of defenses. In this paper, we present a threat-based method for quantifying the relative impact of various security settings for intrusion detection systems (IDSs) within ICS environments. This method provides operational staff with a clear understanding of the relative impact of their settings and assumes that the attacks levied against them are dynamic. The model is described in detail, we apply the model to a synthetic data set, and discuss the inferences that can be made and what types of decisions they could be used to support.

Computer facilities and microprocessor-based technology have been successfully used in the energy industry. For protection and equipment control, this technology has been used in SCADA, remote control and monitoring applications. Particular attention is paid to the cyber security sector for automation and control systems. Protective application of the equipment and control, SCADA, monitoring and remote control, uses the technology with microprocessor. Due to the great importance of the power supply process, there is no question of being left in a state of vulnerability and neglect. Security is not perfect and will never be. For this reason, there will always be security breaches and incidents. Also, for this reason, not only protection mechanisms are in place, but also mechanisms for rapid detection of incidents and which are able to react effectively to the isolation of problems and to ensuring security. Processes security for systems will continue to evolve in the future. By definition, there are no communication systems that are 100% safe. Attacks against critical industrial infrastructures marked an increase not only in terms of number but also of the level of complexity. The destruction of the industrial control system (ICS) and critical processes were interrupted. For many organizations, the security improvement in ICS systems is great. The extreme sensitivity to ensure the availability and performance of industrial processes has led to a more conservative and rigorous approach to how security measures are implemented. Cyber-attacks that could compromise the availability, integrity, and confidentiality of ICS systems may come from within systems or from outside ICS systems. Among the ICS system infection vectors from the perspective of the SANS Institute (2014) include: external threats (state attacks, hacking etc.), malware, exploiting tools, phishing, internal attacks, cyber security protocols, and industrial espionage. This chapter addresses the cyber security issues required for the protection, automation, control and communications systems of transformation stations as well as methods that could be used to prevent computer attacks that can have a significant impact on the availability of the system Electro-energetic effect with serious consequences on extended area interruptions.

Control systems are used in a number of different industrial sectors and critical infrastructures, including manufacturing, distribution, and transportation. Failure of these control systems because of malware or other faults would be catastrophic for critical infrastructure and would result in significant losses. Adverse operating conditions, such as those found in networked control systems, exacerbate the likelihood of vulnerability to malware attacks. The prospect of severe adversarial assaults such as buffer overflow, conventional faults, and especially stealthy Ladder Logic Bombs is a serious cause of concern in Industrial Control Systems (ICS) with novel attacks such as Struxnet. Decoupled at-distance Electromagnetic spectrum-based monitoring of faults and malware is more robust and can likely be integrated into Industrial Control System frameworks. Our failure analysis and Machine Learning (ML) modeling approach is fundamentally different from traditional methods in that we propose a Hybrid Quantum Artificial Intelligence-based Electromagnetic (EM) Spectral domain-based analysis approach that is completely decoupled from the controller processor and can predict PLC fault/malware conditions, including stealth Ladder Logic Bombs and buffer overflow attacks. Further, robust Supervisory Control Systems (SCSs) that interface with programmable logic controllers (PLCs) are essential components of Industrial Control Systems (ICSs) that handle critical infrastructure. Modern industrial control systems, on the other hand, are made up of densely linked Internet of Things (IoT) nodes. Because of their networked nature, supervisory control systems are also susceptible to widespread cyberattacks. As a result, in the case of a coordinated attack on IoT control systems, the dependability of Supervisory control decision-making procedures is jeopardized and need to be decoupled from the attacks. This work also develops a Fuzzy inference Engine-based supervisory monitoring technology based on the characteristics of the Hybrid Quantum AI-based analysis of the EM spectrum to reduce industrial plant downtime and false alarms by localizing adversarial attacks/faults, risk severity levels, and impacted nodes, as well as having dependability and malware immunity in networked Industrial control systems. The Hybrid QAI technique improved prediction accuracy by up to 88 percent when identifying different control system viruses and defects in 6-stage pipelined processors. The Fuzzy inference engine in the Mamdani Inference System architecture has been found to reduce the risk of false alarms and downtime.

Detecting malicious activities in Information Technology (IT) is a critical component of cybersecurity and is essential for identifying threats and attacks on systems, networks, and resources. However, security of industrial control systems, an area of increasing concern due to the convergence of IT with Operational Technology (OT), requires new approaches. This work proposes a novel containerized testbed architecture for industrial water systems, implemented using open-source technologies and structured according to the Purdue reference model, which is widely used in industrial control and automation systems. The architecture aims to provide a secure and efficient environment. The experiments demonstrate that the proposed architecture enables the simulation of computational devices behavior in water systems under different scenarios, allowing data to be collected for the detection of malicious activities, such as denial-of-service attacks and command injection. The results highlight the architecture's relevance to advancing research and development efforts aimed at enhancing the security of critical water infrastructure.

The introduction of Industry 4.0 and IIoT has enabled the interconnection of information technology (IT) and operational technology (OT) and exposed industrial control systems to cyber threats. Industrial cybersecurity requires knowledge, skill, and collaboration between IT and OT. A comparison of graduate curricula of software engineering and systems engineering identifies competencies related to industrial control systems cybersecurity. Industry experts are interviewed to identify needs for cybersecurity skills and competencies. Results from the mapping are discussed in the context of software and systems engineering challenges in ICS cybersecurity and leveraged against industry experiences and needs expressed through interviews with three OT and IT industry professionals. The curricula mapping reveals variations in both how they are organised and expressed to the extent that subjective interpretation is required for evaluation and comparison. The interviews with the industry experts indicate a gap between graduate competence from the curricula and industry needs.

Industrial control systems (ICSs) are crucial in managing critical infrastructure, making their security a paramount concern. In recent years, their widespread adoption, together with the overall distance spanned by the critical infrastructure of industrial communication networks, have increased the complexity of the networks’ topological arrangement, increasing their structural vulnerabilities. In this scenario, deep learning models, especially those that incorporate graph-aware mechanisms, have arisen as a promising solution. This paper presents a novel centrality-and graph-aware attack detector (CGAAD) that includes nodes’ significance by centrality measures within a graph convolution network (GCN) framework to provide superior cyberattack detection performance and increase the resilience of critical ICS infrastructure. The proposed CGAAD model is in three parts. First, centrality measures are used as features for each of the nodes in the ICS graph topology. Then, a sparse-autoencoder (sparse-AE) enhances the feature representations to harness the subsequent classification step. Finally, the GCN leverages the graph structure and the enhanced features to classify dataflow between nodes as either normal or attacked. Experimental results demonstrate promising performance, reaching nearly 99% in terms of accuracy and F1-score, reducing misclassifications of both normal and attacked samples, which is crucial in ICS critical infrastructure applications.

Industrial Control Systems (ICS) underpin critical infrastructure sectors such as energy, manufacturing, water treatment, and transportation, where operational continuity, safety, and reliability are paramount.The increasing integration of operational technology (OT) with information technology (IT) networks has expanded the cyber-attack surface, exposing ICS environments to advanced, persistent, and highimpact threats.This paper presents a practical and comprehensive cybersecurity approach specifically for ICS, addressing the unique constraints of industrial environments.It incorporates industry standards, documentation-driven governance, and structured risk assess-ment to support secure system development and lifecycle man-agement.Core cybersecurity design principles-secure by design, reduced attack surface, defense in depth, least privilege, and zero trust-are applied to guide resilient architecture development.The paper further outlines robust network design based on the Purdue Model, secure communication practices, segmentation techniques, intrusion detection methodologies, backup strategies, and system hardening requirements.Additional focus is given to identity and access management, endpoint protection, vulnerabil-ity and asset management, and incident response aligned with the NIST Sajath P Sathar https://iaeme.

A critical infrastructure (CI) consists of those physical and information technology facilities, networks, services and assets which, if disrupted or destroyed, have a serious impact on the health, safety, security or economic well-being of citizens or the effective functioning of governments. Nowadays, the operation controls of these infrastructures have been computerized and have gradually become open systems. The malfunction controls of the information technology (IT) have been one of the focuses in the researches of information security management in industrial control system (ICS). In this paper we discuss the IT malfunction of ICS security incidents which occurred in Taiwan, and explore the details of the controls for CI.

The integration of Industrial Control Systems (ICS) with Information and Communication Technologies (ICT) systems has resulted in tremendous increase in the number of ICS security incidents. Current ICS incident response practices can hardly be applied into ICS directly as the two systems are fundamentally different in terms of system complexity, criticality, flexibility and dependability. This paper addresses this challenges by proposing an ICS incident response decision framework. It is based on decision-making theory and has descriptive, predictive and prescriptive models that particularly address ICS incident response decision-making. This framework is implemented using a service-oriented architecture (SOA) that provides incident response decision making as services and offers standardized interfaces to integrate with existing incident management systems.

: Critical infrastructure is vulnerable to cyber threats and the consequences of attacking an industrial control system (ICS) may result in loss of life. ICSs are different in several ways from information technology (IT) systems. As a result, the processes to protect IT cannot be applied to ICS infrastructure. This report presents common threat vectors to ICSs and lessons learned from recent malware to provide recommendations to protect critical infrastructure from cyber attacks.

By 2030, forecasts suggest that urban areas will house 60 percent of the world’s population and one in every three people will live in cities with at least half a million inhabitants. Within the same time frame, the number of global megacities is expected to jump from 33 today to 43 in 2030 [1]. Underpinning these large urban areas will be an interconnected network of critical physical infrastructures reliant on Internet-connected Industrial Control Systems and susceptible to increasingly sophisticated, e.g., AI-enabled, cyber threats. In hand, the cyber threat landscape is shifting rapidly. We are seeing a sharp rise in the number of cyberattacks on critical infrastructure [2] with significant impacts cascading across multiple sectors and causing disruption to the provisioning of essential goods and services. Security scholars suggest that these impacts are not always equitable and that disruption to critical infrastructure can affect vulnerable groups differently [3], which further emphasizes the need to improve cybersecurity between critical infrastructure sectors [4]. Through structured analysis of city statistics, demographic information, cyber incidents, and current cyber policy, our presentation will articulate potential social implications of megacity growth through the lens of cyber-physical infrastructure disruption. We investigate the largest 15 megacities in the world and find that megacities continue to grow in population but not in cyber policy. We highlight recent examples of cyber-physical disruption in Mumbai and New York City with focus on implications for vulnerable populations. Our work suggests the need for future research on social responsibility regarding security of these critical infrastructure sectors and on the need for technology-focused law, policy, and regulation guidelines.