An Industrial Control Systems incident response decision framework

The oil and gas industry, a vital lifeline fueling the global economy, find itself at a pivotal juncture where the convergence of operational technology (OT) and information technology (IT) has ushered in unprecedented opportunities and challenges. As digital transformation sweeps across this sector, the imperative to fortify cybersecurity defenses against ever-evolving threats has become paramount. Innovative and forward-looking oil and gas organizations across the globe are adopting the Cloud in many forms because of their digital transformation initiatives. Data lakes, edge technology, machine-to-machine communication, and machine learning (ML) algorithms have been enabling this industrial digital transformation. This transformation is also driving changes to the OT landscape, and as these environments continue to evolve, OT environments are leveraging well proven IT solution patterns to improve the productivity and efficiency of production operations. Industrial customers often start their digital transformation journey by sending OT data to the cloud for analysis and analytics without sending commands back to the industrial automation and control systems (ICAS). This process is often called "open loop" operations, since there is one-way communication from edge to cloud. Customers generally find this relatively easy to secure and manage. However, more often we are witnessing requirements to optimize operations by generating an automatic or operator-initiated response in the oil and gas production operation, rig management based on insights gained from cloud analytics. This process is often referred to as "closed loop" operations with two-way communication between edge and cloud. The security and compliance practices for closed loop operations are more rigorous because closed operations manipulate OT devices remotely. Developing these practices should be rooted in a cyber risk assessment to help businesses understand and prioritize security concerns. In this paper we propose how strengths of Cloud computing can become key enabler for oil and gas organizations in helping them enhance their overall security posture and manage risks within OT environments. We have deployed solution patterns described in this paper as the foundational pillar of several Oil and Gas organization's overall OT system architecture to unlock both "open loop" and "closed loop" operations in a secure, reliable and cost-effective manner. The specific scope items we will cover in this paper focus on a custom security uplift framework having four foundational components – 1) Cloud led architecture patterns to provide next generation network segmentation strategies in OT De-militarized Zone 2) OT asset inventory and vulnerability management 3) Centralized security monitoring and incident response with help of Artificial Intelligence and most recently providing Generative AI based virtual assistant to query security event data from OT systems. For organizations to plan their industrial digital transformation safely and securely, it is recommended that a multi-layered approach to secure the Industrial Control Systems (ICS)/OT and Cloud environments be implemented as captured in ten security golden rules in the following paper [1]. In addition to this, in the paper we propose a comprehensive architecture framework that aligns with established cybersecurity framework (CSF) such as NIST. The use case studies discussed in the paper will highlight how customer have been able to remediate critical security vulnerabilities within weeks post implementation by deploying a comprehensive asset inventory discovery and vulnerability assessment. This has help reduce mean time to identify and mitigate vulnerabilities from months to days with automated testing in pre-production environments, ensure quick detection and response towards security incidents with help of advanced security monitoring and incident response playbooks, covering 100% of the OT assets through this capability and leverage advanced data analytics, machine learning to perform log mining, data cleansing, data validation, log mining and analysis through natural language processing such as conversational AI assistants powered by large language model (LLM) in the Cloud.

Industrial control systems (ICSs) are transitioning from legacy-electromechanical-based systems to modern information and communication technology (ICT)-based systems creating a close coupling between cyber and physical components. In this paper, we explore the ICS cybersecurity landscape including: 1) the key principles and unique aspects of ICS operation; 2) a brief history of cyberattacks on ICS; 3) an overview of ICS security assessment; 4) a survey of “uniquely-ICS” testbeds that capture the interactions between the various layers of an ICS; and 5) current trends in ICS attacks and defenses.

Cyber threats to industrial control systems (ICSs) have increased as information and communications technology (ICT) has been incorporated. In response to these cyber threats, we are implementing a range of security equipment and specialized training programs. Anomaly data stemming from cyber-attacks are crucial for effectively testing security equipment and conducting cyber training exercises. However, securing anomaly data in an ICS environment requires a lot of effort. For this reason, we propose a method for generating anomaly data that reflects cyber-attack characteristics. This method uses systematic sampling and linear regression models in an ICS environment to generate anomaly data reflecting cyber-attack characteristics based on benign data. The method uses statistical analysis to identify features indicative of cyber-attack characteristics and alters their values from benign data through systematic sampling. The transformed data are then used to train a linear regression model. The linear regression model can predict features because it has learned the linear relationships between data features. This experiment used ICS_PCAPS data generated based on Modbus, frequently used in ICS. In this experiment, more than 50,000 new anomaly data pieces were generated. As a result of using some of the new anomaly data generated as training data for the existing model, no significant performance degradation occurred. Additionally, comparing some of the new anomaly data with the original benign and attack data using kernel density estimation confirmed that the new anomaly data pattern was changing from benign data to attack data. In this way, anomaly data that partially reflect the pattern of the attack data were created. The proposed method generates anomaly data like cyber-attack data quickly and logically, free from the constraints of cost, time, and original cyber-attack data required in existing research.

With the integration of the modern industrial control systems (ICS) with the Internet technology, ICS can make full use of the rich resources on the Internet to facilitate remote process control. However, every coin has two sides. More exposure to the outside IT world has made ICS an attractive target for hackers, so it becomes urgent to protect the security of ICS. Skilled attackers can penetrate control networks and then manipulate sensor readings or control signals persistently until the system crashes, while still keeping themselves undetected by following the expected behavior of the system closely. This kind of attacks are referred to as stealthy attacks. As far as we know, many existing intrusion detection techniques only investigate the magnitudes of behavior residuals, so they cannot detect this kind of stealthy attacks. In this paper, we discover that residuals generated during stealthy attacks exhibit significant skewness compared to attack-free residuals. Based on the new observation, we propose an effective and fast technique to detect stealthy attacks against ICS based on residual skewness analysis. Skewness coefficients can distinguish the counterfeited residuals from the attack-free residuals effectively. A larger absolute value of the skewness coefficient generally indicates the occurrence of a more intense stealthy attack. Finally, we conduct comprehensive experiments to verify the effectiveness and efficiency of the proposed stealthy attack detection approach.

After investigating the conception and features of PLC (Programmable Logic Controller) and embedded system, in this paper the conception of a Quasi-PLC is proposed, which combine the advantages of PLC and embedded system. The architecture of Quasi-PLC and a Top-Down design method with collaboration design of software and hardware for Quasi-PLC embedded control system are researched then. Finally, setting the large-scale industrial valve control system as an example, the conception of Quasi-PLC and related technologies are used in industrial valve control system, and a satisfied application effect is obtained, which proves the rationality of the conception of Quasi-PLC and related technologies.

Industrial control systems (ICS)- the backbone of any modern nation's critical infrastructure (CI) such as the water, energy, transportation and information and communication technology (ICT) sectors-have been subjected to considerable cyberattacks in recent times. This is exacerbated by the gradual convergence of the information technology (IT) and operational technology (OT) domains. This paper sought to establish the basic cyber hygiene practices to stop malicious cyber activities against connected OTs. Cyber hygiene practices refer to knowledge, attitudes and behaviours consistently put into practice to eliminate a few root causes responsible for many cyber incidents. A scoping technique was adopted to review ICS security studies conducted in the past ten years (2012-2022). The key findings indicate that many CI operators have poor password and access control policies for onsite and remote access to networks, do not perform system updates and patching as and when it is necessary to do so, do not actively restrict, segregate and/or separate access to ICS networks and devices, and do not conduct cybersecurity awareness training as frequently as they should. Lastly, due to legacy ICS networks, threat intelligence tools such as extended detection and response and similar others to monitor and detect, in real-time, anomalous behaviour on the networks are rarely utilised for cyber risk assessment on OT networks.

Detecting cyberattacks in industrial control systems using online learning algorithms

Introduction In the last chapter, we explored how to determine a cyber-attacker's optimal strategy for attacking a computer system based on malware and exploits available on the darkweb. In this chapter, we look at the case where the attacker is focused on industrial control systems (ICS): IT infrastructure that controls physical systems (electricity, water, industrial machinery, etc.). A critical feature of these complex ICS systems is the interdependencies among various components. However, despite the prevalence of markets for malware and exploits, and their potential threat to ICS, existing paradigms, including the framework presented in the previous chapter, do not account for the complex nature of ICS systems consisting of multiple interconnected components. In particular, it would prove useful to simulate a cyber-attack on a model of an existing system, to assess its degree of vulnerability. Such a model would also prove useful for automated cybersecurity systems that can learn defense and contingency strategies based on the model's simulations. This chapter takes the first steps toward addressing this need. In particular, we introduce a framework that allows for modeling of ICS systems with highly interconnected components (Section 7.3) and study this model through the lens of lattice theory [57]. We then turn our attention to the problem of determining the optimal/most dangerous strategy for a cyber-adversary with respect to this model and find it to be an NPComplete problem (Section 7.4). Next, we present a suite of algorithms for this problem based on A* search and introduce provably correct algorithms (Section 7.5). Our intuition is that these algorithms will obtain satisfactory performance in practice due to heuristic functions (for which we show admissibility). We demonstrate the performance of these algorithms by implementing them and performing a suite of experiments using both simulated and actual vulnerability data (Section 7.6). This chapter also includes some background on ICS (Section 7.2) and a brief overview of related work (Section 7.7). Background Contemporary cyber threat actors rely on a variety of malware and exploits purchased through various channels such as the darkweb [99] in order to carry out their attacks. The trend toward automation of industrial control systems (ICS) and toward “smart” utilities [50] has made understanding such adversarialbehavior directed against ICS a priority. For instance, code from the infamous Stuxnet [97] attack against Iranian nuclear facilities is available for public download.

Recent world events and geopolitics have brought the vulnerability of critical infrastructure to cyberattacks to the forefront. While there has been considerable attention to attacks on Information Technology (IT) systems, such as data theft and ransomware, the vulnerabilities and dangers posed by industrial control systems (ICS) have received significantly less attention. What is very different is that industrial control systems can be made to do things that could destroy equipment or even harm people. For example, in 2021 the US encountered a cyberattack on a water treatment plant in Florida that could have resulted in serious injuries or even death. These risks are based on the unique physical characteristics of these industrial systems. In this paper, we present a holistic, integrated safety and security analysis, we call Cybersafety, based on the STAMP (System-Theoretic Accident Model and Processes) framework, for one such industrial system—an industrial chiller plant—as an example. In this analysis, we identify vulnerabilities emerging from interactions between technology, operator actions as well as organizational structure, and provide recommendations to mitigate resulting loss scenarios in a systematic manner.

Industry 4.0 is the German vision for the future of manufacturing, where smart factories use information and communication technologies to digitise their processes to achieve improved quality, lower costs, and increased efficiency. It is likely to bring a massive change to the way control systems function today. Future distributed control systems are expected to have an increased connectivity to the Internet, in order to capitalize on new offers and research findings related to digitalization, such as cloud, big data, and machine learning. A key technology in the realization of distributed control systems is middleware, which is usually described as a reusable software layer between operating system and distributed applications. Various middleware technologies have been proposed to facilitate communication in industrial control systems and hide the heterogeneity amongst the subsystems, such as OPC UA, DDS, and RT-CORBA. These technologies can significantly simplify the system design and integration of devices despite their heterogeneity. However, each of these technologies has its own characteristics that may work better for particular applications. Selection of the best middleware for a specific application is a critical issue for system designers. In this paper, we conduct a survey on available standard middleware technologies, including OPC UA, DDS, and RT-CORBA, and show new trends for different industrial domains.

The control instructions of industrial control systems are prone to threats such as unauthorized access and tampering during transmission and interaction, and access control is a fundamental method to protect data security. Due to the cyber-physical integration and availability constraints in industrial control systems, existing access control methods cannot be directly applied. In this paper, we propose an access control policy for control instructions based on the ciphertext policy attribute-based encryption (CP-ABE) under the availability constraints in industrial control systems. First, we analyze the abnormal behaviors of control instructions in process industrial monitoring systems, and model the attributes associated with field control business and integrate them into CP-ABE to achieve fine-grained access control and avoid non-compliant operations. Second, we adopt a trusted computing mechanism to protect the identity trustworthiness of the transmission node; the confidentiality of the transmitted control instruction is guaranteed by the negotiated symmetric key and the key authorization is realized by the CP-ABE. We further optimize the measuring frequency of the trusted measurement and the deployment policy of the access control method to guarantee business availability. Finally, we conduct formal analysis and experimental validation of the proposed method, and the results show that the proposed access control policy can prevent unauthorized access and non-compliant tampering by industrial control devices and achieve trustworthy delivery of control instructions with controlled computational complexity.

This article presents an analysis of industrial control system (ICS), its multilevel structure and operation conditions. The ICS infrastructure is considered as a part of enterprise information system (EIS). The problem of information security of ICS is discussed. The reasons why ICS information security has become one of the most discussed issues of our time is defined. A model of EIS infrastructure comprising industrial control system is suggested. A verbal model of ICS as a protection object of information security system (ISS) is developed. The model takes into account all computer equipment, communication lines, channels, components of the three ICS levels. The necessary of a development of such models is substantiated according to the system analysis method. Modeling is an effective tool for studying the characteristics of complex systems and makes it possible to have a closer look at their structure. A successful development of ISS depends on the adequacy of a protection object model (ICS), taking into account its specific features.

Currently, most anomaly detection approaches in industrial control systems (ICSs) use network event logs to build models, and current unsupervised machine learning methods rarely use spatiotemporal correlations and other dependencies between multiple variables (sensors/actuators) in a system to detect anomalies. Most of the existing anomaly detection technologies simply compare the current states with the predicted normal range. Due to the highly dynamic characteristic of industrial control systems, it is insufficient to simply compare the current states with the predicted normal range. As a result, these approaches have low detection rates for unknown or new types of attacks. In view of these shortcomings, this paper presents a network model for predicting sensor/controller parameters in industrial control systems. To predict the parameter values of the sensors and controllers more accurately, the 1D convolutional neural network (1D_CNN) and gated recurrent unit (GRU) are combined to fully learn the spatiotemporal correlation and other dependencies between the parameter values of the sensors and controllers at each moment. An abnormal state detection method based on the calculation of the statistical deviation is proposed to realize the anomaly detection of industrial control systems. The model is validated on the Secure Water Treatment (SWaT) dataset. The precision, recall and F1 scores are used to evaluate the effectiveness of this method in anomaly detection on the SWaT dataset. The experimental results show that the average precision and recall of this method are 0.99 and 0.85, respectively, and that the average F1 score is 0.91. The experimental results show that the proposed method can be successfully applied to anomaly detection systems in industrial control systems with lower false positive rates.

Computer facilities and microprocessor-based technology have been successfully used in the energy industry. For protection and equipment control, this technology has been used in SCADA, remote control and monitoring applications. Particular attention is paid to the cyber security sector for automation and control systems. Protective application of the equipment and control, SCADA, monitoring and remote control, uses the technology with microprocessor. Due to the great importance of the power supply process, there is no question of being left in a state of vulnerability and neglect. Security is not perfect and will never be. For this reason, there will always be security breaches and incidents. Also, for this reason, not only protection mechanisms are in place, but also mechanisms for rapid detection of incidents and which are able to react effectively to the isolation of problems and to ensuring security. Processes security for systems will continue to evolve in the future. By definition, there are no communication systems that are 100% safe. Attacks against critical industrial infrastructures marked an increase not only in terms of number but also of the level of complexity. The destruction of the industrial control system (ICS) and critical processes were interrupted. For many organizations, the security improvement in ICS systems is great. The extreme sensitivity to ensure the availability and performance of industrial processes has led to a more conservative and rigorous approach to how security measures are implemented. Cyber-attacks that could compromise the availability, integrity, and confidentiality of ICS systems may come from within systems or from outside ICS systems. Among the ICS system infection vectors from the perspective of the SANS Institute (2014) include: external threats (state attacks, hacking etc.), malware, exploiting tools, phishing, internal attacks, cyber security protocols, and industrial espionage. This chapter addresses the cyber security issues required for the protection, automation, control and communications systems of transformation stations as well as methods that could be used to prevent computer attacks that can have a significant impact on the availability of the system Electro-energetic effect with serious consequences on extended area interruptions.

Critical industrial infrastructures are currently facing increasing cyberspace threats in their underlying information and communication systems. The advanced monitoring, control, and management functionalities of the industrial systems firmly rely on the reliable and secure operations of the industrial control system (ICS) network. This article characterizes the ICS network traffic and presents a scalable and efficient solution for real-time ICS network traffic anomaly detection, considering various forms of ICS anomaly events. The events due to the cyberattacks, malicious operating behaviors, and network anomalies can be effectively detected without sophisticated computational requirements and retrieval of communication protocols. The proposed hybrid statistical-machine learning model integrates a seasonal autoregressive integration moving average (SARIMA)-based dynamic threshold model and a long short-term memory (LSTM) model to jointly identify the abnormal traffic patterns with low false omission rates. The proposed solution is extensively evaluated at a realistic ICS cyber–physical system (CPS) testbed, and the numerical results confirm its high detection accuracy and low computational complexity. Note to Practitioners—This article was motivated by the challenge of real-time anomaly detection in industrial cyber–physical systems (CPSs). The existing industrial control system (ICS) network anomaly detection solutions are generally carried out based on a single model based on the historian database and cannot dynamically classify the abnormal conditions in a real-time fashion. A novel hybrid statistical-machine learning model is developed that integrates a seasonal autoregressive integration moving average (SARIMA)-based dynamic threshold model and a long short-term memory (LSTM) model to jointly identify the anomalous events through traffic pattern analysis. The proposed anomaly detection solution can efficiently provide accurate detection for cyberattacks, malicious operating behaviors, and network anomalies while meeting the real-time requirements of ICS networks. The proposed solution can be deployed in the realistic ICS CPSs, e.g., the power generation system, gas pipeline systems, and urban railway transportation systems. The preliminary numerical results obtained from the ICS-CPS testbed suggested that it can provide high detection accuracy with low computational complexity and, hence, can be adopted with minimal deployment hurdles.