Developing a Cyber Incident Communication Management Exercise for CI Stakeholders

Industrial control systems (ICSs) are crucial in managing critical infrastructure, making their security a paramount concern. In recent years, their widespread adoption, together with the overall distance spanned by the critical infrastructure of industrial communication networks, have increased the complexity of the networks’ topological arrangement, increasing their structural vulnerabilities. In this scenario, deep learning models, especially those that incorporate graph-aware mechanisms, have arisen as a promising solution. This paper presents a novel centrality-and graph-aware attack detector (CGAAD) that includes nodes’ significance by centrality measures within a graph convolution network (GCN) framework to provide superior cyberattack detection performance and increase the resilience of critical ICS infrastructure. The proposed CGAAD model is in three parts. First, centrality measures are used as features for each of the nodes in the ICS graph topology. Then, a sparse-autoencoder (sparse-AE) enhances the feature representations to harness the subsequent classification step. Finally, the GCN leverages the graph structure and the enhanced features to classify dataflow between nodes as either normal or attacked. Experimental results demonstrate promising performance, reaching nearly 99% in terms of accuracy and F1-score, reducing misclassifications of both normal and attacked samples, which is crucial in ICS critical infrastructure applications.

An evaluation framework for industrial control system cyber incidents

By 2030, forecasts suggest that urban areas will house 60 percent of the world’s population and one in every three people will live in cities with at least half a million inhabitants. Within the same time frame, the number of global megacities is expected to jump from 33 today to 43 in 2030 [1]. Underpinning these large urban areas will be an interconnected network of critical physical infrastructures reliant on Internet-connected Industrial Control Systems and susceptible to increasingly sophisticated, e.g., AI-enabled, cyber threats. In hand, the cyber threat landscape is shifting rapidly. We are seeing a sharp rise in the number of cyberattacks on critical infrastructure [2] with significant impacts cascading across multiple sectors and causing disruption to the provisioning of essential goods and services. Security scholars suggest that these impacts are not always equitable and that disruption to critical infrastructure can affect vulnerable groups differently [3], which further emphasizes the need to improve cybersecurity between critical infrastructure sectors [4]. Through structured analysis of city statistics, demographic information, cyber incidents, and current cyber policy, our presentation will articulate potential social implications of megacity growth through the lens of cyber-physical infrastructure disruption. We investigate the largest 15 megacities in the world and find that megacities continue to grow in population but not in cyber policy. We highlight recent examples of cyber-physical disruption in Mumbai and New York City with focus on implications for vulnerable populations. Our work suggests the need for future research on social responsibility regarding security of these critical infrastructure sectors and on the need for technology-focused law, policy, and regulation guidelines.

Industrial control systems (ICS)- the backbone of any modern nation's critical infrastructure (CI) such as the water, energy, transportation and information and communication technology (ICT) sectors-have been subjected to considerable cyberattacks in recent times. This is exacerbated by the gradual convergence of the information technology (IT) and operational technology (OT) domains. This paper sought to establish the basic cyber hygiene practices to stop malicious cyber activities against connected OTs. Cyber hygiene practices refer to knowledge, attitudes and behaviours consistently put into practice to eliminate a few root causes responsible for many cyber incidents. A scoping technique was adopted to review ICS security studies conducted in the past ten years (2012-2022). The key findings indicate that many CI operators have poor password and access control policies for onsite and remote access to networks, do not perform system updates and patching as and when it is necessary to do so, do not actively restrict, segregate and/or separate access to ICS networks and devices, and do not conduct cybersecurity awareness training as frequently as they should. Lastly, due to legacy ICS networks, threat intelligence tools such as extended detection and response and similar others to monitor and detect, in real-time, anomalous behaviour on the networks are rarely utilised for cyber risk assessment on OT networks.

Control systems are used in a number of different industrial sectors and critical infrastructures, including manufacturing, distribution, and transportation. Failure of these control systems because of malware or other faults would be catastrophic for critical infrastructure and would result in significant losses. Adverse operating conditions, such as those found in networked control systems, exacerbate the likelihood of vulnerability to malware attacks. The prospect of severe adversarial assaults such as buffer overflow, conventional faults, and especially stealthy Ladder Logic Bombs is a serious cause of concern in Industrial Control Systems (ICS) with novel attacks such as Struxnet. Decoupled at-distance Electromagnetic spectrum-based monitoring of faults and malware is more robust and can likely be integrated into Industrial Control System frameworks. Our failure analysis and Machine Learning (ML) modeling approach is fundamentally different from traditional methods in that we propose a Hybrid Quantum Artificial Intelligence-based Electromagnetic (EM) Spectral domain-based analysis approach that is completely decoupled from the controller processor and can predict PLC fault/malware conditions, including stealth Ladder Logic Bombs and buffer overflow attacks. Further, robust Supervisory Control Systems (SCSs) that interface with programmable logic controllers (PLCs) are essential components of Industrial Control Systems (ICSs) that handle critical infrastructure. Modern industrial control systems, on the other hand, are made up of densely linked Internet of Things (IoT) nodes. Because of their networked nature, supervisory control systems are also susceptible to widespread cyberattacks. As a result, in the case of a coordinated attack on IoT control systems, the dependability of Supervisory control decision-making procedures is jeopardized and need to be decoupled from the attacks. This work also develops a Fuzzy inference Engine-based supervisory monitoring technology based on the characteristics of the Hybrid Quantum AI-based analysis of the EM spectrum to reduce industrial plant downtime and false alarms by localizing adversarial attacks/faults, risk severity levels, and impacted nodes, as well as having dependability and malware immunity in networked Industrial control systems. The Hybrid QAI technique improved prediction accuracy by up to 88 percent when identifying different control system viruses and defects in 6-stage pipelined processors. The Fuzzy inference engine in the Mamdani Inference System architecture has been found to reduce the risk of false alarms and downtime.

Computer facilities and microprocessor-based technology have been successfully used in the energy industry. For protection and equipment control, this technology has been used in SCADA, remote control and monitoring applications. Particular attention is paid to the cyber security sector for automation and control systems. Protective application of the equipment and control, SCADA, monitoring and remote control, uses the technology with microprocessor. Due to the great importance of the power supply process, there is no question of being left in a state of vulnerability and neglect. Security is not perfect and will never be. For this reason, there will always be security breaches and incidents. Also, for this reason, not only protection mechanisms are in place, but also mechanisms for rapid detection of incidents and which are able to react effectively to the isolation of problems and to ensuring security. Processes security for systems will continue to evolve in the future. By definition, there are no communication systems that are 100% safe. Attacks against critical industrial infrastructures marked an increase not only in terms of number but also of the level of complexity. The destruction of the industrial control system (ICS) and critical processes were interrupted. For many organizations, the security improvement in ICS systems is great. The extreme sensitivity to ensure the availability and performance of industrial processes has led to a more conservative and rigorous approach to how security measures are implemented. Cyber-attacks that could compromise the availability, integrity, and confidentiality of ICS systems may come from within systems or from outside ICS systems. Among the ICS system infection vectors from the perspective of the SANS Institute (2014) include: external threats (state attacks, hacking etc.), malware, exploiting tools, phishing, internal attacks, cyber security protocols, and industrial espionage. This chapter addresses the cyber security issues required for the protection, automation, control and communications systems of transformation stations as well as methods that could be used to prevent computer attacks that can have a significant impact on the availability of the system Electro-energetic effect with serious consequences on extended area interruptions.

Industrial control systems (ICSs) operate a variety of critical infrastructures such as waterworks and power plants using cyber physical systems (CPSs). Abnormal or malicious behavior in these critical infrastructures can pose a serious threat to society. ICS networks tend to be configured such that specific tasks are performed repeatedly. Further, for a specific task, the resulting pattern in the ICS network traffic does not vary significantly. As a result, most traffic patterns that are caused by tasks that are normally performed in a specific ICS have already occurred in the past, unless the ICS is performing a completely new task. In such environments, anomaly-based intrusion detection system (IDS) can be helpful in the detection of abnormal or malicious behaviors. An anomaly-based IDS learns a statistical model of the normal activities of an ICS. We use the nearest-neighbor search (NNS) to learn patterns caused by normal activities of an ICS and identify anomalies. Our method learns the normal behavior in the overall traffic pattern based on the number of network packets transmitted and received along pairs of devices over a certain time interval. The method uses a geometric noise model with lognormal distribution to model the randomness on ICS network traffic and learns solutions through cross-validation on random samples. We present a fast algorithm, along with its theoretical time complexity analysis, in order to apply our method in real-time on a large-scale ICS. We provide experimental results tested on various types of large-scale traffic data that are collected from real ICSs of critical infrastructures.

Industrial Control Systems (ICS) are used worldwide in critical infrastructures. An ICS system can be a single embedded system working stand-alone for controlling a simple process or ICS can also be a very complex Distributed Control System (DCS) connected to Supervisory Control And Data Acquisition (SCADA) system(s) in a nuclear power plant. Although ICS are widely used today, there are very little research on the forensic acquisition and analyze ICS’s artefacts. In this paper we present a case study of forensics in ICS where we describe a method of safeguarding important volatile artefacts from an embedded industrial control system and several other sources.

Study on Device Authentication System for Dynamic Zoning of Industrial Control Systems

Critical industrial infrastructures are currently facing increasing cyberspace threats in their underlying information and communication systems. The advanced monitoring, control, and management functionalities of the industrial systems firmly rely on the reliable and secure operations of the industrial control system (ICS) network. This article characterizes the ICS network traffic and presents a scalable and efficient solution for real-time ICS network traffic anomaly detection, considering various forms of ICS anomaly events. The events due to the cyberattacks, malicious operating behaviors, and network anomalies can be effectively detected without sophisticated computational requirements and retrieval of communication protocols. The proposed hybrid statistical-machine learning model integrates a seasonal autoregressive integration moving average (SARIMA)-based dynamic threshold model and a long short-term memory (LSTM) model to jointly identify the abnormal traffic patterns with low false omission rates. The proposed solution is extensively evaluated at a realistic ICS cyber–physical system (CPS) testbed, and the numerical results confirm its high detection accuracy and low computational complexity. Note to Practitioners—This article was motivated by the challenge of real-time anomaly detection in industrial cyber–physical systems (CPSs). The existing industrial control system (ICS) network anomaly detection solutions are generally carried out based on a single model based on the historian database and cannot dynamically classify the abnormal conditions in a real-time fashion. A novel hybrid statistical-machine learning model is developed that integrates a seasonal autoregressive integration moving average (SARIMA)-based dynamic threshold model and a long short-term memory (LSTM) model to jointly identify the anomalous events through traffic pattern analysis. The proposed anomaly detection solution can efficiently provide accurate detection for cyberattacks, malicious operating behaviors, and network anomalies while meeting the real-time requirements of ICS networks. The proposed solution can be deployed in the realistic ICS CPSs, e.g., the power generation system, gas pipeline systems, and urban railway transportation systems. The preliminary numerical results obtained from the ICS-CPS testbed suggested that it can provide high detection accuracy with low computational complexity and, hence, can be adopted with minimal deployment hurdles.

Cybersecurity for industrial control systems: A survey

Industrial control systems (ICS) have an inherent lack of security and situational awareness capabilities at the field device level. Yet these systems comprise a significant portion of the nation's critical infrastructure. Currently, there is little insight into the characterization of attacks on ICS. Stuxnet provided an initial look at the type of tactics that can be employed to create physical damage via cyber means. The question still remains, however, as to the extent of malware and attacks that are targeting the critical infrastructure, along with the various methods employed to target systems associated with the ICS environment. This paper presents a device using Gumstix technology that emulates an ICS field device. The emulation device is low-cost, adaptable to myriad ICS environments and provides logging capabilities at the field device level. The device was evaluated to ensure conformity to RFC standards and that the operating characteristics are consistent with actual field devices.

Critical infrastructures support essential services across various sectors, including finance, energy, healthcare, and public administration. However, their increasing exposure to the internet, combined with insecure communication protocols, weak authentication mechanisms, and misconfigurations, makes them prime targets for cyber threats. To address these risks, this paper presents a novel cybersecurity methodology tailored for Industrial Control Systems (ICS), leveraging the Shodan search engine for systematic vulnerability identification. The proposed approach integrates six key phases: IP discovery (1), DNS verification (2), port, protocol and service identification (3), operating system profiling (4), web application analysis (5), and comprehensive risk assessment using a customized risk matrix (6). This study contributes by (1) conducting a systematic literature review to identify gaps in existing ICS security frameworks, (2) developing a structured methodology for risk assessment across different ICS lifecycle phases, (3) applying the methodology to a real-world case study to validate its effectiveness, and (4) demonstrating its capability to systematically identify vulnerabilities, quantify risks, and provide actionable security insights. The results reveal critical security gaps, such as outdated software and unencrypted communication channels, emphasizing the need for improved security controls. By quantifying the attack surface and assessing risk levels, the proposed model enables stakeholders to prioritize remediation efforts effectively. The findings highlight the urgent need for proactive security measures in ICS environments, reinforcing the importance of continuous monitoring and risk mitigation strategies to enhance the resilience of critical infrastructures against evolving cyber threats.

This report documents the program and the outcomes of Dagstuhl Seminar 14292 “Network Attack Detection and Defense: Securing Industrial Control Systems for Critical Infrastructures”. The main objective of the seminar was to discuss new approaches and ideas for securing industrial control systems. It is the sequel of several previous Dagstuhl seminars: (1) the series “Network Attack Detection and Defense” held in 2008 and 2012, and (2) the Dagstuhl seminar “Securing Critical Infrastructures from Targeted Attacks”, held in 2012. At the seminar, which brought together members from academia an industry, appropriate methods for detecting attacks on industrial control systems (ICSs) and for limiting the impact on the physical components were considered. A central question was whether and how reactive security mechanisms can be made more ICS- and process-aware. To some extent it seems possible to adopt existing security approaches from other areas (e. g., conventional networks, embedded systems, or sensor networks). The main question is whether adopting these approaches is sufficient to reach the desired level of security for ICSs. Detecting attacks to the physical components and appropriate reactions to attacks are new aspects that need to be considered as well. The main result of the seminar is a list of recommendations for future directions in ICS security that is presented in this report.

A critical infrastructure (CI) consists of those physical and information technology facilities, networks, services and assets which, if disrupted or destroyed, have a serious impact on the health, safety, security or economic well-being of citizens or the effective functioning of governments. Nowadays, the operation controls of these infrastructures have been computerized and have gradually become open systems. The malfunction controls of the information technology (IT) have been one of the focuses in the researches of information security management in industrial control system (ICS). In this paper we discuss the IT malfunction of ICS security incidents which occurred in Taiwan, and explore the details of the controls for CI.