Securing manufacturing industrial control systems:

Cyber physical systems (CPSs) utilised in many of the critical infrastructures including the smart grid. The operational activities of smart grid's CPS use different industrial solution such as industrial control systems (ICS) for monitoring and controlling the physical architecture of smart grid. Therefore, it is quite essential to keep these industrial control systems secure and safe from potential hazards and cyber world as it may be harmful for human safety, strategic infrastructure of a country and also for the economy. The study gathered the scattered guidelines, best practices and policies available from various organisations such as National Institute of Standards and Technology (NIST), ISO, and North American Electric Reliability Corporation (NERC) for the purpose of developing safe and secure ICS security systems and also the knowledge about the issues involved in ICS security and protection. A conceptual framework is proposed and developed to address the shortcomings in-order to protect the ICS systems in a smart grid environment. The proposed framework was developed by reviewing related studies, standards and utilising IT security working experience. This framework will not only expand the horizon of knowledge but also provides pathway for the development of existing activities of CPS applications such as smart grid.

After investigating the conception and features of PLC (Programmable Logic Controller) and embedded system, in this paper the conception of a Quasi-PLC is proposed, which combine the advantages of PLC and embedded system. The architecture of Quasi-PLC and a Top-Down design method with collaboration design of software and hardware for Quasi-PLC embedded control system are researched then. Finally, setting the large-scale industrial valve control system as an example, the conception of Quasi-PLC and related technologies are used in industrial valve control system, and a satisfied application effect is obtained, which proves the rationality of the conception of Quasi-PLC and related technologies.

The implementation of automated regulatory control has been around since the middle of the last century through analog means. It has allowed engineers to operate the plant more consistently by focusing on overall operations and settings instead of individual monitoring of local instruments (inside and outside of a control room). A similar approach is proposed for cyber security, where current border-protection designs have been inherited from information technology developments that lack consideration of the high-reliability, high consequence nature of industrial control systems. Instead of an independent development, however, an integrated approach is taken to develop a holistic understanding of performance. This performance takes shape inside a multiagent design, which provides a notional context to model highly decentralized and complex industrial process control systems, the nervous system of critical infrastructure. The resulting strategy will provide a framework for researching solutions to security and unrecognized interdependency concerns with industrial control systems.

Cybersecurity for industrial control systems: A survey

The oil and gas industry, a vital lifeline fueling the global economy, find itself at a pivotal juncture where the convergence of operational technology (OT) and information technology (IT) has ushered in unprecedented opportunities and challenges. As digital transformation sweeps across this sector, the imperative to fortify cybersecurity defenses against ever-evolving threats has become paramount. Innovative and forward-looking oil and gas organizations across the globe are adopting the Cloud in many forms because of their digital transformation initiatives. Data lakes, edge technology, machine-to-machine communication, and machine learning (ML) algorithms have been enabling this industrial digital transformation. This transformation is also driving changes to the OT landscape, and as these environments continue to evolve, OT environments are leveraging well proven IT solution patterns to improve the productivity and efficiency of production operations. Industrial customers often start their digital transformation journey by sending OT data to the cloud for analysis and analytics without sending commands back to the industrial automation and control systems (ICAS). This process is often called "open loop" operations, since there is one-way communication from edge to cloud. Customers generally find this relatively easy to secure and manage. However, more often we are witnessing requirements to optimize operations by generating an automatic or operator-initiated response in the oil and gas production operation, rig management based on insights gained from cloud analytics. This process is often referred to as "closed loop" operations with two-way communication between edge and cloud. The security and compliance practices for closed loop operations are more rigorous because closed operations manipulate OT devices remotely. Developing these practices should be rooted in a cyber risk assessment to help businesses understand and prioritize security concerns. In this paper we propose how strengths of Cloud computing can become key enabler for oil and gas organizations in helping them enhance their overall security posture and manage risks within OT environments. We have deployed solution patterns described in this paper as the foundational pillar of several Oil and Gas organization's overall OT system architecture to unlock both "open loop" and "closed loop" operations in a secure, reliable and cost-effective manner. The specific scope items we will cover in this paper focus on a custom security uplift framework having four foundational components – 1) Cloud led architecture patterns to provide next generation network segmentation strategies in OT De-militarized Zone 2) OT asset inventory and vulnerability management 3) Centralized security monitoring and incident response with help of Artificial Intelligence and most recently providing Generative AI based virtual assistant to query security event data from OT systems. For organizations to plan their industrial digital transformation safely and securely, it is recommended that a multi-layered approach to secure the Industrial Control Systems (ICS)/OT and Cloud environments be implemented as captured in ten security golden rules in the following paper [1]. In addition to this, in the paper we propose a comprehensive architecture framework that aligns with established cybersecurity framework (CSF) such as NIST. The use case studies discussed in the paper will highlight how customer have been able to remediate critical security vulnerabilities within weeks post implementation by deploying a comprehensive asset inventory discovery and vulnerability assessment. This has help reduce mean time to identify and mitigate vulnerabilities from months to days with automated testing in pre-production environments, ensure quick detection and response towards security incidents with help of advanced security monitoring and incident response playbooks, covering 100% of the OT assets through this capability and leverage advanced data analytics, machine learning to perform log mining, data cleansing, data validation, log mining and analysis through natural language processing such as conversational AI assistants powered by large language model (LLM) in the Cloud.

Control systems are used in a number of different industrial sectors and critical infrastructures, including manufacturing, distribution, and transportation. Failure of these control systems because of malware or other faults would be catastrophic for critical infrastructure and would result in significant losses. Adverse operating conditions, such as those found in networked control systems, exacerbate the likelihood of vulnerability to malware attacks. The prospect of severe adversarial assaults such as buffer overflow, conventional faults, and especially stealthy Ladder Logic Bombs is a serious cause of concern in Industrial Control Systems (ICS) with novel attacks such as Struxnet. Decoupled at-distance Electromagnetic spectrum-based monitoring of faults and malware is more robust and can likely be integrated into Industrial Control System frameworks. Our failure analysis and Machine Learning (ML) modeling approach is fundamentally different from traditional methods in that we propose a Hybrid Quantum Artificial Intelligence-based Electromagnetic (EM) Spectral domain-based analysis approach that is completely decoupled from the controller processor and can predict PLC fault/malware conditions, including stealth Ladder Logic Bombs and buffer overflow attacks. Further, robust Supervisory Control Systems (SCSs) that interface with programmable logic controllers (PLCs) are essential components of Industrial Control Systems (ICSs) that handle critical infrastructure. Modern industrial control systems, on the other hand, are made up of densely linked Internet of Things (IoT) nodes. Because of their networked nature, supervisory control systems are also susceptible to widespread cyberattacks. As a result, in the case of a coordinated attack on IoT control systems, the dependability of Supervisory control decision-making procedures is jeopardized and need to be decoupled from the attacks. This work also develops a Fuzzy inference Engine-based supervisory monitoring technology based on the characteristics of the Hybrid Quantum AI-based analysis of the EM spectrum to reduce industrial plant downtime and false alarms by localizing adversarial attacks/faults, risk severity levels, and impacted nodes, as well as having dependability and malware immunity in networked Industrial control systems. The Hybrid QAI technique improved prediction accuracy by up to 88 percent when identifying different control system viruses and defects in 6-stage pipelined processors. The Fuzzy inference engine in the Mamdani Inference System architecture has been found to reduce the risk of false alarms and downtime.

Industry 4.0 is the German vision for the future of manufacturing, where smart factories use information and communication technologies to digitise their processes to achieve improved quality, lower costs, and increased efficiency. It is likely to bring a massive change to the way control systems function today. Future distributed control systems are expected to have an increased connectivity to the Internet, in order to capitalize on new offers and research findings related to digitalization, such as cloud, big data, and machine learning. A key technology in the realization of distributed control systems is middleware, which is usually described as a reusable software layer between operating system and distributed applications. Various middleware technologies have been proposed to facilitate communication in industrial control systems and hide the heterogeneity amongst the subsystems, such as OPC UA, DDS, and RT-CORBA. These technologies can significantly simplify the system design and integration of devices despite their heterogeneity. However, each of these technologies has its own characteristics that may work better for particular applications. Selection of the best middleware for a specific application is a critical issue for system designers. In this paper, we conduct a survey on available standard middleware technologies, including OPC UA, DDS, and RT-CORBA, and show new trends for different industrial domains.

Recent world events and geopolitics have brought the vulnerability of critical infrastructure to cyberattacks to the forefront. While there has been considerable attention to attacks on Information Technology (IT) systems, such as data theft and ransomware, the vulnerabilities and dangers posed by industrial control systems (ICS) have received significantly less attention. What is very different is that industrial control systems can be made to do things that could destroy equipment or even harm people. For example, in 2021 the US encountered a cyberattack on a water treatment plant in Florida that could have resulted in serious injuries or even death. These risks are based on the unique physical characteristics of these industrial systems. In this paper, we present a holistic, integrated safety and security analysis, we call Cybersafety, based on the STAMP (System-Theoretic Accident Model and Processes) framework, for one such industrial system—an industrial chiller plant—as an example. In this analysis, we identify vulnerabilities emerging from interactions between technology, operator actions as well as organizational structure, and provide recommendations to mitigate resulting loss scenarios in a systematic manner.

Nuclear power plants are important industrial production facilities whose safety issues can have disastrous consequences for the social environment. With the deep fusion of industrialization and information, the nuclear power control system is gradually transformed into automatic digital systems. Such development improves the production efficiency and economic benefits, but introduce the security problem from traditional IT systems into industrial control systems. However, the existing power industrial control system of nuclear power plant mainly adopts firewall, anti-virus software, network gate and other passive security strategies, which lack the safety of active. Besides, only part of the data can be backed up locally and the remote backup is completed manually by operators regularly. The security of industrial control systems cannot be guaranteed and real-time remote backup cannot be realized. In this paper, we analyze and summarize the characteristics of industrial control systems used in nuclear power plants. Then we propose a Truly Private Network (TPN) for nuclear power plants based on the Multi-identifier network (MIN), which integrates blockchain, cryptography, and other security mechanisms to provide a trusted environment. Lastly, we build a network remote real-time backup scheme based on Mimic distributed storage technology providing data tamper-resistance and traceability for nuclear power plants.

Computer facilities and microprocessor-based technology have been successfully used in the energy industry. For protection and equipment control, this technology has been used in SCADA, remote control and monitoring applications. Particular attention is paid to the cyber security sector for automation and control systems. Protective application of the equipment and control, SCADA, monitoring and remote control, uses the technology with microprocessor. Due to the great importance of the power supply process, there is no question of being left in a state of vulnerability and neglect. Security is not perfect and will never be. For this reason, there will always be security breaches and incidents. Also, for this reason, not only protection mechanisms are in place, but also mechanisms for rapid detection of incidents and which are able to react effectively to the isolation of problems and to ensuring security. Processes security for systems will continue to evolve in the future. By definition, there are no communication systems that are 100% safe. Attacks against critical industrial infrastructures marked an increase not only in terms of number but also of the level of complexity. The destruction of the industrial control system (ICS) and critical processes were interrupted. For many organizations, the security improvement in ICS systems is great. The extreme sensitivity to ensure the availability and performance of industrial processes has led to a more conservative and rigorous approach to how security measures are implemented. Cyber-attacks that could compromise the availability, integrity, and confidentiality of ICS systems may come from within systems or from outside ICS systems. Among the ICS system infection vectors from the perspective of the SANS Institute (2014) include: external threats (state attacks, hacking etc.), malware, exploiting tools, phishing, internal attacks, cyber security protocols, and industrial espionage. This chapter addresses the cyber security issues required for the protection, automation, control and communications systems of transformation stations as well as methods that could be used to prevent computer attacks that can have a significant impact on the availability of the system Electro-energetic effect with serious consequences on extended area interruptions.

Detecting cyberattacks in industrial control systems using online learning algorithms

This paper addresses the pressing challenges of building secure and resilient Industrial Control Systems (ICS) by focusing on rapid attack detection, recovery, and maintaining monotonicity in online monitoring systems. Traditional methods often fail to quickly identify threats, leaving systems vulnerable to prolonged downtime. Specifically, classical online monitoring systems struggle to preserve monotonicity, as they typically detect only isolated anomalies during operation, which can mask subsequent deviations in system behavior. This research presents an advanced approach to resilient cyber-physical systems (CPS) that utilizes Signal Temporal Logic with Global Time (STL-GT) in combination with an Autotuning mechanism for robust realtime monitoring, multi-point anomaly detection, and recovery. This innovative framework enables prompt detection of attacks and faults, along with rapid system recovery. Our STL-GT online monitoring system incorporates a syntactic separation technique based on a partition rule to address monotonicity issues and improve the system's ability to detect and respond to multiple anomalies during system execution. The autotuning mechanism, based on Internal Model Control (IMC) PID tuning rules, enables swift and adaptive system recovery in the event of disruptions. We validated our methodology using the Tennessee Eastman Plant model, a complex chemical plant simulator designed to study industrial processes and control systems. Experimental results demonstrate that our approach provides effective security and resilience of the CPS by consistently detecting anomalies and restoring the system with zero overshoot and minimal oscillations, eliminating violation masking and missed alarms. These findings highlight the effectiveness of our approach in fortifying critical systems against adversarial attacks and operational faults.

Industrial Control Systems (ICS) are used worldwide in critical infrastructures. An ICS system can be a single embedded system working stand-alone for controlling a simple process or ICS can also be a very complex Distributed Control System (DCS) connected to Supervisory Control And Data Acquisition (SCADA) system(s) in a nuclear power plant. Although ICS are widely used today, there are very little research on the forensic acquisition and analyze ICS’s artefacts. In this paper we present a case study of forensics in ICS where we describe a method of safeguarding important volatile artefacts from an embedded industrial control system and several other sources.

The integration of Industrial Control Systems (ICS) with Information and Communication Technologies (ICT) systems has resulted in tremendous increase in the number of ICS security incidents. Current ICS incident response practices can hardly be applied into ICS directly as the two systems are fundamentally different in terms of system complexity, criticality, flexibility and dependability. This paper addresses this challenges by proposing an ICS incident response decision framework. It is based on decision-making theory and has descriptive, predictive and prescriptive models that particularly address ICS incident response decision-making. This framework is implemented using a service-oriented architecture (SOA) that provides incident response decision making as services and offers standardized interfaces to integrate with existing incident management systems.

Introduction In the last chapter, we explored how to determine a cyber-attacker's optimal strategy for attacking a computer system based on malware and exploits available on the darkweb. In this chapter, we look at the case where the attacker is focused on industrial control systems (ICS): IT infrastructure that controls physical systems (electricity, water, industrial machinery, etc.). A critical feature of these complex ICS systems is the interdependencies among various components. However, despite the prevalence of markets for malware and exploits, and their potential threat to ICS, existing paradigms, including the framework presented in the previous chapter, do not account for the complex nature of ICS systems consisting of multiple interconnected components. In particular, it would prove useful to simulate a cyber-attack on a model of an existing system, to assess its degree of vulnerability. Such a model would also prove useful for automated cybersecurity systems that can learn defense and contingency strategies based on the model's simulations. This chapter takes the first steps toward addressing this need. In particular, we introduce a framework that allows for modeling of ICS systems with highly interconnected components (Section 7.3) and study this model through the lens of lattice theory [57]. We then turn our attention to the problem of determining the optimal/most dangerous strategy for a cyber-adversary with respect to this model and find it to be an NPComplete problem (Section 7.4). Next, we present a suite of algorithms for this problem based on A* search and introduce provably correct algorithms (Section 7.5). Our intuition is that these algorithms will obtain satisfactory performance in practice due to heuristic functions (for which we show admissibility). We demonstrate the performance of these algorithms by implementing them and performing a suite of experiments using both simulated and actual vulnerability data (Section 7.6). This chapter also includes some background on ICS (Section 7.2) and a brief overview of related work (Section 7.7). Background Contemporary cyber threat actors rely on a variety of malware and exploits purchased through various channels such as the darkweb [99] in order to carry out their attacks. The trend toward automation of industrial control systems (ICS) and toward “smart” utilities [50] has made understanding such adversarialbehavior directed against ICS a priority. For instance, code from the infamous Stuxnet [97] attack against Iranian nuclear facilities is available for public download.