The Cybersecurity Landscape in Industrial Control Systems

The integration of Industrial Control Systems (ICS) with Information and Communication Technologies (ICT) systems has resulted in tremendous increase in the number of ICS security incidents. Current ICS incident response practices can hardly be applied into ICS directly as the two systems are fundamentally different in terms of system complexity, criticality, flexibility and dependability. This paper addresses this challenges by proposing an ICS incident response decision framework. It is based on decision-making theory and has descriptive, predictive and prescriptive models that particularly address ICS incident response decision-making. This framework is implemented using a service-oriented architecture (SOA) that provides incident response decision making as services and offers standardized interfaces to integrate with existing incident management systems.

A security testbed is an important aspect of Industrial Control System (ICS) security research. However, existing testbeds still have many problems in that they cannot fully simulate enterprise networks and ICS attacks. This paper presents a Multiple-Scenario Industrial Control System Testbed (MSICST), a hardware-in-the-loop ICS testbed for security research. The testbed contains four typical process scenarios: thermal power plant, rail transit, smart grid, and intelligent manufacturing. We use a combination of actual physical equipment and software simulations to build the process scenario sand table and use real hardware and software to build the control systems, demilitarized zone, and enterprise zone networks. According to the ICS cyber kill chain, the attacker is modeled, and two typical attack scenarios are constructed in the testbed. Through research into this security solution, whitelist-based host protection and a new Intrusion Detection System (IDS) are proposed and tested.

Industrial control systems (ICS)- the backbone of any modern nation's critical infrastructure (CI) such as the water, energy, transportation and information and communication technology (ICT) sectors-have been subjected to considerable cyberattacks in recent times. This is exacerbated by the gradual convergence of the information technology (IT) and operational technology (OT) domains. This paper sought to establish the basic cyber hygiene practices to stop malicious cyber activities against connected OTs. Cyber hygiene practices refer to knowledge, attitudes and behaviours consistently put into practice to eliminate a few root causes responsible for many cyber incidents. A scoping technique was adopted to review ICS security studies conducted in the past ten years (2012-2022). The key findings indicate that many CI operators have poor password and access control policies for onsite and remote access to networks, do not perform system updates and patching as and when it is necessary to do so, do not actively restrict, segregate and/or separate access to ICS networks and devices, and do not conduct cybersecurity awareness training as frequently as they should. Lastly, due to legacy ICS networks, threat intelligence tools such as extended detection and response and similar others to monitor and detect, in real-time, anomalous behaviour on the networks are rarely utilised for cyber risk assessment on OT networks.

Cyber threats to industrial control systems (ICSs) have increased as information and communications technology (ICT) has been incorporated. In response to these cyber threats, we are implementing a range of security equipment and specialized training programs. Anomaly data stemming from cyber-attacks are crucial for effectively testing security equipment and conducting cyber training exercises. However, securing anomaly data in an ICS environment requires a lot of effort. For this reason, we propose a method for generating anomaly data that reflects cyber-attack characteristics. This method uses systematic sampling and linear regression models in an ICS environment to generate anomaly data reflecting cyber-attack characteristics based on benign data. The method uses statistical analysis to identify features indicative of cyber-attack characteristics and alters their values from benign data through systematic sampling. The transformed data are then used to train a linear regression model. The linear regression model can predict features because it has learned the linear relationships between data features. This experiment used ICS_PCAPS data generated based on Modbus, frequently used in ICS. In this experiment, more than 50,000 new anomaly data pieces were generated. As a result of using some of the new anomaly data generated as training data for the existing model, no significant performance degradation occurred. Additionally, comparing some of the new anomaly data with the original benign and attack data using kernel density estimation confirmed that the new anomaly data pattern was changing from benign data to attack data. In this way, anomaly data that partially reflect the pattern of the attack data were created. The proposed method generates anomaly data like cyber-attack data quickly and logically, free from the constraints of cost, time, and original cyber-attack data required in existing research.

This report documents the program and the outcomes of Dagstuhl Seminar 14292 “Network Attack Detection and Defense: Securing Industrial Control Systems for Critical Infrastructures”. The main objective of the seminar was to discuss new approaches and ideas for securing industrial control systems. It is the sequel of several previous Dagstuhl seminars: (1) the series “Network Attack Detection and Defense” held in 2008 and 2012, and (2) the Dagstuhl seminar “Securing Critical Infrastructures from Targeted Attacks”, held in 2012. At the seminar, which brought together members from academia an industry, appropriate methods for detecting attacks on industrial control systems (ICSs) and for limiting the impact on the physical components were considered. A central question was whether and how reactive security mechanisms can be made more ICS- and process-aware. To some extent it seems possible to adopt existing security approaches from other areas (e. g., conventional networks, embedded systems, or sensor networks). The main question is whether adopting these approaches is sufficient to reach the desired level of security for ICSs. Detecting attacks to the physical components and appropriate reactions to attacks are new aspects that need to be considered as well. The main result of the seminar is a list of recommendations for future directions in ICS security that is presented in this report.

Background. Life expectancy is an important health status indicator based on average number of years a person at a given age may be expected to live given current mortality rates. Given this significance, it would be necessary to probe into the factors affecting the life expectancy. Ensuring that information and communication technology (ICT) services are properly used could contribute to development and achievement, as it represents an important issue for the countries moving toward knowledge-based and information-based societies. Therefore, this study explored the impact of the information and communication technology on life expectancy. Methods. This study covers annual data from 2008 to 2018 for a group of countries in the Middle East. Data were retrieved from the Annual Reports such as World Bank and International Telecommunication Union (ITU) data sets. The effects of ICT on life expectancy are estimated with the Panel model. We also used the Hausman test to investigate fixed versus random effects. The data were analyzed by Stata 14 software. Results. The core findings of this study confirm the significant impact of ICT on life expectancy in the Middle East. The calculated Coefficient of the regression was 0.551 indicating how much life expectancy changes when ICT variable increases by one unit. Moreover, the rho (intraclass correlation) was found to be 0.975 showing that 97.5% of the variance is due to differences across panels. Conclusion. Considering the effect of ICT on life expectancy, policymakers of the Middle Eastern countries should integrate the use of ICT with the existing programs and systems. Technology is not an end in itself but merely the means to reinforce the existing system and to meet the locally determined goals. It can be used as a tool to attain broader health and development goals. Background Life expectancy is an important health status indicator based on average number of years a person at a given age may be expected to live given current mortality rates. Given this significance, it would be necessary to probe into the factors affecting the life expectancy. Ensuring that information and communication technology (ICT) services are properly used could contribute to development and achievement, as it represents an important issue for the countries moving toward knowledge-based and information-based societies. As ICT affects everyday lives, it also impacts the macroeconomic growth, which in turn further affects everyday lives by allowing improvements in infrastructures and a higher standard of living. ICTs inherently entail the economic development of countries, regions and cities, while also improving social inclusion, well-being and therefore quality of life. Therefore, this study explored the impact of the information and communication technology on life expectancy. Methods This study covers annual data from 2008 to 2018 for a group of countries of in the Middle East. Data were retrieved from the Annual Reports such as World Bank dataset and International Telecommunication Union (ITU) data set. The effects of information and communication technology on life expectancy were estimated through the Panel model. First, stationary tests were performed with the Fisher’s generalized unit root test. In the Fisher test for panel data, the null hypothesis of a unit root was rejected at the 5% level of significance. The cross-section correlation test was performed with the Freeze test. The null hypothesis of no correlation was rejected at the 5% level of significance. We also used the Hausman test to investigate fixed versus random effects. The null hypothesis of no fixed effects was accepted so the random effects model was used. The Hausman test detects endogenous regressors in a regression model. Endogenous variables have values that are determined by other variables in the system. The data were analyzed by Stata 14 software. Results The core findings of this study confirm the significant impact of information and communication technology on life expectancy in the Middle East. The Coefficient of the regression was 0.551 indicating how much life expectancy changes when information technology variable increases by one unit. The coefficient of ICT shows that 1% increase in ICT variable causes 0.551 % incline in life expectancy and this result is significant at 5% level of significance. Regarding control variables, we found that all have expected statistically significant effects on life expectancy. The intra-cluster correlation coefficient (rho) is a measure of the relatedness, or similarity, of clustered data. Values of rho range from 0 to 1 in human studies, and as the rho increases, more individuals within the clusters resemble one another. The rho (intraclass correlation) was found to be 0.975 showing that 97.5% of the variance is due to differences across panels. This research recommends that human development programs need to focus on polices which foster digital inclusion. Conclusion Considering the effect of information and communication technology on life expectancy, policymakers of the Middle Eastern countries should integrate the use of information and communication technology with the existing programs and systems. The digital citizen is happier and values living in regions with technological capacity, investing in research & development, and committed to achieving sustainable growth. ICT use leads to improved assessments of the efficiency and management of the public administration by more technological users, underlining the importance of an understanding between users and public services in the virtual sphere. Technology is not an end in itself but merely an instrument to reinforce the existing system and to meet the locally determined goals. It can be used as a tool to attain broader health and development goals. The findings from this study provide key insights that explain how life expectancy may be enhanced through ICTs. Practical Implications of Research According to the influence of information and communication technology (ICT) on life expectancy, policymakers should provide ICT infrastructures and adopt strategies integrating ICT policies with human life criteria such as education, health and work to improve life expectancy. Ethical Consideration The paper reflects the author’s own research and analysis in a truthful and complete manner. Conflict of Interests This study was an independent research and the author declares no potential conflicts of interest with respect to the research, authorship, and/or publication of this article. Acknowledgement I would like to thank Dr Marzieh Ronaghi for her guidance and assistance throughout this research.

One of the areas in which these technological advances are dramatically influencing people’s lives is information technology and telecommunications hence the claim that we are in the midst of a ‘digital revolution’ that is driving us towards an ‘information society’. The development of human learning abilities has been changed over the past 60 years of technological innovation starting from the widespread use of the radio, through television, and finally to the mass implementation of computers and information and communication technologies (ICT). With information revolution on the go, shift towards knowledge-based economy is the prime target of all nations of the world. Also, there is a growing concern about the current trends in ICT adoption and use. Throughout the world communities are grappling with the concept of knowledge based development. Education is considered, as the most important contributing factor to nations development and achievement of knowledge economy in the era of information revolution. Education especially the primary and secondary education is important; as it is here the foundations of knowledge are led. The literature on educational technology lacks empirical research on the social practice of information and communication technology (ICT) that would enable us to extend our understanding of the barriers to adoption and integration of ICT in the educational context. The present field study was undertaken with teachers, students, parents and staff of a government primary educational institute in a disadvantaged rural area of India. Research was initiated with the investigation by adapting participatory appraisal methods suitable to a rural context. The anthropological approach used in the present research focuses on the influences of culture and society on the individual adoption behavior; it emphasizes participant observation and academic analysis of behavior through both management and consumer perspectives. The cultural capital in question includes knowledge about ICT product features and qualities, ICT skills, digital literacy, the level of education of family elders, and proficiency in English. Economic capital includes access to electricity, lack of knowledge of the ICT market, a transportation system, and ownership of ICT equipment. Social capital includes distrust of rural and semi-urban sources of ICT purchases, lack of motivation, and access to ICT. In addition to finding ways to facilitate the work of teachers and educational institutions in both formal and non-formal learning environments, the informal learning environment has to be considered. The paper explores that every culture, organizational or national, is different, and not all technologies are equally acceptable in all cultures. It brings forward the ground realities including policy concerns, failures in governmental efforts and community’s role in facilitating ICT adoption. It also highlights the role of teacher’s in promoting ICT adoption and use in education. The better we understand culture, the better we can maximize the usefulness of new information technology in the workplace. Keywords: ICT4d, educational technology, digital literacy, developing countries, barriers to technology, diffusion of innovations.

Detecting cyberattacks in industrial control systems using online learning algorithms

After investigating the conception and features of PLC (Programmable Logic Controller) and embedded system, in this paper the conception of a Quasi-PLC is proposed, which combine the advantages of PLC and embedded system. The architecture of Quasi-PLC and a Top-Down design method with collaboration design of software and hardware for Quasi-PLC embedded control system are researched then. Finally, setting the large-scale industrial valve control system as an example, the conception of Quasi-PLC and related technologies are used in industrial valve control system, and a satisfied application effect is obtained, which proves the rationality of the conception of Quasi-PLC and related technologies.

Nuclear power plants are important industrial production facilities whose safety issues can have disastrous consequences for the social environment. With the deep fusion of industrialization and information, the nuclear power control system is gradually transformed into automatic digital systems. Such development improves the production efficiency and economic benefits, but introduce the security problem from traditional IT systems into industrial control systems. However, the existing power industrial control system of nuclear power plant mainly adopts firewall, anti-virus software, network gate and other passive security strategies, which lack the safety of active. Besides, only part of the data can be backed up locally and the remote backup is completed manually by operators regularly. The security of industrial control systems cannot be guaranteed and real-time remote backup cannot be realized. In this paper, we analyze and summarize the characteristics of industrial control systems used in nuclear power plants. Then we propose a Truly Private Network (TPN) for nuclear power plants based on the Multi-identifier network (MIN), which integrates blockchain, cryptography, and other security mechanisms to provide a trusted environment. Lastly, we build a network remote real-time backup scheme based on Mimic distributed storage technology providing data tamper-resistance and traceability for nuclear power plants.

Recent world events and geopolitics have brought the vulnerability of critical infrastructure to cyberattacks to the forefront. While there has been considerable attention to attacks on Information Technology (IT) systems, such as data theft and ransomware, the vulnerabilities and dangers posed by industrial control systems (ICS) have received significantly less attention. What is very different is that industrial control systems can be made to do things that could destroy equipment or even harm people. For example, in 2021 the US encountered a cyberattack on a water treatment plant in Florida that could have resulted in serious injuries or even death. These risks are based on the unique physical characteristics of these industrial systems. In this paper, we present a holistic, integrated safety and security analysis, we call Cybersafety, based on the STAMP (System-Theoretic Accident Model and Processes) framework, for one such industrial system—an industrial chiller plant—as an example. In this analysis, we identify vulnerabilities emerging from interactions between technology, operator actions as well as organizational structure, and provide recommendations to mitigate resulting loss scenarios in a systematic manner.

Industrial control system (ICS) devices with IP addresses are accessible on the Internet and become an essential part of critical infrastructures. The adoption of ICS devices also yields cyber-attacks targeted specific port based on proprietary industrial protocols. However, there is a lack of comprehensive understanding of these ICS threats in cyberspace. To this end, this paper uniquely exploits active interaction on ICS-related ports and analysis of long-term multi-port traffic in a first attempt ever to capture and comprehend ICS automated attacks based on private protocols. Specially, we first propose a minimal-interaction scheme for ICS honeypot(MirrorPot), which can listen on any port and respond automatically without understanding the protocol format. Then, we devise a preprocessing algorithm to extract requests payload and classify them from long-term honeypot-captured data. Finally, to better characterize the ICS attacks based on private industrial protocols, we propose a Markov state transition model for describing their attack complexity. Our experiments show that there are several unknown probing methods have not been observed by previous works. We concur that our work provides a solid first step towards capturing and comprehending real ICS attacks based on private protocols.

Having explored the general nature of ICS and SCADA systems, it is time to take a broad look at threats to these systems, i.e., the causes of cyber incidents. An ISO standard (ISO27000 2014) for information and communication technology (ICT) defines threat as potential cause of an unwanted incident , which may result in harm to a system or organization. The former (ISO22399 2007) standard, which stems from the incident preparedness and operational continuity management domain, defines a threat as potential cause of an unwanted incident , which may result in harm to individuals, a system or organization, the environment or the community.

The fact that modern Networked Industrial Control Systems (NICS) depend on Information and Communication Technologies (ICT), is well known. Although many studies have focused on the security of SCADA systems, today we still lack the proper understanding of the effects that cyber attacks have on NICS. In this paper we identify the communication and control logic implementation parameters that influence the outcome of attacks against NICS and that could be used as effective measures for increasing the resilience of industrial installations. The implemented scenario involves a powerful attacker that is able to send legitimate Modbus packets/commands to control hardware in order to bring the physical process into a critical state, i.e. dangerous, or more generally unwanted state of the system. The analysis uses a Boiling Water Power Plant to show that the outcome of cyber attacks is influenced by network delays, packet losses, background traffic and control logic scheduling time. The main goal of this paper is to start an exploration of cyber-physical effects in particular scenarios. This study is the first of its kind to analyze cyber-physical systems and provides insight to the way that the cyber realm affects the physical realm.

As an extension of a previous methodological proposal to provide management of information security in Industrial Control Systems (ICS), this study aims to adapt IT frameworks to protect industrial and manufacturing enterprises against Information and Communication Technology disruptions and malicious activity. In order to accomplish this purpose, the integration of traditional IT standards and good practices such as COBIT, PMI-PMBOK, ITIL and NIST have been merged. Hereby, COBIT has been applied to align management with the enterprise strategy, PMI-PMBOK for project management, and ITIL for the support and maintenance of ICS services. In this respect, NIST-SP 800-82 has been used as a Guide to ICS Security. Prior to its implementation, we performed an evaluation and selection of a group of tools of these frameworks. Furthermore, they have been used effectively in the operational management of the information security in real cases. Among the main obtained benefits, we were able to reduce incidents and accomplished a holistic management. The achieved results and indicators demonstrate that the management tools comply with the control of the information security in the ICS in the contexts of technology, processes, and people aligned with the strategic objectives.