Search

Testing cybersecurity techniques for critical infrastructure on real-world setups is economically infeasible and lacks flexibility. A study presents a testbed for water infrastructures capable of accurately assessing the effectiveness of cybersecurity solutions to address this challenge. The study has exploited the testbed to investigate monitoring systems’ reactions in the presence of physical and cyber issues. A comparison between a model-based fault diagnosis (FD) system with a network anomaly detector (NAD) has been provided. The experimental stage has stressed the consideration that wanted to be emphasized where the control theory world has to merge with the network security one in order to provide overall cyber–physical security for critical infrastructure (CI) scenarios.

Over the past decade, industrial control systems have experienced a massive integration with information technologies. Industrial networks have undergone numerous technical transformations to protect operational and production processes, leading today to a new industrial revolution. Information Technology tools are not able to guarantee confidentiality, integrity and availability in the industrial domain, therefore it is of paramount importance to understand the interaction of the physical components with the networks. For this reason, usually, the industrial control systems are an example of Cyber-Physical Systems (CPS). This paper aims to provide a tool for the detection of cyber attacks in cyber-physical systems. This method is based on Machine Learning to increase the security of the system. Through the analysis of the values assumed by Machine Learning it is possible to evaluate the classification performance of the three models. The model obtained using the training set, allows to classify a sample of anomalous behavior and a sample that is related to normal behavior. The attack identification is implemented in water tank system, and the identification approach using Machine Learning aims to avoid dangerous states, such as the overflow of a tank. The results are promising, demonstrating its effectiveness.

Critical Infrastructures (CIs) such as power grid, water and gas distribution are controlled by Industrial Control Systems (ICS). Sensors and actuators of a physical plant are managed by the ICS. Data and commands transmitted over the network from the Programmable Logic Controllers (PLCs) are saved and parsed within the Historian. Generally, this architecture guarantees to check for any process anomalies that may occur due to component failures and cyber attacks. The other use of this data allows activities such as forensic analysis. To secure the network is also crucial to protect the communication between devices. A cyber attack on the log devices could jeopardize any forensic analysis be it for maintenance, or discovering an attack trail. In this paper is proposed a strategy to secure plant operational data recorded in the Historian and data exchange in the network. An integrity checking mechanism, in combination with blockchain, is used to ensure data integrity. Data redundancy is achieved by applying an efficient replication mechanism and enables data recovery after an attack.

Over the last year, the Internet of Things (IoT) drove the development of cyber-physical systems, leading the convergence between information and operational technologies. This coupling improves performances and saves costs but increases the number of vulnerabilities and the attack surface to malicious actors. Consequently, it is mandatory to understand how IoT devices can be properly integrated into a more secure environment. This issue is even more crucial in the field of Critical Infrastructures, such as energy, water, transportation, and telecommunications. To this aim, this paper analyzes the concept of opacity for Discrete Event Systems (DES) and applies it to a real system. The opacity describes the ability of the system to keep some states secret even if an attacker knows the happening of some events. The proposed approach is validated by applying the concept of opacity on the analysis over a simple system. It is demonstrated that opacity can be guaranteed and exploited when systems having different levels of security are integrated.

The interaction among networking, sensing, and control in the modern industry results in a variety of new devices used in many sectors such as health, energy distribution, and transportation. The on-going tendency of exploiting automation and data exchange in manufacturing technologies leads to the Industry 4.0. The fourth industrial revolution deals with Cyber-Physical Systems, the Internet of Things, cloud computing, and cognitive computing converging towards the Industrial Internet of Things. To be successful, this new era requires innovative paradigms to ensure the security of provided services and connected systems. In the industrial field, the problem gets more complex due to the need of protecting a large attack surface while guaranteeing the availability of the systems and the real-time response to the presence of threats. In this chapter, we perform an analysis of the existing industrial threats and we present a distributed intrusion detection methodology to deal with attacks affecting the Industrial Internet of Things scenarios.

Industry 4.0 advent opens several cyber-threats scenarios originally designedfor classic information technology, drawing the attention to serious risks for themodern industrial control networks. To cope with this problem, in this paper weaddress the security issues related to covert channels applied to industrial networks,identifying the new vulnerability points when information technologies convergewith operational technologies such as edge computing infrastructures. Specifically,we define two signaling strategies where we exploit the Modbus/TCP protocol astarget to set up a covert channel. Once the threat channel is established, passiveand active offensive methodologies are further exploited by implementing and testingthem on a real Industrial Internet of Things testbed. The experimental resultshighlight the potential damage of such specific threats and the easy extrapolationof the attacks to other types of channels in order to show the new risks for the Industry4.0. Related to this, we discuss some countermeasures offering an overviewof possible mitigation and defensive measures.

Complex and heterogeneous systems characterize the Industry 4.0. Due to the Information Technology (IT) convergence towards the Operational Technology (OT), the development of innovative cyber-physical security tools represents a milestone for the Industrial Control Systems (ICSs) protection. In this context, honeypots are systems used as decoys to detect and analyze malicious actions. However, industrial networks require specific honeypot development capabilities. In this work, we present MimePot, a cyber-physical honeypot conceived for industrial control networks. Compared to classic honeypots, MimePot offers a model-based approach: it is able to simulate physical processes to lure skilled attackers targeting industrial plants. Moreover, MimePot uses the Software Defined Networking (SDN) technology to provide a consistent future proof security approach. We demonstrate the usefulness of MimePot performing data integrity attacks against a water distribution system in a simulated environment.

Critical infrastructure (CI) protection and situation awareness are relevant topics in critical system domain. These issues go far beyond the academic world involving very often the national security framework. In this contribution, a review of the most attractive approaches proposed for addressing the situation awareness problems is presented. Most of the proposed approaches are based on multi-sensor data fusion, since the awareness is achieved by building a scenario using data provided by sensors spread into the systems. Humans are supposed to interact with the system, but only a few models are able to include their intervention. The review analysis is performed by considering models, architectures, and techniques adopted in each system and by highlighting their effectiveness and drawbacks. Finally an example in the field of air traffic management is presented. © 2014 Inderscience Enterprises Ltd.