A review of security assessment methodologies in industrial control systems

2019 ◽  
Vol 27 (1) ◽  
pp. 47-61 ◽  
Author(s):  
Qais Saif Qassim ◽  
Norziana Jamil ◽  
Maslina Daud ◽  
Ahmed Patel ◽  
Norhamadi Ja’affar
Keyword(s):  
Control Systems ◽  
Cyber Security ◽  
Electrical Power ◽  
Assessment Method ◽  
Cyber Attacks ◽  
Security Requirements ◽  
Security Assessment ◽  
Industrial Control ◽  
Industrial Control Systems ◽  
Content Type

Purpose The common implementation practices of modern industrial control systems (ICS) has left a window wide open to various security vulnerabilities. As the cyber-threat landscape continues to evolve, the ICS and their underlying architecture must be protected to withstand cyber-attacks. This study aims to review several ICS security assessment methodologies to identify an appropriate vulnerability assessment method for the ICS systems that examine both critical physical and cyber systems so as to protect the national critical infrastructure. Design/methodology/approach This paper reviews several ICS security assessment methodologies and explores whether the existing methodologies are indeed sufficient to meet the cyber security assessment exercise required to validate the security of electrical power control systems. Findings The study showed that most of the examined methodologies seem to concentrate on vulnerability identification and prioritisation techniques, whilst other security techniques received noticeably less attention. The study also showed that the least attention is devoted to patch management process due to the critical nature of the SCADA system. Additionally, this review portrayed that only two security assessment methodologies exhibited absolute fulfilment of all NERC-CIP security requirements, whilst the others only partially fulfilled the essential requirements. Originality/value This paper presents a review and a comparative analysis of several standard SCADA security assessment methodologies and guidelines published by internationally recognised bodies. In addition, it explores the adequacy of the existing methodologies in meeting cyber security assessment practices required for electrical power networks.

scholarly journals Industrial control systems: The biggest cyber threat

2020 ◽  
Vol 4 (1) ◽  
pp. 044-046
Author(s):  
Beretas Christos P
Keyword(s):  
Control Systems ◽  
Cyber Security ◽  
Security Policy ◽  
Security Requirements ◽  
Security Policies ◽  
Western World ◽  
Control Analysis ◽  
Industrial Control ◽  
Industrial Control Systems ◽  
Cyber Threats

Industrial control systems (ICS) are critical, as in these systems, cyber threats have the potential to affect, disorganize, change their mode of operation, act as an information extraction vehicle, and ultimately turn against itself. Creating risks to the system itself, infrastructure, downtime, leakage of sensitive data, and even loss of human life. Industrial control systems (ICS) are vital to the operation of all the modern automated infrastructure in the western world, such as power plant and power stations. Industrial control systems (ICS) differ from the traditional information systems and infrastructures of organizations and companies, a standard cyber security strategy cannot be implemented but part of it adapting to the real facts and needs of each country, legislation and infrastructure. These systems require continuous operation, reliability and rapid recovery when attacked electronically with automated control, isolation and attack management processes. Incorrect settings and lack of strategic planning can lead to unprotected operation of critical installations, as they do not meet the cyber security requirements. Industrial control systems (ICS) require special protection in their networks, as they should be considered vulnerable in all their areas, they need protection from cyber attacks against ICS, SCADA servers, workstations, PLC automations, etc. Security policies to be implemented should provide protection against cyber threats, and systems recovery without affecting the operation and reliability of operating processes. Security policies such as security assessment, smart reporting, vulnerability and threat simulation, integrity control analysis, apply security policy to shared systems, intrusion detection and prevention, and finally firewall with integrated antivirus and sandbox services should be considered essential entities.

Cyber-Security for ICS/SCADA

2020 ◽  
pp. 613-630
Author(s):  
Barend Pretorius ◽  
Brett van Niekerk
Keyword(s):  
South Africa ◽  
Control System ◽  
Control Systems ◽  
Cyber Security ◽  
Cyber Attacks ◽  
Physical Damage ◽  
Industrial Control ◽  
Industrial Control Systems ◽  
Nation States ◽  
National Infrastructure

Industrial control systems (ICS) or supervisory, control, and data acquisition (SCADA) systems drive many key components of the national infrastructure. It makes these control systems targets for cyber-attacks by terrorists and nation-states who wish to damage their target economically and socially, and cyber-criminals who blackmail the companies operating the infrastructure. Despite the high risk of leaving these systems exposed, providing adequate cyber-security is often challenging. The Stuxnet worm illustrated how vulnerable control systems potentially are when it bypassed a number of security mechanisms to cause physical damage to an Iranian nuclear facility. The article focuses on ICS/SCADA in South Africa discussing the unique challenges and legislation relate to securing control system in the South Africa. A governance and security framework for overcoming these challenges are proposed.

scholarly journals A Review of Cyber Security Assessment (CSA) for Industrial Control Systems (ICS) and Their Impact on The Availability of the ICS Operation

2021 ◽  
Vol 1860 (1) ◽  
pp. 012015
Author(s):  
Nor Afiq Bonandir ◽  
Norziana Jamil ◽  
Md Nabil Ahmad Nawawi ◽  
Razali Jidin ◽  
Mohd Ezanee Rusli ◽  
...  
Keyword(s):  
Control Systems ◽  
Cyber Security ◽  
Security Assessment ◽  
Industrial Control ◽  
Industrial Control Systems

Cyber-Security for ICS/SCADA

2016 ◽  
Vol 6 (3) ◽  
pp. 1-16 ◽  
Author(s):  
Barend Pretorius ◽  
Brett van Niekerk
Keyword(s):  
South Africa ◽  
Control Systems ◽  
Cyber Security ◽  
Cyber Attacks ◽  
Security Framework ◽  
Physical Damage ◽  
Industrial Control ◽  
Industrial Control Systems ◽  
Nation States ◽  
National Infrastructure

Industrial control systems (ICS) or supervisory, control, and data acquisition (SCADA) systems drive many key components of the national infrastructure. It makes these control systems targets for cyber-attacks by terrorists and nation-states who wish to damage their target economically and socially, and cyber-criminals who blackmail the companies operating the infrastructure. Despite the high risk of leaving these systems exposed, providing adequate cyber-security is often challenging. The Stuxnet worm illustrated how vulnerable control systems potentially are when it bypassed a number of security mechanisms to cause physical damage to an Iranian nuclear facility. The article focuses on ICS/SCADA in South Africa discussing the unique challenges and legislation relate to securing control system in the South Africa. A governance and security framework for overcoming these challenges are proposed.

scholarly journals powerLang: a probabilistic attack simulation language for the power domain

2020 ◽  
Vol 3 (1) ◽  
Author(s):  
Simon Hacks ◽  
Sotirios Katsikeas ◽  
Engla Ling ◽  
Robert Lagerström ◽  
Mathias Ekstedt
Keyword(s):  
Cyber Security ◽  
Cyber Attacks ◽  
Security Assessment ◽  
Cyber Attack ◽  
Industrial Control ◽  
Attack Graphs ◽  
Industrial Control Systems ◽  
Domain Specific ◽  
Simulation Language ◽  
Power Domain

AbstractCyber-attacks these threats, the cyber security assessment of IT and OT infrastructures can foster a higher degree of safety and resilience against cyber-attacks. Therefore, the use of attack simulations based on system architecture models is proposed. To reduce the effort of creating new attack graphs for each system under assessment, domain-specific languages (DSLs) can be employed. DSLs codify the common attack logics of the considered domain.Previously, MAL (the Meta Attack Language) was proposed, which serves as a framework to develop DSLs and generate attack graphs for modeled infrastructures. In this article, powerLang as a MAL-based DSL for modeling IT and OT infrastructures in the power domain is proposed. Further, it allows analyzing weaknesses related to known attacks. To comprise powerLang, two existing MAL-based DSL are combined with a new language focusing on industrial control systems (ICS). Finally, this first version of the language was validated against a known cyber-attack.

scholarly journals Cyber Safety System by Implementing Integration of Expert Learning and Data Mining Concepts

2019 ◽  
Vol 8 (12S) ◽  
pp. 155-158
Keyword(s):  
Control Systems ◽  
Cyber Security ◽  
Detection System ◽  
Cyber Attacks ◽  
Industrial Control ◽  
Industrial Control Systems ◽  
Essential Information ◽  
Continuous Growth ◽  
Cyber Safety ◽  
The Cost

the continuous growth in the rate of cyber-attacks in recent years uplifts the worry for the cyber security of industrial control systems. The current efforts of the cyber security system are depended on firewalls, data diodes and other basic methods for prevention of infringement. A cyber threat, intrusion or infringement detection system detects malicious or noxious activities by scanning a system and investigate digitally by employing “machine learning” and “data digging” techniques for handling dynamic and complex functioning of malicious assaults in computer systems and extracting essential information from an input data. In this research paper, the techniques we have used to complete this research may bring advancement in recognition rates, decrease the fault rate which also led to a decrease in the cost factor..

scholarly journals Industrial Control Systems (ICS): Cyber-attacks & Security Optimization

2020 ◽  
Vol 12 (5) ◽  
pp. 31-41
Author(s):  
Erhovwosere Donald Emake ◽  
Ibrahim Adepoju Adeyanju ◽  
Godwin Obruozie Uzedhe
Keyword(s):  
Control Systems ◽  
Cyber Security ◽  
Communication Systems ◽  
Research Area ◽  
Cyber Attacks ◽  
Security Threats ◽  
Industrial Control ◽  
Systems Architecture ◽  
Industrial Control Systems ◽  
Security Technologies

Cyber-security of digital industrial control system in reality is complex and challenging research area, due to various interconnections of electro-mechanical related components driving national critical infrastructures. These networked system components performs monitoring and controlling tasks in several industries and organization through the access of Internet connectivity across the world. More recently, there are myriad of security threats and attacks by malicious elements on ICS which now presents a priority to organizations and researchers for optimal security solutions. Development of the Internet and communication systems has also exacerbated such security concerns. Activities of cyber-attacks malicious elements on ICS may result in serious disaster in industrial environments, human casualties and loss. This paper critically looks at the SCADA/industrial control systems, architecture, cyber-attacks. Other aspect of the paper examines current ICS security technologies including a computational secured algorithm for PLC

Sign in / Sign up

Export Citation Format

Share Document