This thesis describes a virtual Supervisory Control and Data Acquisition (SCADA) laboratory. This virtual laboratory was built using virtual devices that simulate industrial processes, emulate control system ladder logic functionality, and utilize control system communication protocols. Human machine interfaces (HMIs) were developed for distribution and testing, and commercially available HMIs were implemented. In addition to virtual devices and HMIs, attacks were implemented against this virtual system. Uses for this laboratory include both SCADA security research and pedagogy. The laboratory serves research purposes, as it utilizes industry standard SCADA communication protocols as well as commercial HMIs, and is capable of interfacing with physical SCADA equipment, and is also capable of producing volumes of industrial control system traffic. It also serves pedagogical purposes as several laboratory exercises were developed in conjunction with the simulators to demonstrate the workings of cyber-physical security in a classroom environment.

Mobile device security is becoming increasingly important as the number of devices that are used continues to grow and has surpassed one billion active devices globally. In this thesis, we will investigate the security of Android ad supported apps, security vulnerabilities that have been identified in the way those ads are delivered to the device and improvements that can be made to protect the privacy of the end user. To do this, we will discuss the Android architecture and the ecosystems of apps and ads on those devices. To better understand the threats to mobile devices, a threat analysis will be conducted, investigating the different attack vectors that devices are susceptible to. This will also include a survey of existing work that has been conducted within the realm of Android security and web based exploits. The specific attacks that are detailed in this research are addJavascriptInterface attacks against a WebView used to display an ad and information leakage from the ad URL request. These attack vectors are discussed in detail with applicability and feasibility studies conducted. The results of these attacks will be analyzed with a discussion of the methodology used to obtain them. In order to combat such attacks, there will also be discussion of potential solutions to mitigate the threats of attack from a variety of angles, to include steps that users can take to protect themselves as well as changes that should be made to the Android operating system itself. / Master of Science

Disruptive technologies developed in the digital age expose individuals, businesses, and government entities to potential cyber security vulnerabilities. Through the conceptual framework of general systems theory, this multiple case study was used to explore the strategies among owners of 4 retail small- and medium-size enterprises (SMEs) in Melbourne, Florida, who successfully protected their businesses against cyber attacks. The data were collected from a review of archival company documents and semistructured interviews. Yin's 5-phased cycles for analyzing case studies provided the guidelines for the data analysis process. Three themes emerged from thematic analysis across the data sets: cyber security strategy, reliance on third-party vendors for infrastructure services, and cyber security awareness. The study findings indicated that the SME owners' successful cyber security strategies might serve as a foundational guide for others to assess and mitigate cyber threat vulnerabilities. The implications for positive social change include the potential to empower other SME owners, new entrepreneurs, and academic institutions with successful cyber security strategies and resources to affect changes within the community. SME owners who survive cyber attacks may spur economic growth by employing local residents, thus stimulating the socioeconomic lifecycle. Moreover, implementation of these successful strategies may catalyze consumer confidence, resulting in greater economic prosperity.

Modern cyber attacks have evolved considerably. The skill level required to conduct a cyber attack is low. Computing power is cheap, targets are diverse and plentiful. Point-and-click crimeware kits are widely circulated in the underground economy, while source code for sophisticated malware such as Stuxnet is available for all to download and repurpose. Despite decades of research into defensive techniques, such as firewalls, intrusion detection systems, anti-virus, code auditing, etc, the quantity of successful cyber attacks continues to increase, as does the number of vulnerabilities identified. Measures to identify perpetrators, known as attribution, have existed for as long as there have been cyber attacks. The most actively researched technical attribution techniques involve the marking and logging of network packets. These techniques are performed by network devices along the packet journey, which most often requires modification of existing router hardware and/or software, or the inclusion of additional devices. These modifications require wide-scale infrastructure changes that are not only complex and costly, but invoke legal, ethical and governance issues. The usefulness of these techniques is also often questioned, as attack actors use multiple stepping stones, often innocent systems that have been compromised, to mask the true source. As such, this thesis identifies that no publicly known previous work has been deployed on a wide-scale basis in the Internet infrastructure. This research investigates the use of an often overlooked tool for attribution: cyber de- ception. The main contribution of this work is a significant advancement in the field of deception and honeypots as technical attribution techniques. Specifically, the design and implementation of two novel honeypot approaches; i) Deception Inside Credential Engine (DICE), that uses policy and honeytokens to identify adversaries returning from different origins and ii) Adaptive Honeynet Framework (AHFW), an introspection and adaptive honeynet framework that uses actor-dependent triggers to modify the honeynet envi- ronment, to engage the adversary, increasing the quantity and diversity of interactions. The two approaches are based on a systematic review of the technical attribution litera- ture that was used to derive a set of requirements for honeypots as technical attribution techniques. Both approaches lead the way for further research in this field.

State estimation plays an essential role in the monitoring and control of power transmission systems. In modern, highly inter-connected power systems the state estimation should be performed in a distributed fashion and requires information exchange between the control centers of directly connected systems. Motivated by recent reportson trojans targeting industrial control systems, in this paper we investigate how a single compromised control center can affect the outcome of distributed state estimation. We describe five attack strategies, and evaluate their impact on the IEEE 118 benchmark power system. We show that that even if the state estimation converges despite the attack, the estimate can have up to 30% of error, and bad data detection cannot locate theattack. We also show that if powerful enough, the attack can impede the convergence of the state estimation, and thus it can blind the system operators. Our results show that it is important to provide confidentiality for the measurement data in order to prevent the most powerful attacks. Finally, we discuss a possible way to detect and to mitigate these attacks. / <p>QC 20130522</p>

Criminals and other threat actors are adapting to the growing reliance individuals, organisations, and nations have upon technology and the internet and have augmented their capabilities to be oriented in that direction for malevolent purposes. Cyberspace has become an extremely large vulnerability for countries because it facilitates any person with access to a computer or other technology along with malicious intent, to cause harm. The increased risk people and organisations now face in cyberspace is not isolated to just them. Nations now are also at an increased risk because of the evolving ubiquity of cyberspace and technology. States are at risk of cyber threats because of vulnerabilities in individual citizens and organisations. Nations have now become intended targets by a larger spectrum of threat actors. This research examines how the United Kingdom has developed their specific national cyber security strategy to improve national resilience to threats, and how well the UK government adapts to an ever- changing threat landscape. The UK is still deficient in the appropriate and thorough execution of their proposed strategies and strategic policies to attain national resilience and security. There have been strides to achieve that goal, but the national strategy continues to fail to...

The new 5G technology, next generation of telecommunication and mobile network, is all around the world in course of inspection and inquiry for its astonishing novelty, from new services to functions and scalability. However, every technology brings alongside new possibilities and new threats scenarios, especially in this case where the impact on the present network is promised to be massive, with brand new features allowed by 5G, like Internet of Things, widespread virtualization and huge leap forward in rapidity and capability of the mobile transmission. An increase in the network surface, considered as more connections, more devices connected and more traffic load of data, will expand also the possible entry point and fault exploitable by a malevolent actor, raising common concern about the technology. The deployment of such a technology on European soil, especially in some states of the Union, caused uproar and critics primarily in the security field. Following a global trend, but also leading a best practice approach, the EU developed a series of mechanisms and agencies that are challenged to oversees the gradual shift from old 4G LTE to 5G. In this paper a Critical Information Infrastructure Protection (CIIP) framework is used to analyse the criticalities of the new technology. Definition of...

Mobile device security presents a unique challenge in the realm of cyber security, one which is difficult to assess and ultimately defend. Mobile devices, like other computing devices, should possess a secure environment by which a mobile user may operate safely and securely. However, insecure coding when developing applications, incomplete assessment tools to determine platform/application security, and security shortcomings in the Android platform and mobile communications standards result in an insecure environment. This thesis presents an analysis of aspects of a Mobile Station to identify components that contribute to the attack surface. An investigation is conducted to highlight vulnerabilities at the Application, Communications, and Resource Layers. The thesis also identifies current efforts to assess and identify mobile vulnerabilities and weaknesses in application and system settings. Finally, an automated vulnerability assessment solution is developed and introduced in this thesis that can aid in combating potential threats to mobile security.

No description available.

A smart grid is different from a traditional power system in that it allows incorporation of intelligent features and functions, e.g., meter reading, adaptive demand response, integration of distributed energy sources, substation automation, etc. All these intelligent features and functions are achieved by choosing appropriate communication technologies and network structures for the smart grid appropriately. The objective of this dissertation is to develop an AHP (analytic hierarchy process) - based strategy for demand curtailment allocation that is subject to communications and cyber security limitations. Specifically, it: (1) proposes an electrical demand curtailment allocation strategy to keep the balance between supply and demand in case of the sudden supply shortage; (2) simulates the operation of the proposed demand curtailment allocation strategy considering the impact from communication network limitations and simultaneous operations of multiple smart grid applications sharing the same communication network; and (3) analyzes the performance of the proposed demand curtailment allocation strategy when selected cyber security technologies are implemented. These are explained in more details below. An AHP-based approach to electrical demand curtailment allocation management is proposed, which determines load reduction amounts at various segments of the network to maintain the balance between generation and demand. Appropriate communication technologies and the network topology are used to implement these load reduction amounts down to the end-user. In this proposed strategy, demand curtailment allocation is quantified taking into account the demand response potential and the load curtailment priority of each distribution substation. The proposed strategy helps allocate demand curtailment (MW) among distribution substations or feeders in an electric utility service area based on requirements of the central load dispatch center. To determine how rapidly the proposed demand curtailment strategy can be implemented, the capability of the communication network supporting the demand curtailment implementation needs to be evaluated. To evaluate the capability of different communication technologies, selected communication technologies are compared in terms of their latency, throughput, reliability, power consumption and implementation costs. Since a number of smart grid applications share the same communication network, the performance of this communication network is also evaluated considering simultaneous operation of popular smart grid applications. Lastly, limitations of using several cyber security technologies based on different encryption methods - 3EDS (Triple Data Encryption Standard), AES (Advanced Encryption Standard), Blowfish, etc. - in deploying the proposed demand curtailment allocation strategy are analyzed. / Ph. D.