Industrial Control Systems (ICSs) play a critical role in various industries, automating processes and efficiency optimization. However, these systems have security vulnerabilities that make them prone to cyber attacks, so it is crucial to have strong access control mechanisms in place. This master thesis focuses on the investigation, development, and evaluation of workflow-driven dynamic authorization for modular automation systems. The authorization enables specifying of policies that can adapt in real-time to the dynamic security environment of ICSs. Furthermore, the thesisexplores the efficiency of authorization in terms of execution time, memory consumption, andtoken size through experimental evaluation. The experimental evaluation compares three variationsof token population: a baseline approach that directly encodes accesscontrol list permissions into the token, and two token population algorithms that aim to reduce thetoken size by replacing permissions with overlapping roles. The results show that the baseline approach achieves the shortest execution time and lowest memory consumption, but leads to increased token sizes. On the other hand, the token population algorithms reduce the token size at the costof increased execution time and memory consumption. The choice between these approaches wouldinvolve trade-offs and would depend on the specific requirements of the ICSs environment. / InSecTT

Critical Infrastructures (CIs) such as water treatment plants, power grids and telecommunication networks are critical to the daily activities and well-being of our society. Disruption of such CIs would have catastrophic consequences for public safety and the national economy. Hence, these infrastructures have become major targets in the upsurge of cyberattacks. Defending against such attacks often depends on an arsenal of cyber-defence tools, including Machine Learning (ML)-based Anomaly Detection Systems (ADSs). These detection systems use ML models to learn the profile of the normal behaviour of a CI and classify deviations that go well beyond the normality profile as anomalies. However, ML methods are vulnerable to both adversarial and non-adversarial input perturbations. Adversarial perturbations are imperceptible noises added to the input data by an attacker to evade the classification mechanism. Non-adversarial perturbations can be a normal behaviour evolution as a result of changes in usage patterns or other characteristics and noisy data from normally degrading devices, generating a high rate of false positives. We first study the problem of ML-based ADSs being vulnerable to non-adversarial perturbations, which causes a high rate of false alarms. To address this problem, we propose an ADS called DAICS, based on a wide and deep learning model that is both adaptive to evolving normality and robust to noisy data normally emerging from the system. DAICS adapts the pre-trained model to new normality with a small number of data samples and a few gradient updates based on feedback from the operator on false alarms. The DAICS was evaluated on two datasets collected from real-world Industrial Control System (ICS) testbeds. The results show that the adaptation process is fast and that DAICS has an improved robustness compared to state-of-the-art approaches. We further investigated the problem of false-positive alarms in the ADSs. To address this problem, an extension of DAICS, called the SiFA framework, is proposed. The SiFA collects a buffer of historical false alarms and suppresses every new alarm that is similar to these false alarms. The proposed framework is evaluated using a dataset collected from a real-world ICS testbed. The evaluation results show that the SiFA can decrease the false alarm rate of DAICS by more than 80%. We also investigate the problem of ML-based network ADSs that are vulnerable to adversarial perturbations. In the case of network ADSs, attackers may use their knowledge of anomaly detection logic to generate malicious traffic that remains undetected. One way to solve this issue is to adopt adversarial training in which the training set is augmented with adversarially perturbed samples. This thesis presents an adversarial training approach called GADoT that leverages a Generative Adversarial Network (GAN) to generate adversarial samples for training. GADoT is validated in the scenario of an ADS detecting Distributed Denial of Service (DDoS) attacks, which have been witnessing an increase in volume and complexity. For a practical evaluation, the DDoS network traffic was perturbed to generate two datasets while fully preserving the semantics of the attack. The results show that adversaries can exploit their domain expertise to craft adversarial attacks without requiring knowledge of the underlying detection model. We then demonstrate that adversarial training using GADoT renders ML models more robust to adversarial perturbations. However, the evaluation of adversarial robustness is often susceptible to errors, leading to robustness overestimation. We investigate the problem of robustness overestimation in network ADSs and propose an adversarial attack called UPAS to evaluate the robustness of such ADSs. The UPAS attack perturbs the inter-arrival time between packets by injecting a random time delay before packets from the attacker. The attack is validated by perturbing malicious network traffic in a multi-attack dataset and used to evaluate the robustness of two robust ADSs, which are based on a denoising autoencoder and an adversarially trained ML model. The results demonstrate that the robustness of both ADSs is overestimated and that a standardised evaluation of robustness is needed.

Risk assessment is a critical aspect of all businesses, and leaders are tasked with limiting risk to the lowest reasonable level within their systems. Industrial Control Systems (ICS) operate in a different cybersecurity risk environment than business systems due to the possibility of second and third-order effects when an attack occurs. We present a process for predicting when an adversary gains the ability to attack an industrial control system. We assist leaders in understanding how attackers are targeting ICS by providing visualizations and percentages that can be applied to updating infrastructure or shifting personnel responsibilities to counter the threat. This new process seeks to integrate defenders and threat intelligence providers, allowing defenders to proactively defend their networks prior to devastating attacks. We apply the process by observing it under randomness with constraints and through a case study of the 2015 attack on the Ukrainian power grid. We find that this process answers the question of what an attacker can do, provides the ability for the defender to possess an updated understanding of the threat’s capability, and can both increase and decrease the probability that an attacker has a capability against a control system. This process will allow leaders to provide strategic vision to the businesses and systems that they manage.

Massenanpassung, kleine Losgrößen, hohe Variabilität der Produkttypen und ein sich während des Lebenszyklus einer industriellen Anlage änderndes Produktportfolio sind aktuelle Trends der Industrie. Durch eine zunehmende Entkopplung der Entwicklung von Software- und Hardwarekomponenten im industriellen Kontext, entstehen immer häufiger Kompatibilitätsprobleme innerhalb von industriellen Steuerungen. In dieser Arbeit wird mittels Literaturrecherche und angewandter Forschung ein Strategiekonzept zur Kompatibilitätsprüfung hergeleitet und diskutiert. Dieses vierphasige Konzept ermittelt Inkompatibilitäten zwischen Software- und Hardwarekomponenten im Umfeld von industriellen Steuerungen und ermöglicht Testingenieuren das frühzeitige Erkennen von Problemen. Durch eine automatische Durchführung der Kompatibilitätsprüfung auf einem externen Industrie PC kann die Kompatibilitätsprüfung sowohl beim Aufspielen neuer Software auf die industrielle Steuerung als auch beim Neustart der Steuerung ablaufen. Somit werden Änderungen an den Komponenten stetig erkannt und Inkompatibilitäten vermieden. Weiterhin kann durch die frühzeitige Erkennung sichergestellt werden, dass eine Anlage dauerhaft lauffähig bleibt. Anhand einer Diskussion werden Mittel festgestellt, um die Robustheit und Anwendbarkeit des vorgestellten Konzeptes zusätzlich zu festigen.:1 Motivation 1 1.1 Aufgabenanalyse 3 1.1.1 Forschungsfragen und Teilaufgaben 3 1.1.2 Aufgabenkomplexe 4 1.1.3 Eingrenzung der Aufgabenstellung 5 1.1.4 Ziel der Arbeit 6 1.1.5 Festsetzung von Formulierungen 6 2 Einführung und Stand der Technik 7 2.1 VIBN von industriellen Anlagen 7 2.1.1 Teststrategien aus der VIBN 9 2.1.1.1 Model-in-the-Loop 9 2.1.1.2 Software-in-the-Loop 9 2.1.1.3 Hardware-in-the-Loop 10 2.1.1.4 Konklusion und Forschungsbestrebungen 11 2.2 CS in industriellen Anlagen 12 2.2.1 Sicherheitsziel 13 2.2.2 Teststrategien aus der CS 13 2.2.2.1 Signaturbasierte Erkennung 14 2.2.2.2 Anomaliebasierte Erkennung 14 2.2.2.3 Konklusion und Forschungsbestrebungen 16 2.3 Interoperabilität als Kompatibilitätsmaß 16 2.4 Testautomatisierung und Test Case Generierung 17 2.5 Allgemeine Softwareteststrategien 17 2.5.1 Modellbasiertes Testen 17 2.5.2 Funktionale Tests 18 2.6 Allgemeine Hardware Teststrategien 19 2.6.1 Modellbasiertes Testen 19 2.6.2 Manuelles Testen 19 2.7 Interoperabilität in industriellen Anlagen 20 2.7.1 Definitionen der Interoperabilität 20 2.7.2 Herausforderungen der Interoperabilität 22 2.7.3 Implementierung von Interoperabilität 22 2.7.3.1 Syntaktische Interoperabilität 23 2.7.3.2 Semantische Interoperabilität 23 2.7.4 Vertikale Integration 24 2.7.5 Horizontale Integration 25 3 Anforderungsanalyse 27 3.1 Adaption von Strategien der VIBN und CS 27 3.2 Anforderungen 28 3.2.1 Anforderungen an die Kompatibilitätsprüfung 28 3.2.2 Anforderungen an die Hardwarekomponenten 29 3.2.3 Anforderungen an die Softwarekomponenten 29 4 Konzept 30 4.1 Komponenten des Teststrategiekonzeptes 30 4.1.1 SPS Selbsttest 32 4.1.2 Export & Import des Soll-Zustandes 32 4.1.3 Ermittlung des Ist-Zustandes 35 4.1.4 Vergleich des Soll- & Ist-Zustandes 35 4.2 Fehlerdetektionstabellen 36 4.3 Reaktionen auf Inkompatibilitäten 38 5 Evaluation 39 5.1 Methodik und Evaluationskriterien 39 5.2 Anwendungsbeispiel 39 5.3 Referenzsystem für Evaluation 41 5.4 Durchführung Evaluation 41 5.5 Erfüllung der Anforderungen an die Kompatibilitätsprüfung 46 6 Diskussion 48 6.1 Beantwortung der Forschungsfragen 48 6.2 Diskussion zur Forschungsmethodik 48 6.3 Bewertung des Konzeptes 49 7 Zusammenfassung und Ausblick 50 7.1 Zusammenfassung 50 7.2 Ausblick und weitere Forschungsarbeit 51 Literaturverzeichnis 52 / Mass customization, small batch sizes, high variability of product types and a changing product portfolio during the life cycle of an industrial plant are current trends in the industry. Due to an increasing decoupling of the development of software and hardware components in an industrial context, compatibility problems within industrial control systems arise more and more frequently. In this thesis, a strategy concept for compatibility testing is derived and discussed by means of literature review and applied research. This 4-phased strategy concept identifies incompatibilities between software and hardware components in the industrial control environment and enables test engineers to detect problems at an early stage. By automating the compatibility test on an external I-PC, the test can be run both when new software is installed on the industrial controller and when the controller is restarted. Thus, changes to the components are constantly detected and incompatibilities are avoided. Furthermore, early incompatibility detection can ensure that a system remains permanently operational. Based on a discussion, additionally strategies are identified to consolidate the robustness and applicability of the presented concept.:1 Motivation 1 1.1 Aufgabenanalyse 3 1.1.1 Forschungsfragen und Teilaufgaben 3 1.1.2 Aufgabenkomplexe 4 1.1.3 Eingrenzung der Aufgabenstellung 5 1.1.4 Ziel der Arbeit 6 1.1.5 Festsetzung von Formulierungen 6 2 Einführung und Stand der Technik 7 2.1 VIBN von industriellen Anlagen 7 2.1.1 Teststrategien aus der VIBN 9 2.1.1.1 Model-in-the-Loop 9 2.1.1.2 Software-in-the-Loop 9 2.1.1.3 Hardware-in-the-Loop 10 2.1.1.4 Konklusion und Forschungsbestrebungen 11 2.2 CS in industriellen Anlagen 12 2.2.1 Sicherheitsziel 13 2.2.2 Teststrategien aus der CS 13 2.2.2.1 Signaturbasierte Erkennung 14 2.2.2.2 Anomaliebasierte Erkennung 14 2.2.2.3 Konklusion und Forschungsbestrebungen 16 2.3 Interoperabilität als Kompatibilitätsmaß 16 2.4 Testautomatisierung und Test Case Generierung 17 2.5 Allgemeine Softwareteststrategien 17 2.5.1 Modellbasiertes Testen 17 2.5.2 Funktionale Tests 18 2.6 Allgemeine Hardware Teststrategien 19 2.6.1 Modellbasiertes Testen 19 2.6.2 Manuelles Testen 19 2.7 Interoperabilität in industriellen Anlagen 20 2.7.1 Definitionen der Interoperabilität 20 2.7.2 Herausforderungen der Interoperabilität 22 2.7.3 Implementierung von Interoperabilität 22 2.7.3.1 Syntaktische Interoperabilität 23 2.7.3.2 Semantische Interoperabilität 23 2.7.4 Vertikale Integration 24 2.7.5 Horizontale Integration 25 3 Anforderungsanalyse 27 3.1 Adaption von Strategien der VIBN und CS 27 3.2 Anforderungen 28 3.2.1 Anforderungen an die Kompatibilitätsprüfung 28 3.2.2 Anforderungen an die Hardwarekomponenten 29 3.2.3 Anforderungen an die Softwarekomponenten 29 4 Konzept 30 4.1 Komponenten des Teststrategiekonzeptes 30 4.1.1 SPS Selbsttest 32 4.1.2 Export & Import des Soll-Zustandes 32 4.1.3 Ermittlung des Ist-Zustandes 35 4.1.4 Vergleich des Soll- & Ist-Zustandes 35 4.2 Fehlerdetektionstabellen 36 4.3 Reaktionen auf Inkompatibilitäten 38 5 Evaluation 39 5.1 Methodik und Evaluationskriterien 39 5.2 Anwendungsbeispiel 39 5.3 Referenzsystem für Evaluation 41 5.4 Durchführung Evaluation 41 5.5 Erfüllung der Anforderungen an die Kompatibilitätsprüfung 46 6 Diskussion 48 6.1 Beantwortung der Forschungsfragen 48 6.2 Diskussion zur Forschungsmethodik 48 6.3 Bewertung des Konzeptes 49 7 Zusammenfassung und Ausblick 50 7.1 Zusammenfassung 50 7.2 Ausblick und weitere Forschungsarbeit 51 Literaturverzeichnis 52

As the rate and severity of malicious software attacks have escalated, industrial control systems (ICSes) have emerged as a particularly vulnerable target. ICSes govern the automation of the physical processes in industries such as power, water, oil and manufacturing. In contrast to the personal computing space, where attackers attempt to capture information or computing resources, the attacks directed at ICSes aim to degrade or destroy the physical processes or plants maintained by the ICS. Exploits with potentially catastrophic results are sold on brokerages to any interested party. Previous efforts in ICS security implicitly and mistakenly trust internal software. This thesis presents an architecture for trust enhancement of critical embedded processes (TECEP). TECEP assumes that all software can be or has already been compromised. Trust is instead placed in hardware that is invisible to any malicious software. Software processes critical for stable operation are duplicated in hardware, along with a supervisory process to monitor the behavior of the plant. Furthermore, a copy of the software and a model of the plant are implemented in hardware in order to estimate the system's future behavior. In the event of an attack, the hardware can successfully identify the plant's abnormal behavior in either the present or the future and supersede the software's directives, allowing the plant to continue functioning correctly. This approach to ICS security can be retrofitted to existing ICSes, has minimal impact on the ICS design process, and modestly increases hardware requirements in a programmable system-on-chip. / Master of Science

Industrial Control Systems (ICSes), networked through conventional IT infrastructures, are vulnerable to attacks originating from network channels. Perimeter security techniques such as access control and firewalls have had limited success in mitigating such attacks due to the frequent updates required by standard computing platforms, third-party hardware and embedded process controllers. The high level of human-machine interaction also aids in circumventing perimeter defenses, making an ICS susceptible to attacks such as reprogramming of embedded controllers. The Stuxnet and Aurora attacks have demonstrated the vulnerabilities of ICS security and proved that these systems can be stealthily compromised. We present several run-time methods for preemptive intrusion detection in industrial control systems to enhance ICS security against reconfiguration and network attacks. A run-time prediction using a linear model of the physical plant and a neural-network based classifier trigger mechanism are proposed for preemptive detection of an attack. A standalone, safety preserving, optimal backup controller is implemented to ensure plant safety in case of an attack. The intrusion detection mechanism and the backup controller are instantiated in configurable hardware, making them invisible to operating software and ensuring their integrity in the presence of malicious software. Hardware implementation of our approach on an inverted pendulum system illustrates the performance of both techniques in the presence of reconfiguration and network attacks. / Master of Science

No description available.

Critical infrastructures are defined as the basic facilities, services and utilities needed to support the functioning of society. For over three-thousand years, civil engineers have built these infrastructures to ensure that needed services and products are available to make mankind more comfortable, secure and productive. Modern infrastructure control systems are vulnerable to disruption from natural disaster, accident, negligent operation and intentional cyber assaults from malicious agents. Many critical processes within our infrastructures are continuous (e.g., electric power, etc.) and cannot be interrupted without consequence to industry and the public. Failure to protect the critical infrastructure from cyber assaults will result in physical, economic and social impacts, extending from the local to the national level. Cyber weapons have shown that harm to infrastructures can occur before system operators have time to determine the source.We present the thesis that infrastructure control systems can employ autonomic computing technology to detect anomalies and mitigate process disruption. Specifically we focus on: 1) autonomic computing algorithms that can be integrated into control systems and networks to detect and respond to anomalies; 2) autonomic technology capable of detecting and blocking infrastructure controller commands, that if executed, would result in process disruption; 3) design and construction of a prototype Autonomic Critical Infrastructure Protection appliance (ACIP) for integration and testing of autonomic algorithms; and 4) the design and construction of a test bed capable of modeling critical infrastructures and related control systems and processes for the purpose of testing and demonstrating new autonomic technologies.We report on the development of a new, multi-dimension ontology that organizes cyber assault methodologies correlated with perpetrator motivation and goals. Using this ontology, we create a theoretical framework to identify the integration points for protective technology within infrastructure control systems. We have created a unique modeling and simulation test bed for critical infrastructure systems and processes, and a prototype autonomic computing appliance. Through this work, we have developed an expanded understanding of autonomic computing theory and its application to controls systems. We also, through experimentation, prove the thesis and establish a roadmap for future research.

Critical Infrastructure Industrial Control Systems are substantially different from their more common and ubiquitous information technology system counterparts. Industrial control systems, such as distributed control systems and supervisory control and data acquisition systems that are used for controlling the power grid, were not originally designed with security in mind. Geographically dispersed distribution, an unfortunate reliance on legacy systems and stringent availability requirements raise significant cybersecurity concerns regarding electric reliability while constricting the feasibility of many security controls. Recent North American Electric Reliability Corporation Critical Infrastructure Protection standards heavily emphasize cybersecurity concerns and specifically require entities to categorize and identify their Bulk Electric System cyber systems; and, have periodic vulnerability assessments performed on those systems. These concerns have produced an increase in the need for more Critical Infrastructure Industrial Control Systems specific cybersecurity research. Industry stakeholders have embraced the development of a large-scale test environment through the Department of Energy’s National Supervisory Control and Data Acquisition Test-bed program; however, few individuals have access to this program. This research developed a physical industrial control system test-bed on a smaller-scale that provided an environment for modeling a simulated critical infrastructure sector performing a set of automated processes for the purpose of exploring solutions and studying concepts related to compromising control systems by way of process-tampering through code exploitation, as well as, the ability to passively and subsequently identify any risks resulting from such an event. Relative to the specific step being performed within a production cycle, at a moment in time when sensory data samples were captured and analyzed, it was possible to determine the probability of a real-time risk to a mock Critical Infrastructure Industrial Control System by comparing the sample values to those derived from a previously established baseline. This research achieved such a goal by implementing a passive, spatial and task-based segregated sensor network, running in parallel to the active control system process for monitoring and detecting risk, and effectively identified a real-time risk probability within a Critical Infrastructure Industrial Control System Test-bed. The practicality of this research ranges from determining on-demand real-time risk probabilities during an automated process, to employing baseline monitoring techniques for discovering systems, or components thereof, exploited along the supply chain.

Today the digital evolution is progressing rapidly. This entails both pros and cons concerning the security of devices. Despite the evolution, security has been left in the dark. This results in threats and vulnerabilities in devices, which could potentially be used by a hacker with the purpose of exploiting information. Security has not been a priority in industrial enterprises, even though industrial devices and other networked devices reside on the same network. The evolution of the infrastructure of the Internet has resulted in an increase of cyberattacks. These attacks used to target random individuals. The attacks of today are more intelligent, and hackers have changed their targets to specific enterprises to further exploit sensitive information, damage devices or for financial benefits. Safety in today’s industrial workplaces, such as firewalls, encryption and intrusion detection systems are not specifically designed to work in this type of environment. This leads to new threats and vulnerabilities which further leads to more exploited vulnerabilities. This formulate the following questions: Which are the most occurring threats and vulnerabilities today? What current methods and tools are suited for controlling security in IIoT-networks and its internal industrial devices? The purpose of this thesis was to examine the most occurring threats and vulnerabilities in IIoT-networks and its internal devices and reason among the methods to evaluate security in industrial enterprises. Lastly, an experiment in a real industrial workplace was conducted to attain a nuanced picture of the implementation of finding threats and vulnerabilities in industrial systems. In summary, there are a lot of different threats and vulnerabilities divided into categories and many tools are available to ensure the vulnerability. To conduct a test to find threats and vulnerabilities in an industrial enterprise, it needs to be ethically correct and the consequences carefully considered. The result of this thesis is a mapping and a demonstration of how threats and vulnerabilities are detected in an industrial workplace.