This paper examines the possibilities of performing tests with the aim to ensure that devices in a SCADA network can be deemed secure before deployment. SCADA systems are found in most industries and have recently seen an increased use in building automation, most importantly the healthcare sector, which means that a successful attack toward such a system could endanger lives of patients and healthcare professionals.The method of testing was created to examine whether devices conflicted with the security flaws identified by OWASP IoT Top 10 list, meaning that OWASP IoT Top 10 was the foundation for the methodology used in this paper.Results of the tests show that the devices used in testing are not in conflict with the OWASP IoT Top 10 list when using the default settings. However, some settings that can be enabled on the devices would constitute a security risk if enabled.

In the past, industrial control systems (ICS) and supervisory control and data acquisition (SCADA) systems were planned to run as isolated networks, and not interconnect with other networks e.g., the internet or other parts of a corporate’s network. Because of the isolation, no cybersecurity mechanism was required. In the modern society, ICS/SCADA systems has evolved to communicate over public IP networks and has been incorporated in a company’s intranet or directly to the internet. This integration opens up for threats that were not envisioned at the time when the system was created. When ICS/SCADA systems get exposed to the internet, there is a risk that vulnerabilities in the systems get exploited by a malicious force. This can lead to data loss, destruction of data and devices, damage to infrastructure, financial losses for the company, and even loss of human life could occur. To mitigate and prevent attacks it is crucial to understand the attacks and the behaviour of the attacker. One way to achieve this is setting up a system that mimics the real system. This fake system is separated from the production network and closely monitored. The data collected can be analysed and used to gain knowledge about the attacks. This thesis will present a possible way to study attacks on an ICS/SCADA system using a honeypot designed for this purpose. To do this, a suitable honeypot had to be found that could collect relevant data regarding what kind of attacks that may be used against an ICS/SCADA system. This was achieved by experimenting with different set ups, and the collected data was analysed. This led to the use of T-pot as the chosen honeypot and the collected data showed that a lot of the traffic were directed towards the ICS/SCADA communication protocols Modbus and s7comm. To secure an ICS/SCADA system, it is important to gain knowledge about attacks and attack vectors. A honeypot can be a useful tool that provide information regarding attacks and attackers and can be a help in setting up a defence-in-depth strategy to improve the security in an ICS/SCADA network.

The wind industry is always seeking ways to better understand the performance of a wind turbine and improve its efficiency. During the operation phase and maintenance, wind turbines go through regular optimization. Due to the regular change in wind speed and direction, wind turbines need to be regulated and positioned accordingly. For a specific wind speed, there are a specific set of pitch angle positions. The study aims to quantify the errors in pitch angle positions and validate how much would the loss be if it deviates from its ideal pitch angle position. In this study, airfoil data from an NREL 5 MW turbine is used. Qblade is used in the simulation for error estimation. The simulation is based on BEM theory. A wind turbine blade is developed based on the given airfoil data. Multi-parameter BEM simulation is conducted for a range of wind speed, pitch angle, and rpm. Later the ideal pitch angle position for each wind speed bin is recorded. During the simulation process, downscaling the 5 MW to a 1.5 MW turbine was executed. Validation of the downscaling method was also executed. It showed good agreement with the obtained SCADA data of a working turbine. Later, pitch angle errors are introduced in the simulation.  The results are presented in two cases. Case 1 showed that at below-rated wind speed, there is a significant loss in power production if the error in pitch angle up to 1 degree.  Case 2 also shows error up to 5 degrees in region 2. This study contributes to a better understanding of the effect of pitch angle errors and their loss of power. This study took into account steady wind condition only and does not include climatic conditions or turbulence. A further study focusing on simulating in a high-fidelity setting, including real-time wind or topography conditions, is recommended to achieve a further understanding of the pitch angle errors in a wind turbine.

Critical infrastructures like oil & gas, power grids, water treatment facilities, domain name system (DNS) etc., are attractive targets for attackers — both due to the potential impact of attacks on such systems, and due to the enormous attack surface exposed by such systems. Unwarranted functionality in the form of accidental bugs or maliciously inserted hidden functionality in any component of a system could potentially be exploited by attackers to launch attacks on the system. As it is far from practical to root out undesired functionality in every component of a complex system, it is essential to develop security measures for protecting CI systems that rely only on the integrity of a small number of carefully constructed components, identified as the trusted computing base (TCB) for the system. The broad aim of this dissertation is to characterize elements of the TCB for critical infrastructure systems, and outline strategies to leverage the TCB to secure CI systems. A unified provider-middleman-consumer (PMC) view of systems was adopted to characterize systems as being constituted by providers of data, untrusted middlemen, and consumers of data. As the goal of proposed approach is to eliminate the need to trust most components of a system to be secured, most components of the system are considered to fall under the category of “untrusted middlemen.” From this perspective, the TCB for the system is a minimal set of trusted functionality required to verify that the tasks performed by the middle-men will not result in violation of the desired assurances. Specific systems that were investigated in this dissertation work to characterize the minimal TCB included the domain name system (DNS), dynamic DNS, and Supervisory Control and Data Acquisition (SCADA) systems that monitor/control various CI systems. For such systems, this dissertation provides a comprehensive functional specification of the TCB, and outlines security protocols that leverage the trust in TCB functionality to realize the desired assurances regarding the system.

No description available.

En la actualidad los sistemas de distribución de agua potable implementados son monitoreados, controlados y supervisados desde un Centro de Control, para lo cual se emplean los sistemas SCADA. El objetivo del presente trabajo es desarrollar la aplicación en el software del sistema SCADA, para el proyecto de distribución de agua potable en la quebrada de Manchay. La distribución de agua se realiza a través de 23 estaciones de bombeo distribuidas a lo largo de todo el pueblo. El sistema de distribución de agua potable en Manchay consiste de 4 partes fundamentales: telecomunicaciones, instrumentación, sistema eléctrico y el sistema de control y automatización, esta última parte se relaciona directamente con el presente trabajo, el cual incluye el desarrollo de la programación para realizar el monitorio, control y supervisión de las estaciones de bombeo. Como parte de la implementación del sistema, se hizo configuración de instrumentos para que puedan transmitir la información a los controladores para tener lecturas del proceso como presión, flujo y nivel. Se procedió con el desarrollo de aplicaciones para los Paneles de Operador o Interfaces Hombre Maquina (HMI) con el propósito de realizar un control y monitoreo local de los equipos instalados en cada estación. Se realizaron pruebas en el Centro de Control para verificar el enlace de las señales de campo, así como pruebas con los equipos en las estaciones de bombeo que realizan el control automático y remoto (comandos desde el Centro de Control) del proceso de distribución de agua.

Este proyecto fue realizado en los Reservorios de regulación horaria de San Diego que se encuentran a 14 Km de la Bocatoma perteneciente a la Central Hidroeléctrica de Cañón del Pato.

El Complejo Hidroeléctrico del Mantaro es la central hidroeléctrica más grande del Perú, cuya labor principal es la generación de energía eléctrica, siendo esta la pionera y en la actualidad la más importante fuente de generación eléctrica de la toda Región Central; debido a ello se requiere mantener constante un cierto volumen de agua para obtener el caudal necesario para la generación de energía eléctrica, de acuerdo a la demanda energética, en todas las épocas del año. Es aquí donde surge la necesidad de contar permanentemente con datos de información climática y a la vez recurrir a potenciales reservorios naturales de agua, los cuales serán utilizados en épocas de sequía o estiaje para mantener un volumen estándar y generar la misma potencia promedio todo el año. Para ello la empresa de Electricidad del Perú ELECTROPERU S.A., propietaria de las centrales hidroeléctricas que conforman el Complejo Hidroeléctrico del Mantaro, actualmente cuenta con estaciones hidrometeorológicas dispersas a lo largo de toda la Cuenca del Mantaro, lagunas reguladas y lagunas por regular en los diferentes departamentos de la sierra central del país. Es por ello que es imprescindible requerir de una Red de Telemetría para el envío automático y en tiempo real de la información climática captada por las estaciones hidrometeorológicas, así mismo para el monitoreo a distancia tanto de las estaciones hidrometeorológicas como de las estaciones de lagunas reguladas, y también para permitir el envío de órdenes a distancia tanto de apertura y cierre de las compuertas de retención de agua, las cuales funcionarán en forma automática. Por lo mencionado anteriormente, el presente trabajo de tesis pretende realizar el diseño de la Red de Telemetría más conveniente y que satisfaga los requerimientos mencionados, tomando en cuenta estaciones existentes y futuros proyectos a nivel de pre-factibilidad y factibilidad para la regulación de un mayor número de lagunas de tal empresa. Para esto se desarrollarán cuatro capítulos: el primero será dedicado al marco teórico y aspectos tecnológicos de la red, el segundo a la determinación de necesidades para el diseño de la Red, en el tercero se desarrollará la ingeniería del proyecto, y finalmente en el cuarto se presentarán las conclusiones y recomendaciones.

En la actualidad, el laboratorio de acuicultura del Instituto del Mar del Perú (IMARPE) cuenta con 5 salas dedicadas a distintos organismos marinos para su investigación. Estos ambientes son: sala de microalgas, sala de alimentos vivos, sala de larvicultura, sala de moluscos y sala de reproductores. En estos espacios, se desarrollan diversos estudios como el comportamiento de los peces, la aceleración en su crecimiento y el mejorar el proceso reproductivo. Además, todos son operados de forma manual por los trabajadores de la institución y muchas veces demandan de equipos portátiles para cumplir su labor. El objetivo de este trabajo es diseñar la automatización del laboratorio mediante un sistema SCADA (Supervisión, Control y Adquisición de Datos) que brinde la opción de controlar y monitorear diversos parámetros remotamente. La temperatura, el flujo de oxigenación, el caudal del agua de mar, radiación UV e iluminación son las medidas más esenciales. Por ello, se emplean PLC’s para las señales de control con sus respectivos módulos de expansión de entradas y salidas, ya sean analógicas, digitales o del tipo relé. Asimismo, se cuentan con sensores, actuadores y transmisores de acuerdo a los requerimientos de cada sala. Al mismo tiempo, se emplean micro-controladores Arduino para un sistema de fotoperiodo, cuyo fin es simular la iluminación que reciben las especies para poder regular sus funciones biológicas. El desarrollo del presente informe está compuesto por 5 capítulos. En primer lugar, se explica la problemática y se plantea una solución a través del uso de un sistema mecatrónico integrado en un SCADA. En el segundo capítulo, se detallan los requerimientos que conllevan a la presentación del concepto de solución. Luego, se especifican los diagramas de funcionamiento, planos P&ID, arquitectura de comunicaciones, diagramas de flujos del control entre SCADA-PLC-Arduino y otros esquemas que ayudan a comprender mejor lo propuesto. En el capítulo cuatro, se brinda la información de los costos de los diversos componentes utilizados dando así el presupuesto total para implementar este proyecto. Finalmen

Legacy cyber-physical systems (CPSs) were designed without considering cybersecurity as a primary design tenet especially when considering their evolving operating environment. There are many examples of legacy systems including automotive control, navigation, transportation, and industrial control systems (ICSs), to name a few. To make matters worse, the cost of designing and deploying defenses in existing legacy infrastructure can be overwhelming as millions or even billions of legacy CPS systems are already in use. This economic angle, prevents the use of defenses that are not backward compatible. Moreover, any protection has to operate efficiently in resource constraint environments that are dynamic nature. Hence, the existing approaches that require ex- pensive additional hardware, propose a new protocol from scratch, or rely on complex numerical operations such as strong cryptographic solutions, are less likely to be deployed in practice. In this dissertation, we explore a variety of lightweight solutions for securing different existing CPSs without requiring any modifications to the original system design at hardware or protocol level. In particular, we use fingerprinting, crowdsourcing and deterministic models as alternative backwards- compatible defenses for securing vehicles, global positioning system (GPS) receivers, and a class of ICSs called supervisory control and data acquisition (SCADA) systems, respectively. We use fingerprinting to address the deficiencies in automobile cyber-security from the angle of controller area network (CAN) security. CAN protocol is the de-facto bus standard commonly used in the automotive industry for connecting electronic control units (ECUs) within a vehicle. The broadcast nature of this protocol, along with the lack of authentication or integrity guarantees, create a foothold for adversaries to perform arbitrary data injection or modification and impersonation attacks on the ECUs. We propose SIMPLE, a single-frame based physical layer identification for intrusion detection and prevention on such networks. Physical layer identification or fingerprinting is a method that takes advantage of the manufacturing inconsistencies in the hardware components that generate the analog signal for the CPS of our interest. It translates the manifestation of these inconsistencies, which appear in the analog signals, into unique features called fingerprints which can be used later on for authentication purposes. Our solution is resilient to ambient temperature, supply voltage value variations, or aging. Next, we use fingerprinting and crowdsourcing at two separate protection approaches leveraging two different perspectives for securing GPS receivers against spoofing attacks. GPS, is the most predominant non-authenticated navigation system. The security issues inherent into civilian GPS are exacerbated by the fact that its design and implementation are public knowledge. To address this problem, first we introduce Spotr, a GPS spoofing detection via device fingerprinting, that is able to determine the authenticity of signals based on their physical-layer similarity to the signals that are known to have originated from GPS satellites. More specifically, we are able to detect spoofing activities and track genuine signals over different times and locations and propagation effects related to environmental conditions. In a different approach at a higher level, we put forth Crowdsourcing GPS, a total solution for GPS spoofing detection, recovery and attacker localization. Crowdsourcing is a method where multiple entities share their observations of the environment and get together as a whole to make a more accurate or reliable decision on the status of the system. Crowdsourcing has the advantage of deployment with the less complexity and distributed cost, however its functionality is dependent on the adoption rate by the users. Here, we have two methods for implementing Crowdsourcing GPS. In the first method, the users in the crowd are aware of their approximate distance from other users using Bluetooth. They cross validate this approximate distance with the GPS-derived distance and in case of any discrepancy they report ongoing spoofing activities. This method is a strong candidate when the users in the crowd have a sparse distribution. It is also very effective when tackling multiple coordinated adversaries. For method II, we exploit the angular dispersion of the users with respect to the direction that the adversarial signal is being transmitted from. As a result, the users that are not facing the attacker will be safe. The reason for this is that human body mostly comprises of water and absorbs the weak adversarial GPS signal. The safe users will help the spoofed users find out that there is an ongoing attack and recover from it. Additionally, the angular information is used for localizing the adversary. This method is slightly more complex, and shows the best performance in dense areas. It is also designed based on the assumption that the spoofing attack is only terrestrial. Finally, we propose a tandem IDS to secure SCADA systems. SCADA systems play a critical role in most safety-critical infrastructures of ICSs. The evolution of communications technology has rendered modern SCADA systems and their connecting actuators and sensors vulnerable to malicious attacks on both physical and application layers. The conventional IDS that are built for securing SCADA systems are focused on a single layer of the system. With the tandem IDS we break this habit and propose a strong multi-layer solution which is able to expose a wide range of attack. To be more specific, the tandem IDS comprises of two parts, a traditional network IDS and a shadow replica. We design the shadow replica as a deterministic IDS. It performs a workflow analysis and makes sure the logical flow of the events in the SCADA controller and its connected devices maintain their expected states. Any deviation would be a malicious activity or a reliability issue. To model the application level events, we leverage finite state machines (FSMs) to compute the anticipated states of all of the devices. This is feasible because in many of the existing ICSs the flow of traffic and the resulting states and actions in the connected devices have a deterministic nature. Consequently, it leads to a reliable and free of uncertainty solution. Aside from detecting traditional network attacks, our approach bypasses the attacker in case it succeeds in taking over the devices and also maintains continuous service if the SCADA controller gets compromised. / Doctor of Philosophy / Our lives are entangled with cyber-physical systems (CPSs) on a daily basis. Examples of these systems are vehicles, navigation systems, transportation systems, industrial control systems, etc. CPSs are mostly legacy systems and were built with a focus on performance, overlooking security. Security was not considered in the design of these old systems and now they are dominantly used in our everyday life. After numerous demonstration of cyber hacks, the necessity of protecting the CPSs from adversarial activities is no longer ambiguous. Many of the advanced cryptographic techniques are far too complex to be implemented in the existing CPSs such as cars, satellites, etc. We attempt to secure such resource constraint systems using simple backward compatible techniques in this dissertation. We design cheap lightweight solutions, with no modifications to the original system. In part of our research, we use fingerprinting as a technique to secure passenger cars from being hacked, and GPS receivers from being spoofed. For a brief description of fingerprinting, we use the example of two identical T-shirts with the same size and design. They will always have subtle differences between them no matter how hard the tailor tried to make them identical. This means that there are no two T-shirts that are exactly identical. This idea, when applied to analog signalling on electric devices, is called fingerprinting. Here, we fingerprint the mini computers inside a car, which enables us to identify these computers and prevent hacking. We also use the signal levels to design fingerprints for GPS signals. We use the fingerprints to distinguish counterfeit GPS signals from the ones that have originated from genuine satellites. This summarizes two major contributions in the dissertation. Our earlier contribution to GPS security was effective, but it was heavily dependent on the underlying hardware, requiring extensive training for each radio receiver that it was protecting. To remove this dependence of training for the specific underlying hardware, we design and implement the next framework using defenses that require application-layer access. Thus, we proposed two methods that leverage crowdsourcing approaches to defend against GPS spoofing attacks and, at the same time, improve the accuracy of localization for commodity mobile devices. Crowdsourcing is a method were several devices agree to share their information with each other. In this work, GPS users share their location and direction information, and in case of any discrepancy they figure that they are under attack and cooperate to recover from it. Last, we shift the gear to the industrial control systems (ICSs) and propose a novel IDS to protect them against various cyber attacks. Unlike the conventional IDSs that are focused on one of the layers of the system, our IDS comprises of two main components. A conventional component that exposes traditional attacks and a second component called a shadow replica. The replica mimics the behavior of the system and compares it with that of the actual system in a real-time manner. In case of any deviation between the two, it detects attacks that target the logical flow of the events in the system. Note that such attacks are more sophisticated and difficult to detect because they do not leave any obvious footprints behind. Upon detection of attacks on the original controller, our replica takes over the responsibilities of the original ICS controller and provides service continuity.