An implementation of log visualization system combined SCADA Honeypot
Recently, the leading trend and the biggest issue in global security is cyber terror. In case of Korea, on December 2014, a nuclear power plants' network was hacked into and its blueprint and manual was leaked. The case was a big threat not only to national security but also to the finance of Korea Hydro Nuclear Power Co. LTD. However, despite this situation, there is not enough information about or detailed explanation on cyber terror. Identifying the cyber terrorists who commit a cyber terror is the best way to defend against the attack. So far, we thought that we successfully defended an attack by blocking the cyber terrorist's IP in the network firewall. However, when a certain attack fails, the cyber terrorist usually tries to find another way to attack. Especially, in case of cyber terror, a cyber terrorist uses very technical ways to attack and hack into computer network exploiting the fact that human beings can easily make mistakes. To increase the security, we do a profiling on cyber terrorist's attack techniques beforehand and set up concrete measures to deal with the attacks. This paper proposes a measure to implement a system to profile cyber terrorists, attack techniques on SCADA system, and discuss the practicality of such system by reviewing the result from actual implementation. Keywords APT; Cyber Terror; APT; SCADA Security; SCADA Honeypot; SIEM