Cyber-Physical Systems Security—A Survey <s> B. Cyber Vulnerabilities 1) ICS Vulnerabilities: a) ICS V1, communication vulnerabilities in cybercomponents: <s> The TCP/IP protocol suite, which is very widely used today, was developed under the sponsorship of the Department of Defense. Despite that, there are a number of serious security flaws inherent in the protocols, regardless of the correctness of any implementations. We describe a variety of attacks based on these flaws, including sequence number spoofing, routing attacks, source address spoofing, and authentication attacks. We also present defenses against these attacks, and conclude with a discussion of broad-spectrum defenses such as encryption. <s> BIB001 </s> Cyber-Physical Systems Security—A Survey <s> B. Cyber Vulnerabilities 1) ICS Vulnerabilities: a) ICS V1, communication vulnerabilities in cybercomponents: <s> Several papers have published very specific threats to wireless networks; specifically in the area of attacks against the IEEE 802.11 Wired Equivalency Protocol (WEP). Other papers have addressed wireless attacks based on the attack models used in wired networks. However, the different characteristics of wireless networks require looking at the threat differently. We present a wireless threat taxonomy that we used to build the security architecture for the wireless network at West Point. <s> BIB002 </s> Cyber-Physical Systems Security—A Survey <s> B. Cyber Vulnerabilities 1) ICS Vulnerabilities: a) ICS V1, communication vulnerabilities in cybercomponents: <s> As being an in-house technology, the development of EGAT-SCADA was firstly focused on what it can do. It is developed for supervising the operation on electric power transmission system through out the country of Thailand. It will be installed on five regional control centers, several dozens of group control centers, and more than two hundred substations. Moreover, an implementation on a hydro control center is in a plan. Since the first phase of development was completed, the security issue has become a major concern before the implementation. General procedures on IT security are essentially enforced. Special issues on SCADA security such as address resolution protocol (ARP) spoofing and SQL attacking were studied. Several tests were conducted. Currently, SCADA security is continuing studied for protecting EGAT-SCADA from unauthorized access and abuse. This paper will describe in detail the security concern of EGAT-SCADA <s> BIB003 </s> Cyber-Physical Systems Security—A Survey <s> B. Cyber Vulnerabilities 1) ICS Vulnerabilities: a) ICS V1, communication vulnerabilities in cybercomponents: <s> Abstract Modern critical infrastructures are continually exposed to new threats due to the vulnerabilities and architectural weaknesses introduced by the extensive use of information and communications technologies (ICT). Of particular significance are the vulnerabilities in the communication protocols used in supervisory control and data acquisition (SCADA) systems that are commonly employed to control industrial processes. This paper presents the results of our research on the impact of traditional ICT malware on SCADA systems. In addition, it discusses the potential damaging effects of computer malware created for SCADA systems. <s> BIB004 </s> Cyber-Physical Systems Security—A Survey <s> B. Cyber Vulnerabilities 1) ICS Vulnerabilities: a) ICS V1, communication vulnerabilities in cybercomponents: <s> In recent years we have witnessed the emergence and establishment of research in sensor network security. The majority of the literature has focused on discovering numerous vulnerabilities and attacks against sensor networks, along with suggestions for corresponding countermeasures. However, there has been little guidance for understanding the holistic nature of sensor network security for practical deployments. In this paper, we discuss these concerns and propose a taxonomy composed of the security properties of the sensor network, the threat model, and the security design space. In particular, we try to understand the application-layer goals of a sensor network, and provide a guide to research challenges that need to be addressed in order to prioritize our defenses against threats to application-layer goals. <s> BIB005 </s> Cyber-Physical Systems Security—A Survey <s> B. Cyber Vulnerabilities 1) ICS Vulnerabilities: a) ICS V1, communication vulnerabilities in cybercomponents: <s> Critical infrastructure can be vulnerable to cyber attacks through 802.11 wireless networks. Because wireless intruders are within short range of the targeted network, they can be directly observed by security forces cued to their presence. WildCAT is a prototype system that extends the reach of a physical security force into the cyber realm to detect and respond to wireless threats and vulnerabilities. Its design uses physical security vehicles as the platform for collecting wireless network activity that is then sent via a cellular network to an analysis center. At the analysis center, cyber security specialists detect suspicious activity and cue the physical security force to its location. WildCAT will be tested in comparison to traditional approaches to wardriving, as well as a supplement to wireless intrusion detection systems. <s> BIB006 </s> Cyber-Physical Systems Security—A Survey <s> B. Cyber Vulnerabilities 1) ICS Vulnerabilities: a) ICS V1, communication vulnerabilities in cybercomponents: <s> Supervisory Control and Data Acquisition(SCADA) systems are deeply ingrained in the fabric of critical infrastructure sectors. These computerized real-time process control systems, over geographically dispersed continuous distribution operations, are increasingly subject to serious damage and disruption by cyber means due to their standardization and connectivity to other networks. However, SCADA systems generally have little protection from the escalating cyber threats. In order to understand the potential danger and to protect SCADA systems, in this paper, we highlight their difference from standard IT systems and present a set of security property goals. Furthermore, we focus on systematically identifying and classifying likely cyber attacks including cyber-induced cyber-physical attack son SCADA systems. Determined by the impact on control performance of SCADA systems, the attack categorization criteria highlights commonalities and important features of such attacks that define unique challenges posed to securing SCADA systems versus traditional Information Technology(IT) systems. <s> BIB007 </s> Cyber-Physical Systems Security—A Survey <s> B. Cyber Vulnerabilities 1) ICS Vulnerabilities: a) ICS V1, communication vulnerabilities in cybercomponents: <s> Supervisory Control and Data Acquisition (SCADA) systems are deployed worldwide in many critical infrastructures ranging from power generation, over public transport to industrial manufacturing systems. Whilst contemporary research has identified the need for protecting SCADA systems, these information are disparate and do not provide a coherent view of the threats and the risks resulting from the tendency to integrate these once isolated systems into corporate networks that are prone to cyber attacks. This paper surveys ongoing research and provides a coherent overview of the threats, risks and mitigation strategies in the area of SCADA security. <s> BIB008 </s> Cyber-Physical Systems Security—A Survey <s> B. Cyber Vulnerabilities 1) ICS Vulnerabilities: a) ICS V1, communication vulnerabilities in cybercomponents: <s> Critical infrastructures such as the Supervisory Control and Data Acquisition (SCADA) systems have succumbed to the demands of greater connectivity. Although the scheme of connecting these critical equipment and devices to cyberspace has brought us tremendous convenience, it also enabled certain unimaginable risks and vulnerabilities. These risks and vulnerabilities are very critical to our daily existence and are perilous to ignore. This paper presents an overview of wireless security and vulnerabilities of SCADA systems. Also described are proof-of-concept methods of attacking wireless vulnerabilities on SCADA systems. <s> BIB009 </s> Cyber-Physical Systems Security—A Survey <s> B. Cyber Vulnerabilities 1) ICS Vulnerabilities: a) ICS V1, communication vulnerabilities in cybercomponents: <s> The Smart Grid, generally referred to as the next-generation power system, is considered as a revolutionary and evolutionary regime of existing power grids. More importantly, with the integration of advanced computing and communication technologies, the Smart Grid is expected to greatly enhance efficiency and reliability of future power systems with renewable energy resources, as well as distributed intelligence and demand response. Along with the silent features of the Smart Grid, cyber security emerges to be a critical issue because millions of electronic devices are inter-connected via communication networks throughout critical power facilities, which has an immediate impact on reliability of such a widespread infrastructure. In this paper, we present a comprehensive survey of cyber security issues for the Smart Grid. Specifically, we focus on reviewing and discussing security requirements, network vulnerabilities, attack countermeasures, secure communication protocols and architectures in the Smart Grid. We aim to provide a deep understanding of security vulnerabilities and solutions in the Smart Grid and shed light on future research directions for Smart Grid security. <s> BIB010
ICS' reliance on open standards protocols, such as TCP/IP and ICCP, is increasing. This makes ICS applications vulnerable because of using vulnerable protocols. TCP/IP's vulnerabilities have been studied and investigated for many years, but the protocol still has security issues as it was not intended to be secure by design BIB001 ,  . Another protocol is remote procedure call (RPC), which also has a number of security vulnerabilities, one of which contributed to the well-known Stuxnet attack  . In addition, ICCP, which interconnects control centers, lacks basic security measures such as encryption and authentication BIB008 . Wired communications in ICS includes fiber-optic and Ethernet. Ethernet is usually used for local area networks in substations. Because the communication using Ethernet uses the same medium, it is vulnerable to interception and manin-the-middle (MITM) attacks  . For example, an inside attacker could exploit the privilege of accessing the local network and impersonate legitimate components. It is also possible to inject false data or disclose classified information BIB003 , BIB010 . Short-range wireless communications are usually performed within the ICS plant assuming an adversary is not able to get close enough to capture wireless traffic. However, the traffic is still vulnerable to be captured, analyzed or manipulated by malicious insiders or even a capable-enough outsider BIB006 . In addition, when employees connect their own, probably unsafe, devices to the ICS wireless network, they expose the network to potential threats, so that an attacker could use the employees' personal computers as an attack vector BIB009 . Long-range wireless communications such as cellular, microwave, and satellite are also used in ICS. In the literature, long-range wireless communication vulnerabilities have not been studied in the context of ICS. In conclusion, wireless networks are more vulnerable to cyber attacks, including passive and active eavesdropping, replay attack, unauthorized access, and others discussed thoroughly in the literature as in  and BIB002 . b) ICS V2, software vulnerabilities: A popular Webrelated vulnerability is SQL injection, where attackers can access databases' records without authorization BIB003 , BIB007 . Databases that are connected directly or indirectly to ICS servers contain important data such as historical data and users' information. Furthermore, emails can also contribute to malware spreading to the network. In BIB004 , several emailbased attacks are shown by experimentation. In addition, gathering security credentials for ICS-connected computers is a very enticing goal for attackers interested in gaining access to a secured network. As a result, the network and the ICS as a whole could be at risk. Finally, vulnerabilities in Internetexposed devices that are connected to the local network, such as servers in the control center, employees' portable devices like laptops, and smartphones might be exploited to perform malicious activities that affect the desired operations of the control devices BIB005 .