Cyber-Physical Systems Security—A Survey <s> C. Cyber-Physical Controls 1) ICS Controls: <s> The Analysis Function of the US-CERT Control Systems Security Center (CSSC) at the Idaho National Laboratory (INL) has prepared this report to document cyber security incidents for use by the CSSC. The description and analysis of incidents reported herein support three CSSC tasks: establishing a business case; increasing security awareness and private and corporate participation related to enhanced cyber security of control systems; and providing informational material to support model development and prioritize activities for CSSC. The stated mission of CSSC is to reduce vulnerability of critical infrastructure to cyber attack on control systems. As stated in the Incident Management Tool Requirements (August 2005) ''Vulnerability reduction is promoted by risk analysis that tracks actual risk, emphasizes high risk, determines risk reduction as a function of countermeasures, tracks increase of risk due to external influence, and measures success of the vulnerability reduction program''. Process control and Supervisory Control and Data Acquisition (SCADA) systems, with their reliance on proprietary networks and hardware, have long been considered immune to the network attacks that have wreaked so much havoc on corporate information systems. New research indicates this confidence is misplaced--the move to open standards such as Ethernet, Transmission Control Protocol/Internet Protocol, and Web technologiesmore » is allowing hackers to take advantage of the control industry's unawareness. Much of the available information about cyber incidents represents a characterization as opposed to an analysis of events. The lack of good analyses reflects an overall weakness in reporting requirements as well as the fact that to date there have been very few serious cyber attacks on control systems. Most companies prefer not to share cyber attack incident data because of potential financial repercussions. Uniform reporting requirements will do much to make this information available to Department of Homeland Security (DHS) and others who require it. This report summarizes the rise in frequency of cyber attacks, describes the perpetrators, and identifies the means of attack. This type of analysis, when used in conjunction with vulnerability analyses, can be used to support a proactive approach to prevent cyber attacks. CSSC will use this document to evolve a standardized approach to incident reporting and analysis. This document will be updated as needed to record additional event analyses and insights regarding incident reporting. This report represents 120 cyber security incidents documented in a number of sources, including: the British Columbia Institute of Technology (BCIT) Industrial Security Incident Database, the 2003 CSI/FBI Computer Crime and Security Survey, the KEMA, Inc., Database, Lawrence Livermore National Laboratory, the Energy Incident Database, the INL Cyber Incident Database, and other open-source data. The National Memorial Institute for the Prevention of Terrorism (MIPT) database was also interrogated but, interestingly, failed to yield any cyber attack incidents. The results of this evaluation indicate that historical evidence provides insight into control system related incidents or failures; however, that the limited available information provides little support to future risk estimates. The documented case history shows that activity has increased significantly since 1988. The majority of incidents come from the Internet by way of opportunistic viruses, Trojans, and worms, but a surprisingly large number are directed acts of sabotage. A substantial number of confirmed, unconfirmed, and potential events that directly or potentially impact control systems worldwide are also identified. Twelve selected cyber incidents are presented at the end of this report as examples of the documented case studies (see Appendix B).« less <s> BIB001 </s> Cyber-Physical Systems Security—A Survey <s> C. Cyber-Physical Controls 1) ICS Controls: <s> The interconnectivity of modern and legacy supervisory control and data acquisition (SCADA) systems with corporate networks and the Internet has significantly increased the threats to critical infrastructure assets. Meanwhile, traditional IT security solutions such as firewalls, intrusion detection systems and antivirus software are relatively ineffective against attacks that specifically target vulnerabilities in SCADA protocols. This paper describes a secure version of the Modbus SCADA protocol that incorporates integrity, authentication, non-repudiation and anti-replay mechanisms. Experimental results using a power plant testbed indicate that the augmented protocol provides good security functionality without significant overhead. <s> BIB002 </s> Cyber-Physical Systems Security—A Survey <s> C. Cyber-Physical Controls 1) ICS Controls: <s> Digital control systems are essential to the safe and efficient operation of a variety of industrial processes in sectors such as electric power, oil and gas, water treatment, and manufacturing. Modern control systems are increasingly connected to other control systems as well as to corporate systems. They are also increasingly adopting networking technology and system and application software from conventional enterprise systems. These trends can make control systems vulnerable to cyber attack, which in the case of control systems may impact physical processes causing environmental harm or injury. We present some results of the DATES (Detection and Analysis of Threats to the Energy Sector) project, wherein we adapted and developed several intrusion detection technologies for control systems. The suite of detection technologies was integrated and connected to a commercial security event correlation framework from ArcSight. We demonstrated the efficacy of our detection and correlation solution on two coupled testbed environments. We particularly focused on detection, correlation, and visualization of a network traversal attack, where an attacker penetrates successive network layers to compromise critical assets that directly control the underlying process. Such an attack is of particular concern in the layered architectures typical of control system implementations. <s> BIB003 </s> Cyber-Physical Systems Security—A Survey <s> C. Cyber-Physical Controls 1) ICS Controls: <s> Critical infrastructure can be vulnerable to cyber attacks through 802.11 wireless networks. Because wireless intruders are within short range of the targeted network, they can be directly observed by security forces cued to their presence. WildCAT is a prototype system that extends the reach of a physical security force into the cyber realm to detect and respond to wireless threats and vulnerabilities. Its design uses physical security vehicles as the platform for collecting wireless network activity that is then sent via a cellular network to an analysis center. At the analysis center, cyber security specialists detect suspicious activity and cue the physical security force to its location. WildCAT will be tested in comparison to traditional approaches to wardriving, as well as a supplement to wireless intrusion detection systems. <s> BIB004 </s> Cyber-Physical Systems Security—A Survey <s> C. Cyber-Physical Controls 1) ICS Controls: <s> The development of a trustworthy smart grid requires a deeper understanding of potential impacts resulting from successful cyber attacks. Estimating feasible attack impact requires an evaluation of the grid's dependency on its cyber infrastructure and its ability to tolerate potential failures. A further exploration of the cyber-physical relationships within the smart grid and a specific review of possible attack vectors is necessary to determine the adequacy of cybersecurity efforts. This paper highlights the significance of cyber infrastructure security in conjunction with power application security to prevent, mitigate, and tolerate cyber attacks. A layered approach is introduced to evaluating risk based on the security of both the physical power applications and the supporting cyber infrastructure. A classification is presented to highlight dependencies between the cyber-physical controls required to support the smart grid and the communication and computations that must be protected from cyber attack. The paper then presents current research efforts aimed at enhancing the smart grid's application and infrastructure security. Finally, current challenges are identified to facilitate future research efforts. <s> BIB005 </s> Cyber-Physical Systems Security—A Survey <s> C. Cyber-Physical Controls 1) ICS Controls: <s> It is often appealing to assume that existing solutions can be directly applied to emerging engineering domains. Unfortunately, careful investigation of the unique challenges presented by new domains exposes its idiosyncrasies, thus often requiring new approaches and solutions. In this paper, we argue that the “smart” grid, replacing its incredibly successful and reliable predecessor, poses a series of new security challenges, among others, that require novel approaches to the field of cyber security. We will call this new field cyber-physical security. The tight coupling between information and communication technologies and physical systems introduces new security concerns, requiring a rethinking of the commonly used objectives and methods. Existing security approaches are either inapplicable, not viable, insufficiently scalable, incompatible, or simply inadequate to address the challenges posed by highly complex environments such as the smart grid. A concerted effort by the entire industry, the research community, and the policy makers is required to achieve the vision of a secure smart grid infrastructure. <s> BIB006 </s> Cyber-Physical Systems Security—A Survey <s> C. Cyber-Physical Controls 1) ICS Controls: <s> Increasing awareness of ICS security issues has brought about a growing body of work in this area, including pioneering contributions based on realistic control system logs and network traces. This paper surveys the state of the art in ICS security research, including efforts of industrial researchers, highlighting the most interesting works. Research efforts are grouped into divergent areas, where we add “secure control” as a new category to capture security goals specific to control systems that differ from security goals in traditional IT systems. <s> BIB007 </s> Cyber-Physical Systems Security—A Survey <s> C. Cyber-Physical Controls 1) ICS Controls: <s> Although awareness is constantly rising, that industrial computer networks (in a very broad sense) can be exposed to serious cyber threats, many people still think that the same countermeasures, developed to protect general-purpose computer networks, can be effectively adopted also in those situations where a physical system is managed/controlled through some distributed Information and Communication Technology (ICT) infrastructure. Unfortunately, this is not the case, as several examples of successful attacks carried out in the last decade, and more frequently in the very recent past, have dramatically shown. Experts in this area know very well that often the peculiarities of industrial networks prevent the adoption of classical approaches to their security and, in particular, of those popular solutions that are mainly based on a detect and patch philosophy. This paper is a contribution, from the security point of view, to the assessment of the current situation of a wide class of industrial distributed computing systems. In particular, the analysis presented in this paper takes into account the process of ensuring a satisfactory degree of security for a distributed industrial system, with respect to some key elements such as the system characteristics, the current state of the art of standardization and the adoption of suitable controls (countermeasures) that can help in lowering the security risks below a predefined, acceptable threshold. <s> BIB008 </s> Cyber-Physical Systems Security—A Survey <s> C. Cyber-Physical Controls 1) ICS Controls: <s> In this paper, a behavior-rule based intrusion detection system (BRIDS) is proposed for securing head-ends (HEs), distribution access points/data aggregation points (DAPs) and subscriber energy meters (SEMs) of a modern electrical grid in which continuity of operation is of the utmost importance. The impact of attacker behaviors on the effectiveness of a behavior-rule intrusion detection design is investigated. Using HEs, DAPs and SEMs as examples, it is demonstrated that a behavior-rule based intrusion detection technique can effectively trade false positives for a high detection probability to cope with sophisticated and hidden attackers to support ultra safe and secure applications. It is shown that BRIDS outperforms contemporary anomaly-based IDSs via comparative analysis. <s> BIB009 </s> Cyber-Physical Systems Security—A Survey <s> C. Cyber-Physical Controls 1) ICS Controls: <s> Supervisory control and data acquisition systems are used extensively to control and monitor critical infrastructure including power, gas, oil, and water. To integrate intelligent electronic devices in smart grid infrastructure, the utilities are deploying substation automation systems (SASs) and extensive communication networks, but there is growing concern about SCADA security including substation security. Although there are several solutions utilized to prevent security threats in SCADA networks, existing SCADA networks still have severe shortcomings. In this article, we propose a lightweight and efficient security solution for SASs that provides multilevel multi-factor authentication and attribute-based authorization by deploying public key certificates, and zero-knowledge protocol-based server-aided verification and access control mechanisms using attribute certificates. It can be seen that the proposed approach is efficient and robust. <s> BIB010 </s> Cyber-Physical Systems Security—A Survey <s> C. Cyber-Physical Controls 1) ICS Controls: <s> Supervisory Control and Data Acquisition (SCADA) networks are commonly deployed to aid the operation of large industrial facilities, such as water treatment facilities. Historically, these networks were composed by special-purpose embedded devices communicating through proprietary protocols. However, modern deployments commonly make use of commercial off-the-shelf devices and standard communication protocols, such as TCP/IP. Furthermore, these networks are becoming increasingly interconnected, allowing communication with corporate networks and even the Internet. As a result, SCADA networks become vulnerable to cyber attacks, being exposed to the same threats that plague traditional IT systems. ::: ::: In our view, measurements play an essential role in validating results in network research; therefore, our first objective is to understand how SCADA networks are utilized in practice. To this end, we provide the first comprehensive analysis of real-world SCADA traffic. We analyze five network packet traces collected at four different critical infrastructures: two water treatment facilities, one gas utility, and one electricity and gas utility. We show, for instance, that exiting network traffic models developed for traditional IT networks cannot be directly applied to SCADA network traffic. ::: ::: We also confirm two SCADA traffic characteristics: the stable connection matrix and the traffic periodicity, and propose two intrusion detection approaches that exploit them. In order to exploit the stable connection matrix, we investigate the use of whitelists at the flow level. We show that flow whitelists have a manageable size, considering the number of hosts in the network, and that it is possible to overcome the main sources of instability in the whitelists. In order to exploit the traffic periodicity, we focus our attention to connections used to retrieve data from devices in the field network. We propose PeriodAnalyzer, an approach that uses deep packet inspection to automatically identify the different messages and the frequency at which they are issued. Once such normal behavior is learned, PeriodAnalyzer can be used to detect data injection and Denial of Service attacks. <s> BIB011 </s> Cyber-Physical Systems Security—A Survey <s> C. Cyber-Physical Controls 1) ICS Controls: <s> Pervasive healthcare systems, smart grids, and unmanned aircraft systems are examples of Cyber-Physical Systems (CPSs) that have become highly integrated in the modern world. As this integration deepens, the importance of securing these systems increases. In order to identify gaps and propose research directions in CPS intrusion detection research, we survey the literature of this area. Our approach is to classify modern CPS Intrusion Detection System (IDS) techniques based on two design dimensions: detection technique and audit material. We summarize advantages and drawbacks of each dimension’s options. We also summarize the most and least studied CPS IDS techniques in the literature and provide insight on the effectiveness of IDS techniques as they apply to CPSs. Finally, we identify gaps in CPS IDS research and suggest future research areas. <s> BIB012 </s> Cyber-Physical Systems Security—A Survey <s> C. Cyber-Physical Controls 1) ICS Controls: <s> Cyber-physical systems are characterized by an IT infrastructure controlling effects in the physical world. Attacks are intentional actions trying to cause undesired physical effects. When process data originating in the physical world is manipulated before being handed to the IT infrastructure, the data security property called "veracity" or trustworthiness will be violated. There is no canonical IT security solution guaranteeing that the inputs from a sensor faithfully represent reality. However, the laws of physics may help the defender to detect impossible or implausible sensor readings. This paper proposes a process-aware approach to detect when a sensor signal is being maliciously manipulated. We present a set of lightweight real-time algorithms for spoofing sensor signals directly at the microcontroller of the field device. The detection of spoofed measurements takes the form of plausibility and consistency checks with the help of the correlation entropy in a cluster of related sensors. We use the Tennessee Eastman challenge process to demonstrate the performance of our approach and to highlight aspects relevant to the detection effectiveness. <s> BIB013 </s> Cyber-Physical Systems Security—A Survey <s> C. Cyber-Physical Controls 1) ICS Controls: <s> Integration with information network not only facilitates Smart Grid with many unprecedented features, but also introduces many new security issues, such as false data injection and system intrusion. One of the biggest challenges in Smart Grid attack detection is how to fuse the heterogeneous data from the power system and information network. In this paper, a novel cyber-physical fusion approach is proposed to detect a Smart Grid attack Bad Data Injection (BDI), by merging both the features of the traffic flow in information network and the inherent physical laws in the power system into a unified model, named as Abnormal Traffic-indexed State Estimation (ATSE). The cyber security incidents, monitored by intrusion detection system (IDS), are quantized to serve as the impact factors that are incorporated into the bad data detection system based on state estimation model in power grid. Hundreds of attack cases are simulated on each transmission line of three IEEE standard systems to compare ATSE with current cyber, physical abnormal detection methods and cyber-physical fusion method, including IDS (Snort), bad data detection algorithm (Chi-square test) and SCPSE. The results indicate that ATSE can improve the detection rate 20% than the Chi-square Test on average, filter most false alarms generated by Snort, and solve the observability problem of SCPSE. <s> BIB014 </s> Cyber-Physical Systems Security—A Survey <s> C. Cyber-Physical Controls 1) ICS Controls: <s> The Smart Grid is a new type of power grid that will use advanced communication network technologies to support more efficient energy transmission and distribution. The grid infrastructure was designed for reliability; but security, especially against cyber threats, is also a critical need. In particular, an adversary can inject false data to disrupt system operation. In this paper, we develop a false data detection system that integrates two techniques that are tailored to the different attack types that we consider. We adopt anomaly-based detection to detect strong attacks that feature the injection of large amounts of spurious measurement data in a very short time. We integrate the anomaly detection mechanism with a watermarking-based detection scheme that prevents more stealthy attacks that involve subtle manipulation of the measurement data. We conduct a theoretical analysis to derive the closed-form formulae for the performance metrics that allow us to investigate the effectiveness of our proposed detection techniques. Our experimental data show that our integrated detection system can accurately detect both strong and stealthy attacks. Copyright © 2014 John Wiley & Sons, Ltd. <s> BIB015
a) New design: ICS needs security solutions that are specifically designed for it. Such solutions should take into consideration the cyber-physical interactions, and the heterogeneity of components and protocols. Cárdenas et al.  suggested that, most of the solutions in ICS aim to provide reliability, i.e., they make ICS reliable in the presence of nonmalicious failures. Although reliability is important, malicious cyber attacks are now possible more than ever, and must be considered when designing new solutions. Therefore, security is as important as reliability. b) Protocols with add-on security: Security solutions at the ICS communication level should consider the fundamental differences from traditional IT solutions. A number of proposals that rely on modifications of currents protocols, such as Modbus, DNP, and ICCP, to integrate security. Fovino et al. BIB002 proposed the Secure Modbus framework. It provides authentication, nonrepudiation, and thwart replayed packets. Majdalawieh et al.  proposed DNPSec framework, which adds confidentiality, integrity, and authenticity. c) IDS: The complexity of designing IDS for securing ICS is relatively less than it is in traditional IT security. This is due to the predictability of the traffic and the static topology of the network BIB007 . Zhu and Sastry  defined a set of goals that IDS in ICS are expected to monitor such as detection of: 1) any access to controllers and sensors/actuators' communication links; 2) modifications in sensor settings; and 3) actuators' physical tampering. D'Amico et al. BIB004 propose WildCAT, a solution that targets the physical exposure of the wireless communications within an ICS plant. It is a prototype for securing ICS from cyber attacks that exploits wireless networks. The idea is to install WildCAT in security guards' cars and to collect wireless activities in the physical perimeter of the plant. The collected data is sent to an analysis center, which, in turn, detects any suspicious activities and direct the guards to the location causing such activities. For further analysis of the current ICS-specific IDS solutions, we refer you to BIB011 , BIB003 , BIB008 , BIB013 , BIB007 , BIB012 , and  . d) Remote access to field devices: Fernandez and Fernandez  suggested that only authorized personnel can remotely access field devices. In addition, the access should be strictly secured by using a designated laptop through a VPN. In addition, Turk BIB001 suggested a simple control for Web-based DoS attacks that field devices with Web access features are vulnerable to. The author suggests closing idle connections. In addition, it could be a good measure to disallow multiple connections simultaneously. Usually, no more than one legitimate employee tries to access such a resource at the same time. 2) Smart Grids Controls: a) IDS: IDS for smart grids is still an ongoing problem that is not that mature yet. Designing IDS for smart grids is a complex task due to the enormous size of the grids and the heterogeneity of their components BIB005 . In addition, IDS built for traditional IT systems will not necessarily work for the smart grids. They must be specifically designed for smart grids to reduce the likelihood of false detection rates. Jin et al.  proposed an anomaly based IDS that detect malicious behavior using invariant detection and artificial ants with Bayesian reasoning approach. In addition, Mitchell and Chen BIB009 proposed a behavior-rule-based IDS to detect attacks on cyberphysical devices in smart grids such as headends, subscriber energy meters, and DAPs. Liu et al. BIB014 proposed an IDS for detecting bad data injection attacks targeting the smart grids. Their approach relies on combining detecting techniques from the traditional IDS and physical models. Yu et al. BIB015 proposed another IDS that is based on two detection techniques: 1) anomaly and 2) watermarking detection techniques. b) Low-level authorization and authentication: A common problem in a large system like smart grids is authentication and authorization of users who need to gain access to low-level layers such as field devices. Commonly, all field devices share the same password that employees know. This results in the impossibility of the nonrepudiation security requirement. A malicious employee could gain access to a field device and make undesired changes to the system, and there is no way to trace who did it. Therefore, Vaidya et al. BIB010 proposed an authentication and authorization mechanism that provides legitimate employees the ability to access field devices in the substation automation systems in smart grids. Their proposal relies on elliptic curve cryptography due to its low computation and key size requirements compared with other public key mechanisms. c) New designs: New security issues require that various aspects of smart grids be approached differently. The cyber-physical nature of the systems needs to be considered. Mo et al. BIB006 proposed Cyber-Physical Security, a new approach that combines systems-theoretic and cyber security controls. They provide two examples showing the applicability of their approach on two attacks on smart grids: 1) replay attack and 2) stealthy deception. They emphasize the need for considering those two types of components, cyber-and physical-components, when designing controls for smart grids. Most of the work done is extending existing protocols and systems to capture security properties. This might work as a temporary solution, but a bottom-up redesign is desired.