Cyber-Physical Systems Security—A Survey <s> C. Cyber-Physical Vulnerabilities 1) ICS Vulnerabilities: a) ICS V3, communication between ICS components: <s> Abstract The Modbus protocol and its variants are widely used in industrial control applications, especially for pipeline operations in the oil and gas sector. This paper describes the principal attacks on the Modbus Serial and Modbus TCP protocols and presents the corresponding attack taxonomies. The attacks are summarized according to their threat categories, targets and impact on control system assets. The attack taxonomies facilitate formal risk analysis efforts by clarifying the nature and scope of the security threats on Modbus control systems and networks. Also, they provide insights into potential mitigation strategies and the relative costs and benefits of implementing these strategies. <s> BIB001 </s> Cyber-Physical Systems Security—A Survey <s> C. Cyber-Physical Vulnerabilities 1) ICS Vulnerabilities: a) ICS V3, communication between ICS components: <s> Abstract Modern critical infrastructures are continually exposed to new threats due to the vulnerabilities and architectural weaknesses introduced by the extensive use of information and communications technologies (ICT). Of particular significance are the vulnerabilities in the communication protocols used in supervisory control and data acquisition (SCADA) systems that are commonly employed to control industrial processes. This paper presents the results of our research on the impact of traditional ICT malware on SCADA systems. In addition, it discusses the potential damaging effects of computer malware created for SCADA systems. <s> BIB002 </s> Cyber-Physical Systems Security—A Survey <s> C. Cyber-Physical Vulnerabilities 1) ICS Vulnerabilities: a) ICS V3, communication between ICS components: <s> Distributed Network Protocol (DNP3) is the predominant SCADA protocol in the energy sector – more than 75% of North American electric utilities currently use DNP3 for industrial control applications. This paper presents a taxonomy of attacks on the protocol. The attacks are classified based on targets (control center, outstation devices and network/communication paths) and threat categories (interception, interruption, modification and fabrication). To facilitate risk analysis and mitigation strategies, the attacks are associated with the specific DNP3 protocol layers they exploit. Also, the operational impact of the attacks is categorized in terms of three key SCADA objectives: process confi- dentiality, process awareness and process control. The attack taxonomy clarifies the nature and scope of the threats to DNP3 systems, and can provide insights into the relative costs and benefits of implementing mitigation strategies. <s> BIB003 </s> Cyber-Physical Systems Security—A Survey <s> C. Cyber-Physical Vulnerabilities 1) ICS Vulnerabilities: a) ICS V3, communication between ICS components: <s> Supervisory Control and Data Acquisition(SCADA) systems are deeply ingrained in the fabric of critical infrastructure sectors. These computerized real-time process control systems, over geographically dispersed continuous distribution operations, are increasingly subject to serious damage and disruption by cyber means due to their standardization and connectivity to other networks. However, SCADA systems generally have little protection from the escalating cyber threats. In order to understand the potential danger and to protect SCADA systems, in this paper, we highlight their difference from standard IT systems and present a set of security property goals. Furthermore, we focus on systematically identifying and classifying likely cyber attacks including cyber-induced cyber-physical attack son SCADA systems. Determined by the impact on control performance of SCADA systems, the attack categorization criteria highlights commonalities and important features of such attacks that define unique challenges posed to securing SCADA systems versus traditional Information Technology(IT) systems. <s> BIB004 </s> Cyber-Physical Systems Security—A Survey <s> C. Cyber-Physical Vulnerabilities 1) ICS Vulnerabilities: a) ICS V3, communication between ICS components: <s> It is often appealing to assume that existing solutions can be directly applied to emerging engineering domains. Unfortunately, careful investigation of the unique challenges presented by new domains exposes its idiosyncrasies, thus often requiring new approaches and solutions. In this paper, we argue that the “smart” grid, replacing its incredibly successful and reliable predecessor, poses a series of new security challenges, among others, that require novel approaches to the field of cyber security. We will call this new field cyber-physical security. The tight coupling between information and communication technologies and physical systems introduces new security concerns, requiring a rethinking of the commonly used objectives and methods. Existing security approaches are either inapplicable, not viable, insufficiently scalable, incompatible, or simply inadequate to address the challenges posed by highly complex environments such as the smart grid. A concerted effort by the entire industry, the research community, and the policy makers is required to achieve the vision of a secure smart grid infrastructure. <s> BIB005
ICS relies on protocols that used to be proprietary such as Modbus and DNP3 to monitor and send control commands from a control center to sensors and actuators. Modbus protocol, the de facto standard for communication in many ICS, lacks basic security measures, so that it is vulnerable to a plethora of attacks. Its lack of encryption exposes the traffic to eavesdropping attacks  ,  . It also lacks integrity checks making data integrity questionable  , BIB002 . In addition, no authentication measures are implemented, suggesting the feasibility of manipulating data traveling to actuators to make them act undesirably, or with data coming from sensors so the controllers can be spoofed by false data  , BIB004 . Similarly, DNP3 protocol also does not implement any kind of encryption or authentication mechanisms BIB003 , BIB001 . It has, however, a simple integrity measure using CRC. Although CRC is relatively simple, it is better than no integrity check altogether, like in Modbus. East et al. BIB003 analyzed the DNP3's vulnerability to at least 23 attacks that exploit the absence of encryption, authentication, and authorization. Direct access to remote field devices such as RTUs and PLCs used in smart grids is also a vulnerability that might be overlooked by smart grids' operators. Some field devices might be left with default passwords BIB005 . Furthermore, a large number of PLCs were found to be directly connected to the Internet  . In fact, Leverett  identified 7500 field devices that are directly connected to the Internet. Those devices are also used in smart grids, thus the same vulnerability is also applicable. Sometimes, in case of failure of the primary communications, it is useful to have a secondary communication channel (e.g., dial-up) to access field devices such as PLCs and RTUs. It provides a direct connection with field devices, which in turn are directly connected with the sensors and actuators  . This poses an opportunity for attackers to take control over the field devices without the need to exploit other more advanced communication links, especially in the presence of default logins and simple authentication mechanisms.