Cyber-Physical Systems Security—A Survey <s> A. Causes of Vulnerabilities 1) Isolation Assumption: <s> A waterbed mattress adapted to fit within a rigid frame comprises a water-containing main chamber and at least one supplemental chamber along the perimeter of the main chamber for containing a fluid giving structural rigidity to the perimeter, particularly along the upper boundary abutting the frame. The supplemental chamber is established by an imperforate flexible membrane internally spanning the mattress corner between the top panel and the adjacent side panel. The cross sectional length of the membrane is not greater than the dimension of the adjacent top and side panel segments which constitute the outer walls of the chamber. <s> BIB001 </s> Cyber-Physical Systems Security—A Survey <s> A. Causes of Vulnerabilities 1) Isolation Assumption: <s> In this paper we attempt to answer two questions: (1) Why should we be interested in the security of control systems? And (2) What are the new and fundamentally different requirements and problems for the security of control systems? We also propose a new mathematical framework to analyze attacks against control systems. Within this framework we formulate specific research problems to (1) detect attacks, and (2) survive attacks. <s> BIB002 </s> Cyber-Physical Systems Security—A Survey <s> A. Causes of Vulnerabilities 1) Isolation Assumption: <s> The automobile industry has grown to become an integral part of our everyday life. As vehicles evolve, the primarily mechanical solutions for vehicle control are gradually replaced by electronics and software solutions forming in-vehicle computer networks. An emerging trend is to introduce wireless technology in the vehicle domain by attaching a wireless gateway to the in-vehicle network. By allowing wireless communication, real-time information exchange between vehicles and between infrastructure and vehicles become reality. This communication allows for road condition reporting, decision making, and remote diagnostics and firmware updates over-the-air. However, allowing external parties wireless access to the in-vehicle network creates a potential entry-point for cyber attacks. In this paper, we investigate the security issues of allowing external wireless communication. We use a defense-in-depth perspective and discuss security challenges for each of the prevention, detection, deflection, countermeasures, and recovery layers. <s> BIB003 </s> Cyber-Physical Systems Security—A Survey <s> A. Causes of Vulnerabilities 1) Isolation Assumption: <s> The introduction of “smart grid” solutions imposes that cyber security and power system communication systems must be dealt with extensively. These parts together are essential for proper electricity transmission, where the information infrastructure is critical. The development of communication capabilities, moving power control systems from “islands of automation” to totally integrated computer environments, have opened up new possibilities and vulnerabilities. Since several power control systems have been procured with “openness” requirements, cyber security threats become evident. For refurbishment of a SCADA/EMS system, a separation of the operational and administrative computer systems must be obtained. The paper treats cyber security issues, and it highlights access points in a substation. Also, information security domain modeling is treated. Cyber security issues are important for “smart grid” solutions. Broadband communications open up for smart meters, and the increasing use of wind power requires a “smart grid system”. <s> BIB004 </s> Cyber-Physical Systems Security—A Survey <s> A. Causes of Vulnerabilities 1) Isolation Assumption: <s> In this paper, we analyze several cyber-security incidents involving critical infrastructure and SCADA systems. We classify these incidents based on Source Sector, Method of Operations, Impact, and Target Sector. Using this standardized taxonomy we can easily compare and contrast current and future SCADA incidents. <s> BIB005 </s> Cyber-Physical Systems Security—A Survey <s> A. Causes of Vulnerabilities 1) Isolation Assumption: <s> We present a generic yet practical framework for assessing security risks to cyber-physical systems (CPSs). Our framework can be used to benchmark security risks when information is less than perfect, and interdependencies of physical and computational components may result in correlated failures. Such environments are prone to externalities, and can cause huge societal losses. We focus on the risks that arise from interdependent reliability failures (faults) and security failures (attacks). We advocate that a sound assessment of these risks requires explicit modeling of the effects of both technology-based defenses and institutions necessary for supporting them. Thus, we consider technology-based security defenses grounded in information security tools and fault-tolerant control in conjunction with institutional structures. Our game-theoretic approach to estimating security risks facilitates more effective defenses, especially against correlated failures. <s> BIB006
The trend of "security by obscurity" has been dominant in most, if not all, CPS applications since their initial design. The focus has been on designing reliable and safe systems, whereas the security has not been of a great importance. This is because the systems were supposed to be isolated from the outside world, and therefore, considered secure. For example, in ICS and power grids (before they became "smart"), security relied on the assumption that systems are isolated from the outside world, and the monitoring and control operations were performed locally BIB002 , BIB004 ,  . Furthermore, medical devices, such as IMDs, were originally designed to be isolated from networks and other external interactions  . In addition, the same isolation assumption is also present in smart cars where the security of the ECUs' intercommunications relies on their isolation from adversaries BIB003 . Recent and ongoing advances in CPS applications do not adhere to the isolation assumption, but rather more connectivity has been introduced. More connectivity increases the number of access points to cars, thus more attack surfaces arise. 2) Increased Connectivity: CPS are more connected than ever before. Manufacturers have improved CPS by adding services that rely on open networks and wireless technologies. For example, ICS and smart grids are connected to control centers which are connected to the Internet or some businessrelated networks. In fact, most ICS attacks have been internal until 2001; after that most of the attacks originate from external (Internet-based) sources  . This is clearly due to the increased connectivity deployed in ICS. In addition, for fast incident response and more convenience, some field devices are directly connected to the Internet  , BIB001 . Medical devices have wireless capabilities for easier reconfiguration and monitoring. Smart cars have more connectivity so they are referred to as "connected cars." This connectedness relies on wireless communications such as Bluetooth, cellular, RFID, and satellite radio communications. 3) Heterogeneity: CPS consist of components that are usually heterogeneous such that COTS, third party, and proprietary components are integrated to build a CPS application. CPS are almost always multivendor systems, and each product has its own security problems. For example, a component might have been manufactured, specified, or implemented by different entities, and eventually integrated by the system deployers. Hence, the building components of CPS are more integrated rather than designed BIB004 . This integration invites the inherent vulnerabilities of each product BIB006 . For example, one step of the Stuxnet attack was to exploit the default password in Siemens PLC to access a computer running a Windows OS BIB005 . Last, the internal details of the integrated, heterogenous components are unknown, and thus they may produce unexpected behavior when they are deployed. In fact, most of the bugs that led to successful attacks in smart cars, for example, were found at the boundaries of interconnected components manufactured by different vendors, where the incorrect assumptions interact.