Cloud-Assisted IoT-Based SCADA Systems Security: A Review of the State of the Art and Future Challenges <s> II. CHALLENGES TO SECURE SCADA SYSTEMS IN IoT-CLOUD ENVIRONMENTS <s> Process automation systems are key to the organizations behind the UK's critical national infrastructure (CNI) as they both monitor and control critical processes involved with the production and transportation of gas, electricity and water. As these systems become more 'open' - using Ethernet, TCP/IP and Web technologies - they become vulnerable to the same threats that exist for normal IT systems. <s> BIB001 </s> Cloud-Assisted IoT-Based SCADA Systems Security: A Review of the State of the Art and Future Challenges <s> II. CHALLENGES TO SECURE SCADA SYSTEMS IN IoT-CLOUD ENVIRONMENTS <s> New technologies are increasing the vulnerability of the power system to cyber security threats. Dealing with these threats and determining vulnerabilities is an important task for utilities. This paper presents the development of a testbed designed to assess the vulnerabilities introduced by using public networks for communication. <s> BIB002 </s> Cloud-Assisted IoT-Based SCADA Systems Security: A Review of the State of the Art and Future Challenges <s> II. CHALLENGES TO SECURE SCADA SYSTEMS IN IoT-CLOUD ENVIRONMENTS <s> Cyber security threats and attacks are greatly affecting the security of critical infrastructure, industrial control systems, and Supervisory Control and Data Acquisition (SCADA) control systems. Despite growing awareness of security issues especially in SCADA networks, there exist little or scarce information about SCADA vulnerabilities and attacks. The emergence of Internet and World Wide Web technologies integrated with business systems brought a growing concern about the security and safety of the SCADA control systems. This research aims to addresses the issues regarding security and vulnerability testing. Software program was created to simulate the vulnerability testing and carry out assessment methodologies to test existing SCADA software design and implementation. This paper provides an analysis of potential software vulnerabilities, and security concerns including recommendations toward improving security for SCADA control systems. It also provides recommendations on key requirements and features needed for the enhancement of security for SCADA control systems. <s> BIB003 </s> Cloud-Assisted IoT-Based SCADA Systems Security: A Review of the State of the Art and Future Challenges <s> II. CHALLENGES TO SECURE SCADA SYSTEMS IN IoT-CLOUD ENVIRONMENTS <s> The discovery in June 2010 that a cyber worm dubbed ‘Stuxnet’ had struck the Iranian nuclear facility at Natanz suggested that, for cyber war, the future is now. Yet more important is the political and strategic context in which new cyber threats are emerging, and the effects the worm has generated in this respect. Perhaps most striking is the confluence between cyber crime and state action. States are capitalising on technology whose development is driven by cyber crime, and perhaps outsourcing cyber attacks to non-attributable third parties, including criminal organisations. Cyber offers great potential for striking at enemies with less risk than using traditional military means. It is unclear how much the Stuxnet program cost, but it was almost certainly less than the cost of single fighter-bomber. Yet if damage from cyber attacks can be quickly repaired, careful strategic thought is required in comparing the cost and benefits of cyber versus traditional military attack. One important benefit of cyber ... <s> BIB004 </s> Cloud-Assisted IoT-Based SCADA Systems Security: A Review of the State of the Art and Future Challenges <s> II. CHALLENGES TO SECURE SCADA SYSTEMS IN IoT-CLOUD ENVIRONMENTS <s> Distributed control systems (DCS) and supervisory control and data acquisition (SCADA) systems were developed to reduce labour costs, and to allow system-wide monitoring and remote control from a central location. Control systems are widely used in critical infrastructures such as electric grid, natural gas, water and wastewater industries. While control systems can be vulnerable to a variety of types of cyber attacks that could have devastating consequences, little research has been done to secure the control systems. American Gas Association (AGA), IEC TC57 WG15, IEEE, NIST and National SCADA Test Bed Program have been actively designing cryptographic standard to protect SCADA systems. American Gas Association (AGA) had originally been designing cryptographic standard to protect SCADA communication links and finished the report AGA 12 part 1. The AGA 12 part 2 has been transferred to IEEE P1711. This paper presents an attack on the protocols in the first draft of AGA standard (Wright et al., 2004). This attack shows that the security mechanisms in the first version of the AGA standard protocol could be easily defeated. We then propose a suite of security protocols optimised for SCADA/DCS systems which include: point-to-point secure channels, authenticated broadcast channels, authenticated emergency channels, and revised authenticated emergency channels. These protocols are designed to address the specific challenges that SCADA systems have. <s> BIB005 </s> Cloud-Assisted IoT-Based SCADA Systems Security: A Review of the State of the Art and Future Challenges <s> II. CHALLENGES TO SECURE SCADA SYSTEMS IN IoT-CLOUD ENVIRONMENTS <s> Supervisory control and data acquisition (SCADA) are applications that collect data from a system in order to automate the monitoring and controlling of its activities. Several industrial fields such as, electric utilities, water supplies and buildings' facilities have already adopted SCADA systems to increase the efficiency and reduce cost. However, the IT community is concerned about the level of security that any applied SCADA system provides. This paper concentrates on the major security threats encountered in SCADA systems. In addition, it discusses a new proposed methodology in order to increase the system security with minimal impact on efficiency. The proposed scheme provides several security services which are mutual authentication, confidentiality, data integrity and accountability. <s> BIB006 </s> Cloud-Assisted IoT-Based SCADA Systems Security: A Review of the State of the Art and Future Challenges <s> II. CHALLENGES TO SECURE SCADA SYSTEMS IN IoT-CLOUD ENVIRONMENTS <s> Industrial Control Systems (ICS) which among others are comprised of Supervisory Control and Data Acquisition (SCADA) and Distributed Control Systems (DCS) are used to control industrial processes. ICS have now been connected to other Information Technology (IT) systems and have as a result become vulnerable to Advanced Persistent Threats (APT). APTs are targeted attacks that use zero-day attacks to attack systems. Current ICS security mechanisms fail to deter APTs from infiltrating ICS. An analysis of possible solutions to deter APTs was done. This paper proposes the use of Artificial Immune Systems to secure ICS from APTs. <s> BIB007 </s> Cloud-Assisted IoT-Based SCADA Systems Security: A Review of the State of the Art and Future Challenges <s> II. CHALLENGES TO SECURE SCADA SYSTEMS IN IoT-CLOUD ENVIRONMENTS <s> This paper investigates how secure information sharing with external vendors can be achieved in an Industrial Internet of Things (IIoT). It also identifies necessary security requirements for secure information sharing based on identified security challenges stated by the industry. The paper then proposes a roadmap for improving security in IIoT which investigates both short-term and long-term solutions for protecting IIoT devices. The short-term solution is mainly based on integrating existing good practices. The paper also outlines a long term solution for protecting IIoT devices with fine-grained access control for sharing data between external entities that would support cloud-based data storage. <s> BIB008
The Siberian Pipeline Explosion happened in 1982 and is considered to be the first cybersecurity incident in the history of SCADA systems. In this explosion, an attacker exploited a system vulnerability using a virus called a Trojan horse. In 2000, a former worker hacked into the Maroochy Shire water plant control system, flooding the hotel grounds with raw sewage BIB001 . In 2010, Iran's nuclear system was disrupted by the Stuxnet worm BIB004 . In 2011, another form of Stuxnet was discovered and given the name Duqu. Most recently, the Flame worm  brought devastation to Industrial Control Systems (ICS) and to SCADA systems. A detailed literature review and analysis of the major attacks on SCADA systems can help focus attention on the reasons why these critical infrastructures are so vulnerable. Particularly in cases where these systems are integrated with the IoT and cloud based environments, they are far more exposed to such vulnerabilities. A number of vulnerabilities exist in these environments that could possibly implant malware in SCADA systems, some of which are listed below  ,  , BIB008 configuration errors such as parameter tempering and lack of encryption. 12. Cloud and external individual service providers have security vulnerabilities of their own. The vulnerabilities mentioned above form the basis for why CIs are exposed to threats that have a negative impact on the performance of these systems. A general statistical representation of the threats to SCADA systems before their exposure to the IoT-cloud environment is shown in Fig. 4 . Insider threats are considered to be the most prominent type of attacks on IoT-based SCADA systems BIB008 . Based on the current literature, a few threats to the SCADA systems in IoT-cloud environments are defined below: 1) Advanced Persistent Threats (APTs): APTs are network attacks in which an unauthorized person attempts VOLUME 4, 2016 FIGURE 4. A statistical view of the threats to the SCADA systems BIB006 . to gain access to the system using zero-day attacks with the intention of stealing data rather than causing damage to it BIB007 . 2) Lack of Data Integrity: Data integrity is lost when the original data are destroyed, and this could happen through any means such as physical tampering or interception. 3) Man-in-the-Middle (MITM) Attacks: Two attacks that can easily be launched as a result of a man-in-themiddle attack are spoofing attacks and sniffing attacks. In a spoofing attack, a program or person masquerades as another program or person to gain illegitimate access to the system or the network. In a sniffing attack, the intruder monitors all the messages being passed and all the activities performed by the system BIB003 . 4) Replay Attacks: Replay attacks are a type of network attack in which a valid message containing some valid data is repeated again and again; in some cases, the message may repeat itself. These attacks affect the performance of SCADA systems and can be serious threats when a replay attack delays messages sent to physical devices BIB005 . 5) Denial of Service (DoS) Attacks: The purpose of a DoS attack is to make a service unavailable for the intended user. Such attacks can be performed in multiple ways such as DoS or DDoS. At the simplest level, these attacks overload computer resources such that the machine is unable to perform its intended tasks BIB002 .