Proceedings of the Fifth Annual Industrial Control System Security (ICSS) Workshop最新文献

If I Knew Then What I Know Now: On Reevaluating DNP3 Security using Power Substation Traffic 如果我当时知道我现在知道的:利用变电站流量重新评估DNP3安全性

Proceedings of the Fifth Annual Industrial Control System Security (ICSS) Workshop Pub Date : 2019-12-10 DOI: 10.1145/3372318.3372324

Celine Irvene, Tohid Shekari, David Formby, R. Beyah

{"title":"If I Knew Then What I Know Now: On Reevaluating DNP3 Security using Power Substation Traffic","authors":"Celine Irvene, Tohid Shekari, David Formby, R. Beyah","doi":"10.1145/3372318.3372324","DOIUrl":"https://doi.org/10.1145/3372318.3372324","url":null,"abstract":"In the modern world, the reliable and continuous operation of cyber-physical systems (CPSs) have become increasingly crucial factors of our daily life. As a result, the networking protocols of CPSs have been developed to achieve availability without serious consideration for security. Security flaws in these protocols could lead to system misconfigurations or malicious network penetrations which would severely impact the operation of critical infrastructure and control devices on a CPS network. To combat this some researchers have made efforts to design effective intrusion detection and prevention systems (IDSs/IPSs) for providing security in CPS networks. Most of the past and ongoing work in this space explores security from virtual testbeds or simulated systems, many of which make simplifying assumptions. These artificial platforms generally rely on the expectation that CPS networks are behaviorally very similar to traditional information technology (IT) networks and this does not always hold true in practice. In this paper, we investigate and discuss the feasibility and efficacy of previously proposed DNP3 application layer attacks and their mitigation techniques on network traffic captured from four real-world power grid substations. Based on this and a traffic characterization of the captured data we suggest a set of lightweight, but effective mechanisms to help enhance the security of power substations utilizing the DNP3 protocol. This work primarily focuses on DNP3 since it is the most widely used protocol in power substations which form the backbone of the electricity grid.","PeriodicalId":287941,"journal":{"name":"Proceedings of the Fifth Annual Industrial Control System Security (ICSS) Workshop","volume":"97 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-12-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116671494","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 8

Use of an SDN Switch in Support of NIST ICS Security Recommendations and Least Privilege Networking 使用SDN交换机支持NIST ICS安全建议和最小特权网络

Proceedings of the Fifth Annual Industrial Control System Security (ICSS) Workshop Pub Date : 2019-12-10 DOI: 10.1145/3372318.3372321

Varsha Venugopal, J. Alves-Foss, Sandeep Gogineni Ravindrababu

引用次数: 5

A Strategy for Security Testing Industrial Firewalls 工业防火墙的安全测试策略

Proceedings of the Fifth Annual Industrial Control System Security (ICSS) Workshop Pub Date : 2019-12-10 DOI: 10.1145/3372318.3372323

Thuy D. Nguyen, S. C. Austin, C. Irvine

{"title":"A Strategy for Security Testing Industrial Firewalls","authors":"Thuy D. Nguyen, S. C. Austin, C. Irvine","doi":"10.1145/3372318.3372323","DOIUrl":"https://doi.org/10.1145/3372318.3372323","url":null,"abstract":"The ability to secure industrial control systems (ICS) against adversaries relies on defense in depth and implementation of security controls. However, as automation and networking of industrial processes increases, so do the opportunities for adversaries to cause destruction and disruption. Many industrial firewalls are proprietary and often users blindly trust that the firewalls meet vendor security claims. Independent testing can assess these claims. This paper describes the security testing of two commercial ICS firewalls to determine whether or not these firewalls provide protection of resources as advertised. Our test philosophy is guided by the Flaw Hypothesis Methodology (FHM)---a penetration testing technique for discovery of security flaws derived from documentation and other evidence. The test coverage includes functional testing, exception testing, and penetration testing. Testing is conducted on a simulated natural gas compressor system, utilizing two open-source vulnerability analysis tools, Nessus and Metasploit. The testing methodology is the first step toward a general approach for selecting and testing firewalls intended for critical control systems.","PeriodicalId":287941,"journal":{"name":"Proceedings of the Fifth Annual Industrial Control System Security (ICSS) Workshop","volume":"63 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-12-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"125839735","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 2

ICS-SEA: Formally Modeling the Conflicting Design Constraints in ICS ICS- sea: ICS中冲突设计约束的形式化建模

Proceedings of the Fifth Annual Industrial Control System Security (ICSS) Workshop Pub Date : 2019-12-10 DOI: 10.1145/3372318.3372325

Eyasu Getahun Chekole, Huaqun Guo

引用次数: 3

An Distributed Cyberattack Diagnosis Scheme for Malicious Protection Operation based on IEC 61850 基于IEC 61850的分布式恶意防护网络攻击诊断方案

Proceedings of the Fifth Annual Industrial Control System Security (ICSS) Workshop Pub Date : 2019-12-10 DOI: 10.1145/3372318.3372326

M. Touhiduzzaman, A. Hahn, S. Lotfifard

{"title":"An Distributed Cyberattack Diagnosis Scheme for Malicious Protection Operation based on IEC 61850","authors":"M. Touhiduzzaman, A. Hahn, S. Lotfifard","doi":"10.1145/3372318.3372326","DOIUrl":"https://doi.org/10.1145/3372318.3372326","url":null,"abstract":"Substation automation systems (SAS) are known to be vulnerable to cyber attacks due to the weaknesses of security features (e.g., encryption, authenticity). These issues were demonstrated by the recent Ukranian cyber attack event on 2016. The security mechanisms located at the SAS need to identify cyberattacks and faults occur in protection operations distributively in efficient manner. This work presents a novel distributed cyberattack diagnosis solution (DCDS) for the SAS, based on the backward reachability graph analysis of behavioral Petri-net (BPN). The proposed distributed BPN model for the SAS is developed based on the IEC 61850 protocol. The distributed diagnoser solution produces a local diagnosis result to detect attacks which is consistent and correct without the use of centralized diagnosis scheme. A case study on the SAS is provided to verify our proposed DCDS based on different scenarios that successfully identified cyberattack and other substation (e.g., relay malfunction, normal fault)events. Also, this DCDS is evaluated in the Mininet computer network emulator by using an open-source library (libiec61850) to exchange the SAS messages through IEC 61850.","PeriodicalId":287941,"journal":{"name":"Proceedings of the Fifth Annual Industrial Control System Security (ICSS) Workshop","volume":"520 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-12-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121594843","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

A Probe into Process-Level Attack Detection in Industrial Environments from a Side-Channel Perspective 从侧信道角度探讨工业环境中进程级攻击检测

Proceedings of the Fifth Annual Industrial Control System Security (ICSS) Workshop Pub Date : 2019-12-10 DOI: 10.1145/3372318.3372320

Wissam Aoudi, Albin Hellqvist, Albert Overland, M. Almgren

引用次数: 3

Gas what?: I can see your GasPots. Studying the fingerprintability of ICS honeypots in the wild 气什么?我能看到你的气垫。研究ICS蜜罐在野外的指纹识别能力

Proceedings of the Fifth Annual Industrial Control System Security (ICSS) Workshop Pub Date : 2019-12-10 DOI: 10.1145/3372318.3372322

Mohammad-Reza Zamiri-Gourabi, Ali Razmjoo-Qalaei, Babak Amin Azad

{"title":"Gas what?: I can see your GasPots. Studying the fingerprintability of ICS honeypots in the wild","authors":"Mohammad-Reza Zamiri-Gourabi, Ali Razmjoo-Qalaei, Babak Amin Azad","doi":"10.1145/3372318.3372322","DOIUrl":"https://doi.org/10.1145/3372318.3372322","url":null,"abstract":"Internet connectivity of electronic devices has brought us the ease of centralized management and these days more and more devices are connected to this globally accessible network. At the same time, this landscape has opened new doors for malicious actors. While internet connectivity is a built-in feature for desktop and mobile devices, Industrial Control Systems (ICS) lag behind. Traditionally, ICS networks have been air-gapped and as a result, many ICS devices are not well-equipped to be connected to the internet. Absence of proper authentication and other security mechanisms is commonly observed on these devices. In response to the new threats of connected ICS systems, various ICS honeypots have been developed during the past decade. These honeypots are used to collect information on the attack landscape of ICS systems. In this research, we show that ICS honeypots should be designed more carefully and existing honeypots can fairly easily be fingerprinted by the attackers. We systematically study the categories of often overlooked behaviors that make ICS honeypots fingerprintable. Moreover, to demonstrate the impact of these flaws, we perform a large scale analysis over the internet to detect GasPot honeypots that emulate automatic tank gauges (ATG). We were able to find 17 existing honeypot instances which is more than the number of discovered GasPots by Shodan. Finally, we released our ICS honeypot scanner and our ATG honeypot which provides full protocol support and fixes the existing flaws within GasPot that makes it detectable.","PeriodicalId":287941,"journal":{"name":"Proceedings of the Fifth Annual Industrial Control System Security (ICSS) Workshop","volume":"13 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-12-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"117245378","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 9