Compliance verification of a cyber security standard for Cloud-connected SCADA

Advances in IoT and cloud computing are revolutionizing the architecture of industrial control systems by changing them from isolated architectures to decentralized ones. This leads to increased complexity that exposes these systems to cyber threats from both the cloud and the control environment. Different cyber security standards have been proposed for securing these systems based on a set of security requirements. However, these requirements are often specified in natural language, which makes formal verification of security properties against the standards challenging. In this paper we propose a framework for modeling cloud-connected SCADA systems and formally verify their compliance with the IEC-62443-3-3 standard. We model the system and the security requirements from the standards using the formal modeling language TLA+ in order to formally verify compliance with the standard using the TLC model checker. The applicability of our technique is demonstrated using an industrial case study.