Design Considerations for Building Credible Security Testbeds: Perspectives from Industrial Control System Use Cases

Ani, Uchenna; Watson, Jeremy; Green, Ben; Craggs, Barnaby; Nurse, Jason R. C.

doi:10.1080/23742917.2020.1843822

Cited by 19 publications

(11 citation statements)

References 59 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Current cyber risk concerns are founded on intelligent systems capable of human-computer interactions [8]. The emergence of IoT has resulted with a large number of low-cost connected devices, capable of communicating with each other though a variety of communication protocols (e.g., LoRa, ZigBee, WiFi, LAN, WAN, 5G).…”

Section: Methodsmentioning

confidence: 99%

Epistemological Equation for Analysing Uncontrollable States in Complex Systems: Quantifying Cyber Risks from the Internet of Things

Radanliev

Roure

Burnap

et al. 2021

Rev Socionetwork Strat

View full text Add to dashboard Cite

The Internet-of-Things (IoT) triggers data protection questions and new types of cyber risks. Cyber risk regulations for the IoT, however, are still in their infancy. This is concerning, because companies integrating IoT devices and services need to perform a self-assessment of its IoT cyber security posture. At present, there are no self-assessment methods for quantifying IoT cyber risk posture. It is considered that IoT represent a complex system with too many uncontrollable risk states for quantitative risk assessment. To enable quantitative risk assessment of uncontrollable risk states in complex and coupled IoT systems, a new epistemological equation is designed and tested though comparative and empirical analysis. The comparative analysis is conducted on national digital strategies, followed by an empirical analysis of cyber risk assessment approaches. The results from the analysis present the current and a target state for IoT systems, followed by a transformation roadmap, describing how IoT systems can achieve the target state with a new epistemological analysis model. The new epistemological analysis approach enables the assessment of uncontrollable risk states in complex IoT systems—which begin to resemble artificial intelligence—and can be used for a quantitative self-assessment of IoT cyber risk posture.

show abstract

Section: Methodsmentioning

confidence: 99%

Epistemological Equation for Analysing Uncontrollable States in Complex Systems: Quantifying Cyber Risks from the Internet of Things

Radanliev

Roure

Burnap

et al. 2021

Rev Socionetwork Strat

View full text Add to dashboard Cite

show abstract

“…We then added survey articles, which we got through references from articles on testbeds and from unstructured searches via google scholar. Thanks to that, we found another three relevant articles [26][27][28].…”

Section: Related Workmentioning

confidence: 96%

“…Ani et al [28] described the methodology very thoroughly for evaluating testbeds. The methodology focused mainly on the fidelity of the created testbed, and authors emphasized the essential parameters when creating testbeds with much fidelity.…”

Section: Related Workmentioning

confidence: 99%

Application Perspective on Cybersecurity Testbed for Industrial Control Systems

Pospíšil

Blažek

Kuchař

et al. 2021

Sensors

View full text Add to dashboard Cite

In recent years, the Industry 4.0 paradigm has accelerated the digitalization process of the industry, and it slowly diminishes the line between information technologies (IT) and operational technologies (OT). Among the advantages, this brings up the convergence issue between IT and OT, especially in the cybersecurity-related topics, including new attack vectors, threats, security imperfections, and much more. This cause raised new topics for methods focused on protecting the industrial infrastructure, including monitoring and detection systems, which should help overcome these new challenges. However, those methods require high quality and a large number of datasets with different conditions to adapt to the specific systems effectively. Unfortunately, revealing field factory setups and infrastructure would be costly and challenging due to the privacy and sensitivity causes. From the lack of data emerges the new topic of industrial testbeds, including sub-real physical laboratory environments, virtual factories, honeynets, honeypots, and other areas, which helps to deliver sufficient datasets for mentioned research and development. This paper summarizes related works in the area of industrial testbeds. Moreover, it describes best practices and lessons learned for assembling physical, simulated, virtual, and hybrid testbeds. Additionally, a comparison of the essential parameters of those testbeds is presented. Finally, the findings and provided information reveal research and development challenges, which must be surpassed.

show abstract

“…In 2020, in [23] the authors present an exhaustive survey with guidelines and good practices to help the building of an ICS testbed, highlighting the main challenges and the results of a focus group involving security experts to identify relevant design factors and guidelines. In the same years, the same authors published [24], with interesting guidelines for each ICS layer and a set of characteristics to consider when outlining testbed objectives, architecture, and evaluation process.…”

Section: Related Ics Surveysmentioning

confidence: 99%

A Survey on Industrial Control System Testbeds and Datasets for Security Research

Conti,

Donadel,

Turrin

2021

Preprint

View full text Add to dashboard Cite

The increasing digitization and interconnection of legacy Industrial Control Systems (ICSs) open new vulnerability surfaces, exposing such systems to malicious attackers. Furthermore, since ICSs are often employed in critical infrastructures (e.g., nuclear plants) and manufacturing companies (e.g., chemical industries), attacks can lead to devastating physical damages. In dealing with this security requirement, the research community focuses on developing new security mechanisms such as Intrusion Detection Systems (IDSs), facilitated by leveraging modern machine learning techniques. However, these algorithms require a testing platform and a considerable amount of data to be trained and tested accurately. To satisfy this prerequisite, Academia, Industry, and Government are increasingly proposing testbed (i.e., scaled-down versions of ICSs or simulations) to test the performances of the IDSs. Furthermore, to enable researchers to cross-validate security systems (e.g., security-bydesign concepts or anomaly detectors), several datasets have been collected from testbeds and shared with the community.In this paper, we provide a deep and comprehensive overview of ICSs, presenting the architecture design, the employed devices, and the security protocols implemented. We then collect, compare, and describe testbeds and datasets in the literature, highlighting key challenges and design guidelines to keep in mind in the design phases. Furthermore, we enrich our work by reporting the best performing IDS algorithms tested on every dataset to create a baseline in state of the art for this field. Finally, driven by knowledge accumulated during this survey's development, we report advice and good practices on the development, the choice, and the utilization of testbeds, datasets, and IDSs.

show abstract

Design Considerations for Building Credible Security Testbeds: Perspectives from Industrial Control System Use Cases

Abstract: The version in the Kent Academic Repository may differ from the final published version. Users are advised to check http://kar.kent.ac.uk for the status of the paper. Users should always cite the published version of record.

Cited by 19 publications

References 59 publications

Epistemological Equation for Analysing Uncontrollable States in Complex Systems: Quantifying Cyber Risks from the Internet of Things

Epistemological Equation for Analysing Uncontrollable States in Complex Systems: Quantifying Cyber Risks from the Internet of Things

Application Perspective on Cybersecurity Testbed for Industrial Control Systems

A Survey on Industrial Control System Testbeds and Datasets for Security Research

Contact Info

Product

Resources

About