From Detecting Cyber-Attacks to Mitigating Risk Within a Hybrid Environment

Abstract

Telecommunication networks based on commonplace technologies (such as Ethernet) often constitute a vulnerable attack vector against modern Critical Infrastructures (CIs), particularly for Supervisory Control and Data Acquisition (SCADA) systems, which rely on them for monitoring and controlling physical components. This article presents a unique platform that encompasses a range of capabilities, from cyber attack detection to mitigation strategies, through interdependency and risk evaluation. The platform is made of two main components: a cyber attack detection subsystem and a risk assessment framework. Both blocks are innovative from a research point of view and they have been developed and customized to fit the CIs' features, that are completely different from telecommunication networks. This platform has been tested on a hybrid environment testbed, made of virtual and real components, within the scope of the EU FP7 CockpitCI and EU H2020 ATENA projects. The case study corresponds to a medium voltage power grid controlled by a SCADA control center, where the platform has been validated with optimal results in terms of detection capabilities and time response. Index Terms-cyber attack detection risk assessment, decision support systems, cyber-physical systems, supervisory control and data acquisition (SCADA) I. INTRODUCTION T HE concept of Critical Infrastructure has been changing over the past years. This notion, which was mainly related to the public sector during the 1980s [1], was redefined as a matter of national security [2] during the 1990s, and particularly after 9/11. This comes as no surprise, as CIs are the key assets, systems or networks of our lives; their partial destruction would have a negative effect on security, economy and public health. With time, the definition of CI has been extended to include other services. The concept of "lifeline system" was developed to evaluate large and geographically distributed networks, such as electric power, gas and liquid fuels, telecommunications, transportation, waste disposal and water supply. Thinking about CIs through the subset of lifelines helps clarify common

Impact assessment of anomaly propagation in a naval water distribution cyber-physical system

“…These modelling approaches integrate only to a certain degree part of the CPS specifications and application domains. Otherwise, graph theory abstraction was used to model anomaly propagation, matching critical infrastructures interactions and interdependencies, based on mixed holistic reductionism [12], which is not adapted to CPS. Our work intends to further unify the CPS cyber space and physical world, with the perspective of a generic and comprehensive methodology [13], to cover the design, development, verification, and real-time analysis of CPS.…”

A systematic review of cyber-resilience assessment frameworks

“…Univ Roma,IT [96]; Univ Plymouth,UK [40]; Deakin Univ,AU & Univ Kentucky,US [41]; Chinese Acad Sci,CN [42]; Univ Roma,IT & Univ Coimbra,IT & Israel Elect Corp Ltd, IL [115]; UNIST,KR [43]; Air Force Inst Tech,US & Appl Res Solut,US & LGS Innovat,US [121]; DoD Nat Def Univ,US [88] Economic Evaluation Univ Virginia,US [9] Satisfiability Module theory Univ North Carolina,US [59] Tallin Manual Korea Univ,KR [102] Vulnerability Management Univ Luxembourg,LU & Itrust Consulting,LU & Roma Tre Univ,IT & CRAT,IT & Univ Coimbra,IT & Leonardo SpA,IT [58] Continued on next page Bayesian Max. Likelihood Est.…”

ELEGANT: Security of Critical Infrastructures With Digital Twins

“…In light of the above, security monitoring solutions, along with other mechanisms for preventive and reactive purposes, play a key role in the protection of physical infrastructures and processes. But securing ICS is not an easy task, for reasons such as the substantial differences between these systems and their IT counterparts [2], their increasing complexity, or the considerable amount of legacy technologies still in use, further aggravated by the fact that deploying security mechanisms or migrating away from obsolete technologies often cannot be performed without disruption of service or prohibitive costs.…”