Abstract:ICS environments are vital to the operation of critical infrastructure such as power grids, water treatment facilities, and manufacturing plants. However, these systems are vulnerable to cyber attacks due to their reliance on interconnected devices and networks, which could lead to catastrophic failures. Therefore, securing these systems from cyber threats becomes paramount. In this context, threat modeling plays an essential role. Despite the advances in threat modeling, the fundamental gap in the state-of-the art is the lack of a systematic methodology for identifying threats in ICS comprehensively. Most threat models in the literature (i) rely on expert knowledge, (ii) only include generic threats such as spoofing, tampering, etc., and (iii) these threats are not comprehensive enough for the systems in question. To overcome these limitations, we propose a novel evidence-based methodology to systematically identify threats based on existing CVE entries of components and their associated fundamental weaknesses in the form of CWE entries - namely, CVE-CWE pairs - and thereby generate a comprehensive threat list. Furthermore, we have implemented our methodology as a ready-to-use tool and have applied it to a typical SCADA system to demonstrate that our methodology is practical and applicable in real-world settings.
What problem does this paper attempt to address?
The problem that this paper attempts to solve is the lack of systematicness and comprehensiveness in threat - modeling methods in industrial control systems (ICS). Specifically:
1. **Limitations of existing threat models**:
- **Dependence on expert knowledge**: Most existing threat models rely on the knowledge of experts, which may lead to subjectivity and inconsistency in results.
- **Generalized threats**: Threat models in the existing literature mostly include only general threats (such as deception, tampering, etc.), and these threats are not sufficient to comprehensively cover the potential threats of specific systems.
- **Lack of comprehensiveness**: Due to the lack of systematic methods, existing threat models cannot comprehensively identify and cover all possible threats, resulting in key threats may be ignored or minor threats may be over - emphasized.
2. **Unique challenges in the ICS environment**:
- The ICS environment (such as power grids, water treatment facilities, and manufacturing plants) is crucial for the operation of critical infrastructure, but these systems are vulnerable to cyber - attacks because they rely on interconnected devices and networks.
- The attack surface increases significantly with the integration of IT and ICS systems, making these systems the main targets of cyber - threats.
To solve these problems, the author proposes a new evidence - based threat - modeling method, which systematically identifies threats in ICS by analyzing historical vulnerability information (CVE entries) and their associated underlying weaknesses (CWE entries). This method aims to provide a more comprehensive and specific list of threats, thereby improving the security of ICS.
### Specific problem description
- **How to systematically identify threats**: Existing threat - modeling methods lack systematicness and comprehensiveness in identifying threats, relying on expert knowledge and general threat classifications, and it is difficult to ensure that all potential threats are covered.
- **Improve the accuracy and comprehensiveness of threat identification**: A method that can automatically extract and analyze underlying weaknesses from historical vulnerability data is needed to generate a more detailed and accurate list of threats.
- **Cope with the complexity of the ICS environment**: ICS systems usually contain multiple components (such as PLC, SCADA, sensors, etc.), and each component may have unique vulnerabilities and weaknesses, so a method that can adapt to this complexity is required.
### Solution
The evidence - based threat - modeling method proposed by the author solves the above problems through the following steps:
1. **Define scope and assets**: Determine the system components to be analyzed, including hardware, software, and other components with historical CVE records.
2. **Threat identification**: Analyze historical CVE entries, obtain the underlying weaknesses (CWE entries) of each vulnerability, and eliminate duplicates to generate a unique list of weaknesses.
3. **Threat analysis and prioritization**: Prioritize threats according to the frequency of vulnerability occurrence, focusing on frequently occurring weaknesses.
4. **Threat mitigation**: Propose and plan countermeasures for identified risks, and use the mitigation techniques provided by CWE to repair weaknesses in the system.
5. **Verification and confirmation of mitigation measures**: Ensure the effective implementation of security measures, especially when applying threat - modeling in the system design stage or production environment.
In addition, the author has also developed an automated tool to help users easily apply this method and generate detailed threat reports, thereby improving the efficiency and accuracy of threat - modeling.