Abstract:The threat to Industrial Control Systems (ICS) from cyber attacks is widely acknowledged by governments and literature. Operators of ICS are looking to address these threats in an effective and cost-sensitive manner that does not expose their operations to additional risks through invasive testing. Whilst existing standards and guidelines offer comprehensive advice for reviewing the security of ICS infrastructure, resource and time limitations can lead to incomplete assessments or undesirably long countermeasure implementation schedules.In this paper we consider the problem of undertaking efficient cyber security risk assessments and implementing mitigations in large, established ICS operations for which a full security review cannot be implemented on a constrained timescale. The contribution is the Industrial Control System Cyber Defence Triage Process (ICS-CDTP). ICS-CDTP determines areas of priority where the impact of attacks is greatest, and where initial investment reduces the organisation's overall exposure swiftly. ICS-CDTP is designed to be a precursor to a wider, holistic review across the operation following established security management approaches. ICS-CDTP is a novel combination of the Diamond Model of Intrusion Analysis, the Mandiant Attack Lifecycle, and the CARVER Matrix, allowing for an effective triage of attack vectors and likely targets for a capable antagonist. ICS-CDTP identifies and focuses on key ICS processes and their exposure to cyber threats with the view to maintain critical operations. The article defines ICS-CDTP and exemplifies its application using a fictitious water treatment facility, and explains its evaluation as part of a large-scale serious game exercise.

TICS: Trusted Industry Control System Based on Hardware Security Module

Position Paper: On Using Trusted Execution Environment to Secure COTS Devices for Accessing Industrial Control Systems

Threat Assessment for Power Industrial Control System Based on Descriptive Vulnerability Text

Trusted Terminal Design of Distributed Environment

Insights on Cooperative Defense for Multiple Industrial Security Technologies

Integrated Trusted Protection Technologies for Industrial Control Systems

Survey on Application of Trusted Computing in Industrial Control Systems

A Security Scheme for Industrial Internet Platform Based on Trusted Computing Technology

Development of Security Protection Technologies for Industrial Control System

Industrial Control Systems Security Validation Based on MITRE Adversarial Tactics, Techniques, and Common Knowledge Framework

Towards Provable Security in Industrial Control Systems Via Dynamic Protocol Attestation

Attacks on Data-Driven Process Monitoring Systems: Subspace Transfer Networks

Construction of Integrated Protection System for Industrial Control System Based on Trusted Computing

Experimental Verification of Security Measures in Industrial Environments.

S3A: Secure System Simplex Architecture for Enhanced Security of Cyber-Physical Systems

Towards Low-Barrier Cybersecurity Research and Education for Industrial Control Systems

Leveraging Data Fitting and Trust Assessment to Improve the Security of Industrial Networks

Template for Preparation of Manuscripts for Tsinghua Science and Technology

The industrial control system cyber defence triage process

Research on Attack Mechanism of Network Intrusion in Industrial Control System

A virtual testbed for security management of industrial control systems