Abstract:Industrial Control Systems (ICSs) are widely used in critical infrastructures that face various cyberattacks causing physical damage. With the increasing integration of the ICSs and information technology (IT), ensuring the security of ICSs is of paramount importance. In an ICS, cyberattacks exploit vulnerabilities to compromise sensors and controllers, aiming to cause physical damage. Maliciously accessing different components poses varying risks, highlighting the importance of identifying high-risk cyberattacks. This aids in designing effective detection schemes and mitigation strategies. This paper proposes an optimization-based cyber-risk assessment framework that integrates cyber and physical systems of ICSs. The framework models cyberattacks with varying expertise and knowledge by 1) maximizing physical impact in terms of failure time of the physical system, 2) quickly accessing the sensors and controllers in the cyber system while exploiting limited vulnerabilities, 3) avoiding detection in the physical system, and 4) complying with the cyber and physical restrictions. These objectives enable us to jointly model the interactions between the cyber and physical systems and study the critical cyberattacks that cause the highest impact on the physical system under certain resource constraints. Our framework serves as a tool to understand the vulnerabilities of an ICS with a holistic consideration of cyber and physical systems and their interactions and assess the risk of existing detection schemes by generating the worst-case attack strategies. We illustrate and verify the effectiveness of our proposed method in a numerical and a case study. The results show that a worst-case strategic attacker causes almost 19% further acceleration in the failure time of the physical system while remaining undetected compared to a random attacker.

The industrial control system cyber defence triage process

Insights on Cooperative Defense for Multiple Industrial Security Technologies

Industrial Control Systems Security Validation Based on MITRE Adversarial Tactics, Techniques, and Common Knowledge Framework

Understanding Indicators of Compromise against Cyber-Attacks in Industrial Control Systems: A Security Perspective

Cybersafety: A System-theoretic Approach to Identify Cyber-vulnerabilities & Mitigation Requirements in Industrial Control Systems

An Integrated Cyber-Physical Risk Assessment Framework for Worst-Case Attacks in Industrial Control Systems

A virtual testbed for security management of industrial control systems

ICSrange: A Simulation-based Cyber Range Platform for Industrial Control Systems

Securing Industrial Control Systems: Components, Cyber Threats, and Machine Learning-Driven Defense Strategies

Cybersecurity in industrial control systems: Issues, technologies, and challenges

Vulnerabilities and Attacks Against Industrial Control Systems and Critical Infrastructures

Looking back to look forward: Lessons learnt from cyber-attacks on Industrial Control Systems

Vulnerability Assessment of Industrial Control System with an Improved CVSS

An evaluation framework for industrial control system cyber incidents

DSACR: A defense-based system with adaptive cyber resilience for industrial control systems

Assessing Cyber-Physical Security in Industrial Control Systems

A Unified Architectural Approach for Cyberattack-Resilient Industrial Control Systems

Assessment of Cyber-Physical Intrusion Detection and Classification for Industrial Control Systems

Real-Time Intrusion Detection Based on Decision Fusion in Industrial Control Systems

A Survey on Industrial Control System Testbeds and Datasets for Security Research