Quantitatively Assessing and Visualising Industrial System Attack Surfaces

CHAPTER 1. INTRODUCTION 11
1. Slammer worm shuts down the Ohio Davis-Besse nuclear power station.
2. Digital infiltration and compromise of a Harrisburg Pennsylvania water utility net-
work.
3. A schoolboy switches trams from tracks and derails them in Lodz, Poland.
4. Insider attack on a sewage system in Maroochyshire, Australia.
5. CIA Agent Tom Donohue’s report of extortion attempts against utilities outside the
USA in 2008.
6. Stuxnet discovered and reverse engineered.
You will note that the motivations of these attackers range from an undirected worm,
to stealing computational time, revenge, extortion, and sabotage. In other words, pro-
gressing from accidental to profitable, and finally directed sabotage probably by a nation
state.
There is another case of interest which is not an industrial security incident, but is highly
relevant. The Aurora research [22] showed that generators could be caused to decouple
themselves and become inoperable due to remote commands.
Motivated by all of these factors the re-perimeterisation of these devices was identified as
a national priority in the USA (and other countries), and NERC CIP-5 [16] is trying to
accomplish this today. By re-perimeterisation, we mean creating an electronic security
perimeter using firewalls, and in combination with logical and physical network segre-
gation. In the long run these devices will need to function in the presence of hostile
network traffic, but in the short run they need to be brought inside the electronic security
perimeter.
Implementing authentication in all these devices is a complex supply chain problem that
might take ten years or more to resolve. This is simply because of the operational life
cycle of these devices, which can range from 2-20 years. Given such a scenario the right
approach is to start authenticating at the perimeter, until such a time as these devices are
functional in the hostile environment of the global internet, as well as the harsh physical
conditions many of them are built to withstand.
1.2.1 Incidents
This section is devoted to computer security incidents of industrial control systems. A brief
walk through industrial security incidents serves to motivate the work below, describes
the context in which industrial control system security operates, and show us a range of
motives and methods for compromise of these systems. It also serves to counter act the