Quantitatively Assessing and Visualising Industrial System Attack Surfaces

Chapter 4
Industry Feedback Sessions
In this chapter responses to interactive demonstrations were given to people from various
functions in industry. This is to demonstrate the value of such visualisation and datasets
within those industries. An effort has been made to provide a diversity of roles and
companies to provide a realistic critical review. This is also important to validate the
approach of using Shodan and not interacting with field devices directly. The Rules of
engagement cited in Section 2.2 present a limitation many other security researchers would
find arbitrarily restrictive, but these interviews should serve to demonstrate the necessity
of such precautions in the ICS security domain.
In each of these cases, the visualisation tool was presented over a conference call. The
screen was shared, allowing the industry representatives to see the exposure surface visu-
alisation and ask questions. They could not interact with the visualisation directly, but
could request the researcher to go to a particular node and click on it to reveal further
information. As part of the discussion we tended to focus on a part of the world familiar
to the industry respondents, and sometimes they recognised particular infrastructure as
part of the demonstration. For example in Section 4.1 we discuss particular results from
Fornebu, Norway.
4.1 Judith Rossebo and Kai Hansen
Corporate Research and Department Manager - Automation Networks at ABB (respec-
tively)
“Possible uses of this exercise could be further extended by utilities to ac-
tually find out that none of their devices is accessible from outside – something
that NERC-CIP stipulates. There is a potential to build up a realistic picture
on how connected these devices are to the public network/the Internet.
40