Quantitatively Assessing and Visualising Industrial System Attack Surfaces

More documents

Recommendations

Info

CONTENTS CONTENTS 3.4.2 Exploits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 3.4.3 Powerlink product name ambiguity . . . . . . . . . . . . . . . . . . 36 3.4.4 Reverse DNS .arpa addresses . . . . . . . . . . . . . . . . . . . . . 36 4 Industry Feedback Sessions 40 4.1 Judith Rossebo and Kai Hansen . . . . . . . . . . . . . . . . . . . . . . . . 40 4.2 Joshua Pennell . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 4.3 Colin Cassidy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 4.4 Sean McBride . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 5 Conclusion 44 5.1 Potential uses and mitigations . . . . . . . . . . . . . . . . . . . . . . . . . 44 5.1.1 Use as an audit tool . . . . . . . . . . . . . . . . . . . . . . . . . . 44 5.1.2 Recommended counter-measures . . . . . . . . . . . . . . . . . . . . 44 5.2 Extensions and improvements . . . . . . . . . . . . . . . . . . . . . . . . . 45 5.2.1 Crowdsource more banners . . . . . . . . . . . . . . . . . . . . . . . 45 5.2.2 Track down a subset of companies . . . . . . . . . . . . . . . . . . . 46 5.2.3 Active geolocation attacks . . . . . . . . . . . . . . . . . . . . . . . 46 5.2.4 Scan more ports and use more machines . . . . . . . . . . . . . . . 46 5.2.5 Realtime stream processing . . . . . . . . . . . . . . . . . . . . . . 47 5.2.6 Machine fingerprinting techniques . . . . . . . . . . . . . . . . . . . 47 5.2.7 Banner classifier . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 5.2.8 Trending . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 5.3 Criticality is dependent on context . . . . . . . . . . . . . . . . . . . . . . 49 5.4 Contributions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 5.5 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 Bibliography 53 6
List of Figures 2.1 Example exposure time-map with red marking systems with known exploits 28 2.2 Node information within visualisation . . . . . . . . . . . . . . . . . . . . . 28 2.3 Vulnerable node information within visualisation . . . . . . . . . . . . . . . 29 3.1 Breakdown of HTTP response types . . . . . . . . . . . . . . . . . . . . . . 34 3.2 Screenshot of unauthenticated whitelisting . . . . . . . . . . . . . . . . . . 34 3.3 Default user names and passwords available in help files . . . . . . . . . . . 35 5.1 Number of connections per week . . . . . . . . . . . . . . . . . . . . . . . . 48
Page 1 and 2: Quantitatively Assessing and Visual
Page 3 and 4: Quantitatively Assessing and Visual
Page 5: Contents 1 Introduction 9 1.1 Goals
Page 9 and 10: Chapter 1 Introduction Security of
Page 11 and 12: CHAPTER 1. INTRODUCTION 11 1. Slamm
Page 13 and 14: CHAPTER 1. INTRODUCTION 13 This par
Page 15 and 16: CHAPTER 1. INTRODUCTION 15 Stuxnet
Page 17 and 18: Chapter 2 Methodology In this chapt
Page 19 and 20: CHAPTER 2. METHODOLOGY 19 4. Combin
Page 21 and 22: CHAPTER 2. METHODOLOGY 21 2. SCADA
Page 23 and 24: CHAPTER 2. METHODOLOGY 23 A banner
Page 25 and 26: CHAPTER 2. METHODOLOGY 25 Of course
Page 27 and 28: CHAPTER 2. METHODOLOGY 27 but it do
Page 29 and 30: CHAPTER 2. METHODOLOGY 29 Figure 2.
Page 31 and 32: Chapter 3 Exploring the Dataset In
Page 33 and 34: CHAPTER 3. EXPLORING THE DATASET 33
Page 41 and 42: CHAPTER 4. INDUSTRY FEEDBACK SESSIO
Page 43 and 44: CHAPTER 4. INDUSTRY FEEDBACK SESSIO
Page 45 and 46: CHAPTER 5. CONCLUSION 45 systems vi
Page 47 and 48: CHAPTER 5. CONCLUSION 47 5.2.5 Real
Page 49 and 50: CHAPTER 5. CONCLUSION 49 5.3 Critic
Page 51 and 52: CHAPTER 5. CONCLUSION 51 Of academi
Page 53 and 54: Bibliography [1] Ross Anderson and

Quantitatively Assessing and Visualising Industrial System Attack Surfaces

Create successful ePaper yourself

Delete template?

Save as template?