Quantitatively Assessing and Visualising Industrial System Attack Surfaces

Chapter 1
Introduction
Security of industrial control systems (ICS) against online attacks has received consider-
able attention in the last decade. This attention and effort can be commonly interpreted
as securing a variety of systems against on-line sabotage: utilities like electricity, wa-
ter, and oil and gas. The term ICS may also refer to networks like those for maintaining
transport and communication; and industrial plants such as refineries and pharmaceutical
facilities. Some of the devices used in control systems don’t come with default authenti-
cation enabled, so ‘re-perimeterisation’ is the first step towards reducing their exposure.
The North American Electric Reliability Corporation (NERC), the electricity regulator in
the United States, Canada, and part of Mexico, has identified a set of standards for criti-
cal infrastructure protection called NERC-CIP, which mandate a strict electronic security
perimeter (as well as other organisational and technical security measures).
In this chapter we describe the high level goals of this project, and provide a history of
industrial system security and a brief overview of industrial security incidents. We also
describe the regulatory framework in the USA that our work aligns with, although the
techniques and project have relevance outside that regulatory framework as well.
1.1 Goals
The primary aim of this project is to debunk a popular folk myth of industrial control
systems (hereafter ICS); namely, that they are never connected to the internet.
This is a very pervasive story within the ICS community, but is not always backed up
by evidence. Individual counter-examples spring up often enough to warrant further
investigation, and we set out to provide a larger body of such counter-examples than
previously acknowledged. It is intended that other researchers will add to the set of
counter-examples, and that this may become an open source data set for academic research
of ICS.
9