Cybersecurity in Critical Infrastructure: Defending Against Nation-State Groups

Abstract

Cyber-attacks on critical infrastructure can be disastrous and undermine states' national security. Different groups execute these attacks for varying reasons; some may be state-sponsored, and their attack for geopolitical reasons or to achieve strategic national cyber objectives. Regardless of the nation-state actor, it is essential to identify the techniques used and defend critical infrastructure against these attacks. This study evaluated the attack methodology of five nation-state actors based on the MITRE ATT&CK ICS matrix and proposed a multi-layered defense architecture. A virtual organization with critical and enterprise infrastructure domains was created, and the proposed defense architecture and tooling were implemented there. Then, techniques of the nation-state adversaries were emulated against the infrastructure to evaluate the performance of the defense strategies. The results show that the multi-layered approach was sufficient to mitigate all the techniques of the nation-state actors.