Who's attacking your industrial control systems?: Part 1

Abstract

The critical national infrastructure is increasingly reliant on modern industrial control systems (ICS) to ensure effective operation in meeting consumer demands. The impact of an ICS cyber-attack can potentially cause disruption to business operations and services, damage and destruction of equipment and injury to people. To provide an effective defence against an ICS cyber-attack, it is necessary to understand the tactics, tools and techniques used by digital attackers. This study looks at who is attacking ICS and how they are doing it by providing an emulated vulnerable IT and ICS environment. It is shown that attacks against unprotected or weakly protected ICS devices occur on a regular basis and originate from countries around the world, with particularly high volumes of attack originating in Eastern China and Western Europe. By exposing a broad attack surface, it is demonstrated that the routes to accessing and exploiting vulnerable ICS are many and varied.