Critical Infrastructure Cybersecurity Research Articles

A Novel IDS Securing Industrial Control System of Critical Infrastructure Using Deception Technology

The Industrial Control System (ICS) has become the key concept in the modern industrial world, enabling process monitoring and system control for general industrial systems and critical infrastructures. High-skilled hackers can invade an imperfect ICS by existing vulnerabilities without much effort. Conventional defenses (such as encryption and firewall) to keep invaders away are getting less and less effective when an attack is carried out by exploiting an array of particular vulnerabilities. Under this circumstance, a new-type intrusion detection system (IDS) based on deception strategy using honeypot technique is proposed, which is of dramatic effectiveness in protecting ICSs of critical infrastructures. In this honeypot-based model, we capture malicious Internet flows and system operations. We analyze the collected data before alerting and preventing the intrusion alike when it affects the system in the future. This paper deals with the model's concept, architecture, deployment, and what else can be achieved in the field of Critical Infrastructure Cybersecurity (CIC).

Who’s in charge and how does it work? US cybersecurity of critical infrastructure

ABSTRACT The protection of critical infrastructure (water, energy, food supply, healthcare etc.) from cyberattack has moved from a hypothetical concern to a very real one for the United States. Unfortunately, the cybersecurity for such infrastructure is provided by a multiplicity of organisations, inside and outside the US federal government. In this paper, the authors address how the US Department of Homeland Security and US Department of Defense have evolved to address the cyber critical infrastructure protection (CIP) mission and the issues that have emerged in doing so. Presented here is a description of critical infrastructure’s vulnerability to cyberattack, an assessment of relevant cybersecurity efforts by the US government, and consideration of the civilian–military issues involved in finding remedies to the problem of cybersecurity in critical infrastructure.

Analysis of the critical infrastructure cyber security policy

Analysis of the critical infrastructure cyber security policy

Analysis of the critical infrastructure cyber security policy

Analysis of the critical infrastructure cyber security policy

WAYS OF INCREASING THE RELIABILITY OF MESSAGE TRANSMISSION IN INFORMATION AND COMMUNICATION SYSTEMS USING ONE-WAY RADIO CHANNELS

Modern information and communication systems which use one-way radio channels have the main task to maximize the reliability and information transmission stealth. This task becomes more relevant in conditions of the radio-electronic warfare and growing of the cyber incidents with wireless vulnerabilities exploitation. This solution is useful for Internet of Things technologies with one-way interaction protocols and unmanned aerial vehicle control systems for organization and critical infrastructure cyber security support.The purpose of this work is the fading of possible ways for increasing of the message transmission reliability in the information and communication systems with one-way radio channels.The examples of digital modulation methods applications, interference-resistant coding which are used in modern information and communication technologies with one-way radio transmission are considered in the article. In the work were received results of digital modulation methods and interference-resistant coding analysis with minimum bit error rate criterion. The usage futures of combined random coding which is based on interference-resistant and stochastic coding combination were researched.Standard random bit generators were tested by the NIST Statistical Test Suite 2.1.2 application.This research results give us the possibility to increase the reliability of message transmission by way using binary phase-shift keying in combination with majority coding. In this case we should solve tasks to improve the phase estimation schemes of received signal and optimal choice of majority coding redundancy.In order to increase the reliability and information stealth of message transmission the using of combined random coding was proposed. At the same time, we recommend to use Blum-Blum-Shub random bit generator for the codebook creating. Blum-Blum-Shub random bit generator was chosen according to estimation results, obtained with the help of NIST Statistical Test Suite.

Don’t get stung, cover your ICS in honey: How do honeypots fit within industrial control system security

The advent of Industry 4.0 and smart manufacturing has led to an increased convergence of traditional manufacturing and production technologies with IP communications. Legacy Industrial Control System (ICS) devices, now interconnected via public networks, are exposed to a wide range of previously unconsidered threats, which must be considered to ensure the continued safe operation of industrial processes. This paper surveys the ICS honeypot deployments in the literature to date, provides an overview of ICS focused threat vectors, and studies how honeypots can be integrated within an organisations defensive strategy. We discuss relevant legislation, such as the UK Cyber Assessment Framework, the US NIST Framework for Improving Critical Infrastructure Cybersecurity, and associated industry-based standards and guidelines supporting operator compliance. This is used to frame a discussion on our survey of existing ICS honeypot implementations, and the role of honeypots in supporting regulatory objectives. We observe that many low-interaction honeypots are limited in their use. This is largely due to the increased knowledge attackers have on how real-world ICS devices are configured and operate vs the configurability of simulated honeypot systems. Furthermore, we find that environments with increased interaction provide more extensive capabilities and value, due to their inherent obfuscation delivered through the use of real-world systems. Based on these insights, we propose a novel framework towards the classification and implementation of ICS honeypots.

Legal and organizational provision of protection of the critical information infrastructure from cyberattacks

The article considers the legal and organizational aspects of ensuring the protection of the critical information infrastructure from cyberattacks. Attention is drawn to the positive experience of the United States in ensuring the resilience of the objects of critical infrastructure. The provisions of the new Cyber Security Strategy of Ukraine are analyzed, one of the priorities of which is to improve the regulatory framework for cyber security of critical information infrastructure. The shortcomings of the previous Cyber Security Strategy of Ukraine (2016) are noted. Contains a detailed analysis of legislation and initiatives on providing cybersecurity. General requirements for cyber protection of critical infrastructure objects are considered. Based on the analysis of the current legislation on cyber security of Ukraine, ways to improve the legal and organizational support for the protection of the critical information infrastructure from cyber attacks are proposed.

Bayesian games for the cybersecurity of nuclear power plants

Many modern critical infrastructures are cyber–physical systems that rely on the integration of physical processes and computational resources. While this integration enables advanced system diagnostics, monitoring, and control, it also exposes the physical process to cyber-threats. Critical infrastructures such as nuclear power plants may be targeted by a variety of threat agents, each with unique motivations, resources, and capabilities. A Bayesian game-theoretic approach is presented to secure critical infrastructure when the adversary’s characteristics are uncertain. In a Bayesian game, some players have incomplete information about the other players. Within the context of critical infrastructure cybersecurity, plant defenders have incomplete information about threat agents, and threat agents have incomplete information about plant defenders. A Bayesian game provides a quantitative method for security teams to identify optimal defense strategies.The Bayesian game-theoretic approach is demonstrated on the residual heat removal system of a boiling water reactor. Threat agents are modeled as types in the game using a threat agent library that defines each threat’s characteristics. Similarly, different types of defenders are modeled by considering consequences of importance to plant stakeholders. Using these type definitions, utility functions are defined for each player. Nash equilibria of the Stackelberg game and two simultaneous games are identified and discussed. Using this procedure, a security team at a nuclear power plant can select the optimal strategy to defend the plant from cyber-threats.

Cybersecurity post-COVID-19: Lessons learned and policy recommendations

This article looks at the impact of the novel coronavirus crisis and increased remote work on cybersecurity and the priorities for EU action. Actions should include improving the cybersecurity of businesses, critical infrastructure and users, and creating an EU cybersecurity industry. As more and more aspects of our lives happen online, we are becoming more vulnerable to malicious attacks. This was demonstrated in 2020 when cyber-attacks increasingly disrupted the work of hospitals, service providers, government services and businesses across the globe. The frequency and scale of the attacks created a sense of urgency to improve our cybersecurity resilience. This article argues that the EU should reap the benefits of cybersecurity by pursuing a more ambitious cybersecurity agenda and putting EU values at the core of its approach. It also calls for cybersecurity to be included in all EU pillars, including the EU industrial research and innovation policy, as well as in EU investment plans and diplomatic strategy.

Digital Transformation and Cybersecurity of Critical Infrastructures

Critical infrastructures are vital assets for public safety, economic welfare, and the national security of nations [...]

The Infodemic as a Threat to Cybersecurity

ABSTRACT The infodemic has become a means to facilitate the exploitation of weaknesses in digital networks and launch cyberattacks against vulnerable communities and vital services, highlighting a lack of cybersecurity in critical infrastructure. This paper will delve into the caveats of the cyber threats posed by the infodemic and what it means for the broader network of cybersecurity and the protection of human rights in cyberspace. It will also examine the damage sustained by vulnerable groups as a result of cyberattacks, particularly in light of COVID-19. The infodemic has created a situation where malicious cyber actors spread false information to manipulate human nature and deceive individuals, leaving them susceptible to devastating attacks that risk producing physical and financial harm. This has the effect of undermining human security, dignity and equity in cyberspace. The situation is further exacerbated by the lack of accountability that operates as a carte blanche for cybercriminals to continue with illicit operations against vulnerable persons.

Key competencies for critical infrastructure cyber-security: a systematic literature review

Purpose The purpose of this paper can be encapsulated in the following points: identify the research papers published on the topic: competencies and skills necessary for critical infrastructure (CI) cyber-security (CS) protection; determine main focus areas within the identified literature and evaluate the dependency or lack thereof between them: make recommendations for future research. Design/methodology/approach This study is based on a systematic literature review conducted to identify scientific papers discussing and evaluating competencies, skills and essential attributes needed by the CI workforce for CS and preparedness to attacks and incidents. Findings After a comparative analysis of the articles reviewed in this study, a variety of skills and competencies was found to be necessary for CS assurance in CIs. These skills have been grouped into four categories, namely, technical, managerial, implementation and soft skills. Nonetheless, there is still a lack of agreement on which skills are the most critical and further research should be conducted on the relation between specific soft skills and CS assurance. Research limitations/implications Investigation of which skills are required by industry for specific CS roles, by conducting interviews and sending questionnaire\surveys, would allow consolidating whether literature and industry requirements are equivalent. Practical implications Findings from this literature review suggest that more effort should be taken to conciliate current CS curricula in academia with the skills and competencies required for CS roles in the industry. Originality/value This study provides a previously lacking current mapping and review of literature discussing skills and competencies evidenced as critical for CS assurance for CI. The findings of this research are useful for the development of comprehensive solutions for CS awareness and training.

Modelling and simulation of artificial neural networks using software SIMBRAIN

This paper is considered to be a continuation of a previous publication devoted to tendencies in the applications of advanced technology solutions to strengthen the cybersecurity of critical infrastructure (Yearbook Telecommunications, vol. 6, 2019). The specificity of the research is related to tracing the evolution of artificial neural networks (ANN) from their establishment to their modelling and simulation. The theoretical framework involves a well-supported rationale by some practical examples of advanced methods of design and simulation of ANN using SIMBRAIN. These methods are applicable in Cognitive science and Robotics because of their contribution to scientific researches related to study of perceptions and behaviors, abilities of decision making, pattern recognition and morphological analysis and etc.

Critical Infrastructure Cybersecurity Challenges: IoT in Perspective

A technology platform that is gradually bridging the gap between object visibility and remote accessibility is the Internet of Things (IoT). Rapid deployment of this application can significantly transform the health, housing, and power (distribution and generation) sectors, etc. It has considerably changed the power sector regarding operations, services optimization, power distribution, asset management and aided in engaging customers to reduce energy consumption. Despite its societal opportunities and the benefits it presents, the power generation sector is bedeviled with many security challenges on the critical infrastructure. This review discusses the security challenges posed by IoT in power generation and critical infrastructure. To achieve this, the authors present the various IoT applications, particularly on the grid infrastructure, from an empirical literature perspective. The authors concluded by discussing how the various entities in the sector can overcome these security challenges to ensure an exemplary future IoT implementation on the power critical infrastructure value chain.

Digital Economy: Preconditions, Threats and Prospects

Digital economy is an economy based on digital computer technology. The current stage of civilization is characterized by the formation of a new information society technological structure, the basic innovations of which are infocommunication technologies (ICT), network market architecture, the information resources domination. Infocommunication nature of new technological way of life and digital economy determines the development of adequate digital reality of scientific and methodological support of the management system in infocommunications and related industries, and in general the national digital economy. Understanding the phenomenon of digital economy and information society is based on the analysis of human society and technological systems evolution. Although the impact of the digital economy on economic processes and relations is obvious, this issue is not yet sufficiently studied and needs detailed consideration. Modern realities are such that the dynamic development of information technology, the widespread complexity of business processes, as well as the accumulation of significant amounts of data leads to the objective emergence of such a concept as the digital economy. The digital type of economy affects all industries without exception, from retail to education, energy, and so on. The onslaught of the new digital economy on the position of the old industrial economy testifies to a natural, natural-historical and objectively inevitable process. Accumulation and renewal of knowledge is accelerating, a single global socio-planetary memory is being formed and, expanding, deepening, various types of intellectual property are intensively developing. However, the digitalization of economic and social activities has not only positive aspects. Information attacks on state and commercial structures of individual countries, theft of information, personal data are among the main problems in the transition to the information society. It is necessary to analyze in detail the world experience in cybersecurity of critical infrastructure. At present, there is a significant potential for the use of modern digital technologies in the activities of modern companies. The phenomenon of the digital economy leads to the transformation of information resources into the main source of added value, the emergence on this basis of opportunities to ensure the intensive nature of economic development based on low-cost technologies, including information management technologies. The countries of the post-Soviet space in the field of digital economy lagged behind the advanced countries. They have a paradoxical economic situation, namely: with an excess of outdated information flows, there is a hunger for information on the latest flows. To overcome the information gap, the governments of these countries are trying to close this gap through government regulation.

Nation-State Hacking: Uniting Policy and Code to Limit the Threat

This article examines nation-state hacking and analyzes some possible defenses against these attacks by combining policy and code level defense. The article examines some recent incidents of nation-state hacking and evaluates the actions taken by the attacker and the effected parties. This work focuses on a variety of nation-state hacking incidents and provides a critical perspective on how policy and code level controls could be combined to defend against these attacks. Nation-state hacking continues to be an important issue on the United States security agenda. Advanced nation-state hacking threats can adversely affect the day to day operations of a nation effectively crippling it with nearly complete anonymity. In 2013, the U.S. issued E.O. 13636, Improving Critical Infrastructure Cybersecurity. On December 1, 2016, President Obama unveiled the National Cybersecurity Plan to increase awareness of the threat that lack of appropriate cybersecurity controls presents.

Legal Support of Cybersecurity of Critical Information Infrastructure of Ukraine

The article presents a study of the theoretical and legal foundations of the legal support of cybersecurity of the critical information infrastructure of Ukraine based on the system approach methodology. The current legislation is considered, and the bylaws of Ukraine in the field of cybersecurity of critical information infrastructure are analyzed. It is noted that today in Ukraine, it is important to ensure effective management of regional information security systems and the smooth and efficient operation of information infrastructure, especially critical infrastructure. To achieve these results in practice, it is necessary to prioritize implementing such critical tasks as the development of human resources in cybersecurity and the development of the national field of information technology. It is substantiated that cybersecurity is required to improve legal, organizational, and technical mechanisms for regulating public relations that arise in the information sphere. It is concluded that cybersecurity of critical information infrastructure of Ukraine is possible by identifying objects of this structure, solving problems of cybersecurity of objects with a very long life cycle, developing methods of modernization of critical information infrastructure for each organization, technology and information structure, which are the objects of critical information infrastructure.

A dynamic simulation approach to support the evaluation of cyber risks and security investments in SMEs

The growing amount of cyberspace threats highlights the need to evaluate cybersecurity risks and to plan for effective investments. One internationally recognized document for cybersecurity risk management is the framework for Improving Critical Infrastructure Cybersecurity by the US National Institute of Standards and Technology (NIST). It provides guidelines, best practices and standards for cybersecurity risk management. Nevertheless, as other self-assessment frameworks, it produces a static view of an organization's cyber posture and does not capture the dynamics of organizational changes and cyberattacks. Moreover, the current situation sees small and medium enterprises (SMEs) in a critical position since they need to manage their cybersecurity while usually not being skilled or equipped enough to internalize this process. Therefore, there is a need for a practical and easily applicable model able to identify a cybersecurity risk profile and its dynamics. This study proposes a system dynamics methodology and tool (SMECRA - SME Cyber Risk Assessment) for supporting cybersecurity investment decisions for SMEs through the evaluation of cyber risk and previous investments. SMECRA addresses dynamic organizational complexity and can be used to assess cyber risks and related dynamics over time. Three case studies demonstrate its capability to assess a SME's cybersecurity status and to evaluate investments impacts on an organization's risk profile, raising cybersecurity awareness. This study is important for SMEs wishing to manage their own cybersecurity risk and for insurance companies in their economic evaluation of residual risks that SMEs wish to externalize.

Understanding the Challenge of Cybersecurity in Critical Infrastructure Sectors

Abstract The cybersecurity of critical infrastructures is an essential topic within national and international security as 16 critical infrastructure sectors touch various aspects of American society. Because the failure to provide adequate cybersecurity controls within the critical infrastructure sectors renders the country open to an attack that could have a debilitating effect on security, national public health, safety, and economic security, this matter is so vital that there is the Presidential Policy Directive (PPD) 21 Critical Infrastructure Security and Resilience advances a national policy to strengthen and maintain secure, functioning and resilient critical infrastructure. An organization identified as the Cybersecurity and Infrastructure Security Agency (CISA) at the Department of Homeland Security (DHS) has the mission to be the risk advisor for the United States (US). Other organizations, such as the National Security Agency (NSA), have approved a specific Knowledge Unit (KU) to address cybersecurity for critical infrastructures associated with doctoral-level granting programs. To address this challenge, it is necessary to identify threats better and defend against them while mitigating risks to an acceptable level. Only then can a nation build a more secure and resilient infrastructure for the future while defending against present-day bad actors as cyberwarfare, cyber espionage, and cybersecurity attacks are the modern-day threats that need to be addressed in planning, designing, implementation, and maintenance. Therefore, the researchers developed a case study reviewing threats against different sectors defined in the PPD.

Evaluating the Performance of NIST’s Framework Cybersecurity Controls Through a Constructivist Multicriteria Methodology

This paper aims to show how creating a risk plan can be solved with the help of the constructivist multicriteria method. A case study using Multicriteria Decision Aid Constructivist (MCDA-C) was applied, with cybersecurity framework’s controls as a reference. The study was conducted in a large Brazilian bank in Brazil. The relevance of this work is the need to show that the application of multicriteria methods can be applied in the context of information security, which recommends the use of such methods to assist in risk analysis. The methodology used in this study was both quantitative and qualitative, obtaining primary data through brainstorming with decision-makers and forms answered by experts. The secondary data were obtained through the Framework for Improving Critical Infrastructure Cybersecurity, created by NIST - the National Institute of Standards and Technology of the United States. The problem was structured according to the constructivist method, and the data collected were processed and calculated. The study concluded that the category of Security Continuous Monitoring controls stood out compared to other categories. It also shows the importance of applying the constructivist method for the management of cyber risks by unravelling a problem and providing a basis for decision making. Our work contributes to a better understanding of risk management, encouraging the adoption of the constructivist method as a form of risk management best practice.