Cyber Security Testing Research Articles

Paperless ship navigation: cyber security weaknesses

Maritime transportation is backbone of globalized trade and the manufacturing supply chain as nowadays more than four fifths of world merchandise trade by volume is carried by ships. Safe navigation of ships of today depends heavily on cyber-physical systems, of which the central is the Electronic Chart Display and Information System (ECDIS). The paperless ship navigation is allowed when the type approved ECDIS with official electronic navigation charts acts as an independent backup for the primary system. In this paper, we present an analysis of cyber security weaknesses of the paperless ship navigation that relies on two internetworked ECDIS workstations in the backup arrangement. The method of analysis is based on cyber security testing of the ECDIS workstations with an industry vulnerability scanner tool. The detected vulnerabilities are analysed in the context of ECDIS backup arrangement and safeguards implemented on board the paperless ship. The obtained results suggest that the critical cyber threat vectors result from uncontrolled internetworking of unmaintained ECDIS workstations with identical hardware and software configurations.

Report from Advanced Media Workflow Association (AMWA), Video Services Forum (VSF) and Joint Taskforce on Networked Media (JT-NM)

Since the last SMPTE Progress Report, the Joint Task Force on Networked Media (JT-NM) has released a report on cybersecurity testing. It has also published the JT-NM Tested catalogs connected with its Spring 2020 JT-NM Tested event.

Control System Cyber Security

Cyber security for Information Technology (IT)/Operational Technology (OT) is about the protection of Internet protocol (IP) networks from cyber attacks. Control system cyber security is about protecting physical processes from unintentional incidents and malicious attacks. Technologically, control system cyber security is different than IT cyber security because of the control system devices and their low‐level communication protocols. Yet IT and OT cyber security policy has been developed by the network security organization with minimal participation from the engineering organizations that “own” the hardware and control systems.Control system cyber security is real—there have been more than 1,250 actual incidents identified to date.1 But there currently is widespread lack of appropriate control system cyber forensics and cyber security training. With the availability of IT cyber security hardware, testing, and training, IT systems continue to be compromised, and control system cyber security is arguably 5‐10 years behind IT.In addition to the need to upgrade control system cyber security at the levels of individual organizations and critical infrastructures, this is a matter of national security import. It was widely reported that a large Chinese‐built electric transformer may have contained hardware backdoors, allowing access to transformer equipment control parameters. (Wall Street Journal, 2020). Attack vectors in the control system area resulted in Presidential Executive Order (EO) 13920 in May 2020.2Consequently, this paper advocates a paradigm shift to work around the current lack of a robust capability to secure control system networks. In order to address the limitations in securing control legacy and “next generation” control systems and networks, new approaches for improving control system cyber security and the ability to widely deploy them are needed.

Software Testing for cyber Security

Software testing plays a vital role in software security because hackers attack on a system through back channels which they can easily find if there is any error or bug exists in the software. The software security failure can cause the unbearable loss for IT companies and other organizations. Cyber security is another big issue for computer users' personal data as all their information is vulnerable because of easy excess, visibility and availability. Therefore, software testing is also useful to secure the personal information. In this article, cyber security testing based on particle swam optimization algorithm (CST) is proposed for testing of software cyber security testing. CSTPSOA is a PSO base technique which is used to solve the complex multi-level problems and is also used for optimization. In the CST method PSO is used for the optimization of test cases for cyber security testing.

Shipboard ECDIS Cyber Security

The Electronic Chart Display and Information System (ECDIS) plays a central role in safe navigation of ships. The ECDIS is basically a software package running on a general operating system that could be comprised of the third-party components. This paper presents an analysis of cyber security weaknesses of a shipboard ECDIS raising from the ECDIS software’s third-party components. The analysis is based on the cyber security testing of the shipboard ECDIS using an industry vulnerability scanner. Detected vulnerabilities are analysed regarding the protection measures implemented on the ship. The results suggest that even the type approved ECDIS system with maintained ECDIS software and the underlying operating system could be vulnerable due to weaknesses in the ECDIS software’s third-party components.

Towards a Cyber Secure Shipboard Radar

This paper presents a comparative cyber security resilience estimation of shipboard radars that are implemented on two oil/chemical tankers certified as SOLAS ships. The estimated radars were chosen from the same manufacturer, but belonged to different generations. The estimation was conducted by means of ships' crew interviews and computational testing of the radars using a widely deployed vulnerability scanning software tool. The identified cyber threats were analysed qualitatively in order to gain a holistic understanding of cyber risks threatening shipboard radar systems. The results obtained experimentally indicate that potential cyber threats mainly relate to maintenance of the radars' underlying operating system, suggesting the need for regulatory standardisation of periodic cyber security testing of radar systems.

A Study on Cyber Security Threats in a Shipboard Integrated Navigational System

The integrated navigational system (INS) enhances the effectiveness and safety of ship navigation by providing multifunctional display on the basis of integration of at least two navigational functions, the voyage route monitoring with Electronic Chart Display and Information System (ECDIS) and collision avoidance with radar. The INS is essentially a software platform for fusion of data from the major ECDIS and radar systems with sensors for the additional navigation functions of route planning, status and data display, and alert management. This paper presents a study on cyber security resilience examination of a shipboard INS installed on a RoPax ship engaged in international trade. The study was based on a mixed-method approach, combining an interview of the ship’s navigational ranks and cyber security testing of the INS using an industry vulnerability scanner. The identified threats were analyzed qualitatively to study the source of cyber risks threatening the INS. The results obtained point out cyber threats related to weaknesses of the INS underlying operating system, suggesting a need for occasional preventive maintenance in addition to the regulatory compliance required.

Assessing ship cyber risks: a framework and case study of ECDIS security

The growing reliance of the shipping industry on information and communication technologies places a high premium on cyber risk management. The International Maritime Organization has imposed improvement of the approved safety management system of ships by incorporating the cyber risk management no later than the first annual verification of a shipping company’s document of compliance following 1 January 2021. In this paper, we present a framework for assessing cyber risks that affect safe operation of ships. The framework relies on an on-board survey to identify existing safeguards, cyber security testing to detect vulnerabilities and threats, and determination of the cyber risk level. The cyber security testing of the ship’s critical systems and assets, as the specific part of the framework, is introduced and studied. The cyber security testing method is based on computational vulnerability scanning and penetration testing techniques, which is aligned with the upcoming maritime standard IEC 63154. For a case study, the testing of a shipboard Electronic Chart Display and Information System cyber security was performed using an industry vulnerability scanning tool.

Methodology for P&C cyber security studies using real‐time digital simulation

With the smart grid development, advancements in deeply integrated information and communication technology (ICT) provide enhanced system awareness, effective decision-making support and high-performance protection and control (P&C) to improve operational reliably and stability of the modern power systems. To manage the risks relevant to the existing industrial P&C systems, it is of high necessity to develop a methodology of cyber security testing for industrial P&C systems. This methodology will be rolled out to continue to evaluate the risks for the next-generation industrial P&C systems when new ICTs are introduced e.g. IEC 61850. This study summarises the main purpose, scope of work of an innovation project in collaboration with National Grid. This on-going project is to develop such a methodology using the state-of-art real-time digital simulation to conduct hardware-in-the-loop testing.

Bridging Networks, Systems and Controls Frameworks for Cybersecurity Curricula & Standards Development

Applied Cybersecurity practices in the US private and public industry are transitioning to an overall focus on Cyber Risk Management. It is hence necessary to align IT-Cybersecurity professional association application standards and related educational curricula with emerging applications in practice. Current standards and educational curricula seem fragmented across Networks Protocols and Network Analysis Tools Frameworks, Systems and Networks Infrastructure Frameworks, and, Risk Management & Controls Policy Frameworks. This article develops an applied framework for aligning, integrating, and, streamlining standards and curricula across the above three levels to align them with needs of applied Risk Management practice. The Cyber Risk Management framework is developed with focus on VoIP networks which have been gaining central prominence across diverse industries such as global Banking and Finance over the past decade. Despite central role technologically and economically, sparse attention has been given to critical vulnerabilities described as the ‘weakest links’ in global Banking and Finance networks as evident from Cybersecurity and Penetration Testing. This article demonstrates the contribution of the proposed Cyber Risk Management framework in addressing such critical gaps in global Banking and Finance Cybersecurity and Information Assurance practices as an example while being extendable to multiple other industries such as Healthcare.

Cybersecurity for Allied Future Submarines

Cyber has become a supposedly cheap first-strike weapon of political choice by potential adversaries in a milieu placing insurgency, terrorism, international crime and state-based influences in close un-regulated proximity. The merging of electronic and cyber warfare means that not even submarines, however unconnected or firewalled they may be, are immune. The quantum attack surface of submarines is as much in their past, as they are in their designs today and their operations tomorrow: they must survive to be credible and ideally they should even be a contemporary offensive cyber deterrent. Such critical defensive systems require robust security systems engineering and cybersecurity test and evaluation to build and sustain their cyber-resilience. This paper uses Australia’s future submarine program [1]1 to outline key facets needed in a submarine program to achieve cyber resilience, including how to adapt U.S. Department of Defense (DoD) best practices to engineer, test and sustain cyber-resilient submarine systems. Strategies are needed that provision sovereign-owned and operated land-based test sites to design, build, demonstrate and sustain critical submarine systems. This work is most relevant to countries allied to the U.S. and importing submarine capabilities, such as within lesser European powers and also in the Indo-Pacific where both cyber warfare and submarines are proliferating.

Design of Hack-Resistant Diabetes Devices and Disclosure of Their Cyber Safety.

The focus of the medical device industry and regulatory bodies on cyber security parallels that in other industries, primarily on risk assessment and user education as well as the recognition and response to infiltration. However, transparency of the safety of marketed devices is lacking and developers are not embracing optimal design practices with new devices. Achieving cyber safe diabetes devices: To improve understanding of cyber safety by clinicians and patients, and inform decision making on use practices of medical devices requires disclosure by device manufacturers of the results of their cyber security testing. Furthermore, developers should immediately shift their design processes to deliver better cyber safety, exemplified by use of state of the art encryption, secure operating systems, and memory protections from malware.

Proposed CFTC cybersecurity testing rules for derivatives market infrastructure

Purpose To summarize and analyze the CFTC’s proposed enhanced cybersecurity testing rules for entities that run the core derivatives market infrastructure. Design/methodology/approach This article discusses the CFTC’s proposed rulemaking related to cybersecurity testing, including enhanced cybersecurity testing requirements and guidance on risk analysis and oversight programs, as well as industry commentary on such rulemaking. Findings This article finds that the CFTC’s recent proposed rulemaking has been met with approval generally by industry participants, and is part of a broader effort to protect against cybersecurity threats that may affect the functioning of financial markets. Originality/value Practical guidance from experienced futures and derivatives lawyers.

Security intelligence for industrial control systems

While there is a broad corpus of security intelligence technologies and solutions for IT (information technology) networks, only moderate experience and investment exists in applying security intelligence approaches to OT (operational technology) networks. OT networks have traditionally been isolated from IT networks, and therefore, security has been of minor concern. Given the trend toward interconnecting OT and IT networks for business reasons, and given the disclosure of highly sophisticated attacks against OT environments, OT network operators increasingly recognize the need to deploy security solutions that are widely known in IT also to OT. OT networks are running critical control processes. Configuration changes are avoided to reduce the risk of misconfiguration or unforeseeable side effects detrimental to the network's operation. Therefore, passive non-intrusive security technologies are favored. Consequently, security intelligence applied to passively collected network data is the most acceptable technology to be deployed in OT networks. In this paper, we show how IT-specific security intelligence techniques can be applied to passively collected OT network data. The techniques have been developed for protecting SCADA (Supervisory Control and Data Acquisition) systems and have been validated in an industrial cyber security testing laboratory.

Cyber security testing and intrusion detection for synchrophasor systems

Synchrophasor systems are an emerging technology. Prior to installation of a synchrophasor system a set of cyber security requirements must be developed, new devices must undergo vulnerability testing, and proper security controls must be designed to protect the synchrophasor system from unauthorised access. This paper describes the process taken to develop a set of cyber security requirements for an American Recovery and Reinvestment Act (ARRA) funded synchrophasor project. The paper further describes vulnerability analysis and testing performed on synchrophasor system components. Finally, the paper describes intrusion detection rules written as a response to vulnerabilities discovered in the vulnerability analysis and testing process.