Industrial Automation And Control Systems Research Articles

Intelligent Risk-Based Cybersecurity Protection for Industrial Systems Control—A Feasibility Study

Summary Intelligent automated industrial process control, enabled by IR 4.0 technology, requires increased system integration and connectedness. With such development comes a heightened risk of cyberattack for operational technology (OT) systems, including industrial control systems (ICS) and industrial automation and control systems (IACS), historically shielded from cyberspace. Cyberattacks on OT systems can also impact the physical world. The recent attack on the US Colonial Pipeline interrupted delivery of oil along the US West coast for several days, resulting in a declaration of a state of emergency, while the Ukraine power grid attacks interrupted electrical power supply in Kyiv, impacting thousands of consumers. In 2021, an Equinor-operated platform on the Norwegian Continental shelf was hit by malware. The incident had the potential to affect the drilling control system (DCS). For ICS, the concern is ensuring a safe process, as opposed to the more traditional concern with data protection for information technology (IT) system management. To ensure safe implementation of advanced industrial systems control, while avoiding unnecessary operational downtime, there is a need for cybersecurity solutions that account for risk for the whole cyberphysical system (CPS), including the ICS, the work environment, the product, and the physical surroundings. Diagnostic models and methods must therefore be developed that cover the functionality of the whole CPS. Further, to account for process dynamics and evolving cyberattack threats, adaptability is required with respect to both process state and new types of attacks. For this purpose, knowledge-based awareness monitoring combined with existing cyberattack detection tools for ICS, known as ICS intrusion detection systems (IDS), is proposed, providing an element of artificial intelligence. Results from studies in a DCS environment indicate that existing monitoring applications can be used to detect and discern between different types of cyberattacks on CPSs. This indicates feasibility with respect to monitoring the control and IT components of the ICS system for building risk-based cybersecurity decision support solutions. The key challenge and novelty of the proposed approach is to extend the capability of cybermonitoring in systems control to automated evaluation of process risk, including risk to the physical environment. Such capability will enable appropriate decision support with respect to both process risk and operational downtime.

Designing a high-fidelity testbed for 5G-based Industrial IoT

With the rise of the Industrial IoT (Internet of Things) and Industry 4.0 paradigms, many control and sensor systems used for IACS (Industrial Automation and Control Systems) have become more complex, due to the increasing number of interconnected field devices, sensors and actuators often being geographically spread across large areas. Supporting these increasingly sophisticated networked scenarios calls for the involvement of telecommunications and utility providers to better support Machine-to-Machine (M2M) communications and infrastructure orchestration, for which 5G technology is considered a perfect match. Nowadays, such 5G networks empower solutions both for consumer and for industrial IoT scenarios, providing the capacity and the means to seamlessly connect a massive number of gadgets and sensors, with diverse data rate requirements, low latency, and low power consumption. Part of this flexibility is also due to the nature of the 5G Service Architecture (SA), which is based on a microservice concept, dividing its core through multiple functions, allowing it to horizontally scale in a flexible way. Furthermore, the 3GPP specifications encompass specific support for verticals by means of slicing and 5G LANs, paving the way for a paradigm shift in terms of the relationship between service, telecom, and operational infrastructure tenants. However, such benefits come at the cost of extra complexity and, consequently, an increased vulnerability surface. This calls for further research focused on improving 5G infrastructure management, service integration and security, which cannot be safely undertaken in production environments, thus motivating the development of suitable 5G testbeds. This research work, which was developed in the scope of the POWER and Smart5Grid P2020 projects, addresses the creation of a high-fidelity environment for 5G-related research, which encompasses a gNodeB and 5G core, together with emulated User Elements (terminal devices) and IoT nodes (in this specific case, Programmable Logic Controllers), constituting a 5G Industrial IoT scenario designed for development and validation of new solutions, security research, or even advanced training purposes. The entire infrastructure is supported via container orchestration technology, providing enhanced scalability and resilience characteristics.

A forensics and compliance auditing framework for critical infrastructure protection

Contemporary societies are increasingly dependent on products and services provided by Critical Infrastructure (CI) such as power plants, energy distribution networks, transportation systems and manufacturing facilities. Due to their nature, size and complexity, such CIs are often supported by Industrial Automation and Control Systems (IACS), which are in charge of managing assets and controlling everyday operations.As these IACS become larger and more complex, encompassing a growing number of processes and interconnected monitoring and actuating devices, the attack surface of the underlying CIs increases. This situation calls for new strategies to improve Critical Infrastructure Protection (CIP) frameworks, based on evolved approaches for data analytics, able to gather insights from the CI.In this paper, we propose an Intrusion and Anomaly Detection System (IADS) framework that adopts forensics and compliance auditing capabilities at its core to improve CIP. Adopted forensics techniques help to address, for instance, post-incident analysis and investigation, while the support of continuous auditing processes simplifies compliance management and service quality assessment.More specifically, after discussing the rationale for such a framework, this paper presents a formal description of the proposed components and functions and discusses how the framework can be implemented using a cloud-native approach, to address both functional and non-functional requirements. An experimental analysis of the framework scalability is also provided.

Industrial Internet of Things Intrusion Detection Method Using Machine Learning and Optimization Techniques

The emergence of the Internet of Things (IoT) has witnessed immense growth globally with the use of various devices found in home, transportation, healthcare, and industry. The deployment and implementation of the IoT paradigm in industrial settings lead to the architectural changes of Industrial Automation and Control Systems (IACS) plus the countless connectivity of industrial systems. This resulted in what is referred to as the Industrial Internet of Things (IIoT), which removes the barrier of connecting IACS to isolated conventional ICT platforms. In recent times, the IoT has started hacking our personal lives and not only our world, thus creating a platform for impending IoT cyberattacks. The widespread use of the IoT has created a rich platform for possible IoT cyberattacks. Machine learning (ML) algorithms have been driven solutions to secure wireless communication in IIoT-based systems, and their use in solving various cybersecurity challenges. Therefore, this paper proposes a novel intrusion detection model based on the Particle Swarm Optimization (PSO) and Bat algorithm (BA) for feature selection, and the Random Forest (RF) classifier for the classification of malicious behaviors in IIoT-based network traffic. An IIoT-based cybersecurity dataset, WUSTL-IIOT-2021 Dataset, was used to evaluate the performance of the proposed model using accuracy, recall, precision, and F1-score. The results of the two feature selection were compared to identify the most promising one. The results were compared with other recent state-of-the-art ML and multiobjective algorithms, and the results showed better performance. The RF along with BA classifier had proved to be the best classifier.

Identification of cyber-risks for the control and safety instrumented systems: a synergic framework for the process industry

Malicious interferences to Industrial Automation and Control Systems (IACS) such as the Basic Process Control System (BPCS) and the Safety Instrumented System (SIS) of chemical and process facilities may initiate events with severe consequences such as major accident scenarios (e.g., loss of containment of hazardous substances) and production outages. Existing security vulnerability and risk assessment (SVA/SRA) methodologies, as well as the cybersecurity risk assessment approach proposed by ISA/IEC 62443 series of standards, do not provide any practical method or guideline supporting cyber-risk identification. Moreover, an evident lack of procedures addressing the concrete connection between malicious manipulations of the BPCS and SIS and the impacts on the physical process system that can be initiated, is present in the scientific literature. Given the outlined gap, in the present study, a synergic framework of tools is described and applied to a case study (offshore Oil&Gas platform for gas compression), supporting the systematic identification of the risks that can originate as a result of a malicious interference to the BPCS and SIS. The framework consists of a past incident analysis (PIA) and of two rigorous methodologies, PHAROS, focused on major accident hazards, and POROS, addressing also operability issues. The concept of cyber-attack credibility is here introduced to identify the most credible sets of manipulations based on the score of the plant knowledge level required by the attacker and that of the cyber complexity of the attack pattern, allowing to provide valuable information on how to effectively allocate resources for a more secure network architecture.

Assigning IACS cybersecurity responsibility conformant with the UK Network and Information Systems Regulations 2018

Industrial plants constituting a society’s critical infrastructure, for example electricity-generation and water-supply, contain industrial automation and control systems (IACS). IACS nowadays increasingly contain many digital-electronic components whose behaviour is software-controlled. Amongst engineered artifacts, software and thus software-controlled systems are particularly susceptible to functional weakness (‘bugs’ and ‘vulnerabilities’). Such weakness can be exploited by nefarious parties (‘hackers’) to disrupt the critical operation of the plant; a phenomenon called cyber-insecurity whose contrary, cybersecurity, refers to the resistance of the plant to such exploitation. The UK Network and Information Systems Regulations 2018 SI 2018 No. 506 (NIS Regulations) address the cybersecurity of systems within the critical infrastructure, establishing response and reporting requirements for cybersecurity incidents. In January 2022, Her Majesty’s Government issued a call for comments on enhancing the NIS Regulations, following a 2020 review. We derive here detailed organisational reporting and response requirements based on a computer-scientific understanding of the engineering issues, in an environment which includes a central vulnerability-reporting organisation (ICS-CERT, now part of US CISA (CISA, no date), or cyber security incident response team (CSIRT)) as required under the NIS Regulations. 
 Index words: IACS, ICS, cybersecurity, responsibility, safety, software, vulnerabilities, organisational responsibility, duties, mandate.

Effectiveness of Paired Next Generation Firewalls in Securing Industrial Automation and Control Systems: A Case Study

Industrial automation and control systems (IACS) are oftentimes the backbone of businesses and critical infrastructure (CI) around the world. They underpin control of nuclear plants, refineries, manufacturing and distribution systems. Today, organisations are routinely targeted by cyber-attackers. Cyberattacks have been increasing in frequency and sophistication. This is especially true of those attacks directed against high-profile operations such as petrochemical refineries. Attackers invest considerable time and money to study a target and probe inherent weaknesses, which they eventually attempt, and succeed in some cases, to exploit. Historically, industrial networks were kept separate from corporate networks. However, significant efficiency gains and demands for digital interconnectivity have driven a convergence between operational technology (OT) and information technology (IT) systems. The business of cybersecurity has been evolving dramatically, posing significant challenges to management teams, across all industries and business domains. Countries within the Caribbean, such as Trinidad and Tobago (T&T), are by no means an exception given their dependence on the energy sector and supporting IACSs. This paper examines the effectiveness of next generation firewalls (NGFWs) in their defense of Process Control Networks (PCNs) against malware. It focuses on the case of a process plant complex in T&T.

Intrusion and anomaly detection for the next-generation of industrial automation and control systems

The next-generation of Industrial Automation and Control Systems (IACS) and Supervisory Control and Data Acquisition (SCADA) systems pose numerous challenges in terms of cybersecurity monitoring. We have been witnessing the convergence of OT/IT networks, combined with massively distributed metering and control scenarios such as smart grids. Larger and geographically widespread attack surfaces, and inherently more data to analyse, will become the norm.Despite several advances in recent years, domain-specific security tools have been facing the challenges of trying to catch up with all the existing security flaws from the past, while also accounting for the specific needs of the next-generation of IACS. Moreover, the aggregation of multiple techniques and sources of information into a comprehensive approach has not been explored in depth. Such a holistic perspective is paramount since it enables a global and enhanced analysis enabled by the usage, combination and aggregation of the outputs from multiple sources and techniques.This paper starts by providing a review of the more recent anomaly detection techniques for SCADA systems, focused on both theoretical machine learning approaches and complete frameworks. Afterwards, it proposes a complete framework for an Intrusion and Anomaly Detection System (IADS) composed of specific detection probes, an event processing layer and a core anomaly detection component, amongst others. Finally, the paper presents an evaluation of the framework within a large-scale hybrid testbed, and a comparison of different anomaly detection scenarios based on various machine learning techniques.

Evolutionary Deep Belief Network for Cyber-Attack Detection in Industrial Automation and Control System

Industrial automation and control systems (IACS) are tremendously employing supervisory control and data acquisition (SCADA) network. However, their integration into IACS is vulnerable to various cyber-attacks. In this article, we first present population extremal optimization (PEO)-based deep belief network detection method (PEO-DBN) to detect the cyber-attacks of SCADA-based IACS. In PEO-DBN method, PEO algorithm is employed to determine the DBN's parameters, including number of hidden units and the size of mini-batch and learning rate, as there is no clear knowledge to set these parameters. Then, to enhance the performance of single method for cyber-attacks detection, the ensemble learning scheme is introduced for aggregation of the proposed PEO-DBN method, called EnPEO-DBN. The proposed detection methods are evaluated on gas pipeline system dataset and water storage tank system dataset from SCADA network traffic by comparing with some existing methods. Through performance analysis, simulation results show the superiority of PEO-DBN and EnPEO-DBN.

Security Issues and Software Updates Management in the Industrial Internet of Things (IIoT) Era.

New generation Industrial Automation and Control Systems (IACS) are providing advanced connectivity features, enabling new automation applications, services and business models in the Industrial Internet of Things (IIoT) era. Nevertheless, due to the extended attack surface and increasing number of cyber-attacks against industrial equipment, security concerns arise. Hence, these systems should provide enough protection and resiliency against cyber-attacks throughout their entire lifespan, which, in the case of industrial systems, may last several decades. A sound and complete management of security issues and software updates is fundamental to achieve such goal, since leading-edge security countermeasures implemented in the development phase may eventually become out-of-date. In this article, a review of the IEC 62443 industrial security standard concerning the security maintenance of IIoT systems and components is given, along with guidelines for the implementation of such processes. As concluded, the security issues and software updates management shall jointly be addressed by the asset owner, service providers and product suppliers. These security processes should also be compatible with the safety procedures established by safety standards.

A Novel Method to Prevent Misconfigurations of Industrial Automation and Control Systems

Configuration errors are among the dominant causes of system faults for the industrial automation and control systems (IACS). It is difficult to detect and correct such errors of IACS as there are various kinds of systems and devices with miscellaneous configuration specifications. In this article, we first propose a streaming algorithm to keep all the configuration changes in the limited memory space. When making a new configuration change, another novel streaming algorithm is proposed to search and return all the similar historical changes, which can be used to validate this new one. So far, we are the first to model the configuration changes of IACS as a data stream and apply the streaming similarity search in correcting configuration errors while overcoming the inherent unbounded-memory bottleneck. The theoretical correctness and complexity analyses are presented. Experiments with real and synthetic datasets confirm the theoretical analyses and demonstrate the effectiveness of the proposed method in preventing misconfigurations of IACS.

Co-Engineering Gap Analysis of ANSI/ISA‑62443‑3‑3

Nowadays, software and system development is a more complex process than ever was and it faces challenges, where security became one of the most crucial. Based upon co-engineering in the AQUAS project, complex standards covering development processes regarding safety, but performance and security are missing. In the paper, the representative standard for Industrial Automation and Control Systems (IACS) is selected for gap analysis, both as examples of issues in co-engineering in security and performance, and possibly for evolution and extension in security standards. For IACS, the ANSI/ISA 62443 defines procedures for implementing security requirements. Based upon co-engineering in the AQUAS project and experience from the real implementation of security by TrustPort practitioners of this domain, the paper introduces the 62443 standard gaps analysis with the goal to identify the missing part. Based on this analysis, the possible recommendations for extending 62443-3-3 are proposed.

CKMI: Comprehensive Key Management Infrastructure Design for Industrial Automation and Control Systems

Industrial Automation and Control Systems (IACS) are broadly utilized in critical infrastructures for monitoring and controlling the industrial processes remotely. The real-time transmissions in such systems provoke security breaches. Many security breaches have been reported impacting society severely. Hence, it is essential to achieve secure communication between the devices for creating a secure environment. For this to be effective, the keys used for secure communication must be protected against unauthorized disclosure, misuse, alteration or loss, which can be taken care of by a Key Management Infrastructure. In this paper, by considering the generic industrial automation network, a comprehensive key management infrastructure (CKMI) is designed for IACS. To design such an infrastructure, the proposed scheme employs ECDH, matrix method, and polynomial crypto mechanisms. The proposed design handles all the standard key management operations, viz. key generation, device registration, key establishment, key storage, device addition, key revocation, key update, key recovery, key archival, and key de-registration and destruction. The design supports secure communication between the same and different levels of IACS devices. The proposed design can be applied for major industrial automation networks to handle the key management operations. The performance analysis and implementation results highlight the benefits of the proposed design.

A Comprehensive Security Analysis of a SCADA Protocol: From OSINT to Mitigation

It is an established fact that the security of Industrial Automation and Control Systems (IACS) strongly depends on the robustness of the underlying supervisory control and data acquisition (SCADA) network protocols (among other factors). This becomes especially evident when considering the extent to which certain protocols, designed with poor or nonexistent security mechanisms, have led to a considerable number of past incident reports affecting critical infrastructures and essential services. Considering the current situation, it is rather obvious why the proper auditing and analysis of SCADA protocols are considered as key when it comes to design and/or protect IACS infrastructures. However, while the security of some protocols, such as Modbus or DNP3, has already been extensively analyzed, the same cannot be said for other protocols and technologies being used in the same domain that have not received the same amount of attention. In this paper, we provide a comprehensive security analysis of the PCOM SCADA protocol, including a dissection of PCOM, a demonstration of several attacks scenarios on PCOM-based systems, and also an analysis of possible mitigation strategies against these potential attacks. Moreover, this paper also describes a number of open-source tools that we developed for further analysis and research of PCOM security aspects, including a PCOM Wireshark dissector, a Nmap NSE PCOM scan, multiple Metasploit PCOM modules, a set of Snort PCOM rules, and several network traffic datasets containing multiple samples of different types of PCOM operations.

The industrial internet of things (IIoT): An analysis framework

Historically, Industrial Automation and Control Systems (IACS) were largely isolated from conventional digital networks such as enterprise ICT environments. Where connectivity was required, a zoned architecture was adopted, with firewalls and/or demilitarized zones used to protect the core control system components. The adoption and deployment of ‘Internet of Things’ (IoT) technologies is leading to architectural changes to IACS, including greater connectivity to industrial systems. This paper reviews what is meant by Industrial IoT (IIoT) and relationships to concepts such as cyber-physical systems and Industry 4.0. The paper develops a definition of IIoT and analyses related partial IoT taxonomies. It develops an analysis framework for IIoT that can be used to enumerate and characterise IIoT devices when studying system architectures and analysing security threats and vulnerabilities. The paper concludes by identifying some gaps in the literature.

Key management infrastructure design and novel techniques to establish secure communications in critical infrastructures

The industrial automation and control systems (IACS) play a vital role in critical infrastructures to optimise the processes and control the activities remotely. As the proliferation of deliberate security attacks on these systems is increasing, ensuring reliable operations of these systems with safety and security is prominent. The key management infrastructure (KMI) ensures the proper management of secret keys and cryptographic keying materials which are used to secure the system. From IACS perspective, this paper addresses the security issues, challenges and parameters that need to be considered for designing an effective KMI for IACS. Also, by considering the constraints and required key management features, an efficient KMI is proposed for supervisory control and data acquisition (SCADA) systems using the polynomial key establishment scheme. The objective of the proposed KMI for SCADA systems is to support broadcasting, multicasting, join and leave, key update and pairwise communications between the SCADA devices. Comparison of the proposed scheme with existing schemes is reported.

Key management infrastructure design and novel techniques to establish secure communications in critical infrastructures

The industrial automation and control systems (IACS) play a vital role in critical infrastructures to optimise the processes and control the activities remotely. As the proliferation of deliberate security attacks on these systems is increasing, ensuring reliable operations of these systems with safety and security is prominent. The key management infrastructure (KMI) ensures the proper management of secret keys and cryptographic keying materials which are used to secure the system. From IACS perspective, this paper addresses the security issues, challenges and parameters that need to be considered for designing an effective KMI for IACS. Also, by considering the constraints and required key management features, an efficient KMI is proposed for supervisory control and data acquisition (SCADA) systems using the polynomial key establishment scheme. The objective of the proposed KMI for SCADA systems is to support broadcasting, multicasting, join and leave, key update and pairwise communications between the SCADA devices. Comparison of the proposed scheme with existing schemes is reported.

Securing the industrial cyber space with IEC 62443

In a world of engineers working hard every day to make sure all of us can have light after the sun sets, clean drinking water and get safe transport to a hospital where they can get medical services, they automatically trust these heroes to ensure critical infrastructure services remain operational at all times. However, the world has been changing for several years now as cyber threats have entered the scene and discovered there are easy targets. The industrial automation and control systems (IACSs) in control of their critical infrastructure have been designed with operational assurance in mind, making sure they function with very high accuracy and availability according to specification. As such, they and the people involved with the IACS life cycle are inherently vulnerable to cyber threats as so little effort has been spent on misuse cases, which is basically what the cyber threat actors are exploiting, technology and people alike. To mitigate this, the IEC 62443 standard is emerging as a framework specifically designed to help industrial organisations grow to address the growing cyber threats to their assets.

Key Vulnerabilities of Industrial Automation and Control Systems and Actions to Prevent Cyber-Attacks

Until recently, Industrial Automation and Control Systems (IACS) were largely isolated from corporate systems by means of proprietary protocols, which facilitated their protection against cyber-attacks under the principle of security through obscurity. However, the widespread adoption of the new communication technologies, such as the Internet protocols and wireless communications has changed this scenario.
 
 During recent years there have been many evidences of cyber-attacks to IACS that exploit their vulnerabilities. Unfortunately, these attacks have increased significantly during the last five years, and we should be aware that only the tip of the iceberg comes to the public knowledge.
 
 The purpose of this article is twofold: (1) to raise awareness about the security vulnerabilities that most companies are facing at their IACS and (2) to set a starting point by proposing a roadmap that seeks to guide designers and programmers in the new and complex world of industrial cyber-security.

Analysis of Advanced Process Control Technology and Economic Assessment Improvement

Advanced Process Control (APC) is considered for investment after the Distributed Control System (DCS) and Historian System of Industrial Automation and Control Systems (IACS) had been implemented. The benefits of APC application can be observed by economic assessment (EA), however the EA technique is still behind the development of APC technology. We review the literature on APC and EA and highlight the potential future development.