Security Audit Research Articles

Integrating NIST and ISO Cybersecurity Audit and Risk Assessment Frameworks into Cameroonian Law

This paper reviews cybersecurity laws and regulations in Cameroon, focusing on cybersecurity and information security audits and risk assessments. The importance of cybersecurity risk assessment and the implementation of security controls to cure deficiencies noted during risk assessments or audits is a critical step in developing cybersecurity resilience. Cameroon's cybersecurity legal framework provides for audits but does not explicitly enumerate controls. Consequently, integrating relevant controls from the NIST frameworks and ISO Standards can improve the cybersecurity posture in Cameroon while waiting for a comprehensive revision of the legal framework. NIST and ISO are internationally recognized as best practices in information security systems and cybersecurity risk management. This paper highlights the lack of specific international law provisions addressing cybersecurity audits and risk assessments. Overall, the paper highlights the importance of continuous risk assessment and monitoring, implementation of security controls, and compliance with organizational policies, relevant laws and regulations to ensure the adequate protection of information systems. Finally, the paper underscores the importance of improving Cameroon's cybersecurity regulations by integrating provisions from NIST and ISO.

Role of ICT Risk Management on Insider Fraud Prevention in Commercial Banks in Nairobi County

Purpose: The main objective of the research was to investigate the role of ICT risk management on reduction of insider frauds in the Kenyan banks in Nairobi County. The research explored ICT risks management practices incorporated in the banking industry to mitigate and control insider fraud.
 Methodology: Explorative research design and inferential statistics were used. The unit of analysis was the ICT risk management professionals in all the commercial banks in Nairobi County. 42 commercial banks formed the population of the study. The unit of observation were the ICT security, audit and risk professionals mandated with implementing ICT risk management. The targeted number was at least one respondent from each bank from the three departments identified: internal audit, Information technology, and security managers. In total, the study targeted 42 respondents and a total 29 responses were received which formed 69% of the targeted population. Responses from the distributed questionnaires were analyzed using statical packages for social science (SPSS). The open-ended questions were listed, analysed and reported by descriptive narrative with such statistics as mean and standard deviation. The ANOVA test was used to test the results.
 Findings: The findings revealed that there is a positive but insignificant correlation between ICT risk assessment, ICT awareness, Information security implementation and a significant positive correlation between information security audits and Insider fraud prevention. This study recommends that ICT risk assessment; ICT risk awareness; information security audits; and information security policy are important for preventing insider fraud in commercial banks, but there is need to implement them in conjunction with other stringent measure to increase efficiency
 Unique Contribution to Theory, Practice and Policy: The findings give a theoretical basis for validating the effectiveness of ICT risk management practices in Banks in Nairobi County, this can be adopted by other counties in Kenya. For policy implementation, the study will be important to the central bank of Kenya and any other institution that regulates the banking sector in Kenya in reviewing the current ICT Risk management guidelines. The study shows the adoption of the selected ICT risk management practices by different banks and gives a measure of their effectiveness that ICT Security professionals can use. The study gives the banking sector ICT security professionals a perspective on how ICT risk management can help them improve their ability to curb insider fraud. The study adds to the pool of knowledge for to scholars and academicians.

Analyses on standards and regulations for connected and automated vehicles: Identifying the certifications roadmap

Protecting Connected and Automated Vehicle (CAV) from cyber attacks and data breaches is a major challenge facing the deployment of driverless vehicles. The CAV is a complex interconnected system consisting of sensors, Artificial Intelligence (AI) processors and external units to assure the automated driving without human interaction. Such complexity increases the attack surfaces and makes the CAV highly vulnerable to cyber assaults. It also entangles security audits and certifications procedures. Our work lays out a novel approach towards CAV’s certification focused on cybersecurity and data privacy aspects. Stipulated by the analysis on existing standards’ limitations, we propose a Standards Coverage Map (SCM) outlining the CAV’s entire ecosystem and linking organisational and technical aspects to the latest standards and regulations from the cyber perspective.

Model transformation and code generation using a secure business process model

Emerging daily, new devices and software-driven advancements pose challenges in software development, including errors, bugs, and evolving requirements. This leads to delays in delivery. Ensuring software security within the Software Development Life Cycle (SDLC) is crucial. To address this, the research focuses on incorporating security aspects early in the SDLC through model transformation. Platform-independent models with security attributes like Integrity, Privacy, Security Audit, non-repudiation, and authentication are generated. A template-based source code generator is utilized to create the structure of the source model. The Secure Business Process Model (SBPM) encompasses Unified Modeling Language (UML) artifacts, such as analysis level classes and sequence diagrams, enriched with security attributes derived from the activity model. Security requirements are linked to elements extracted from the source model, and structural codes with security-enabled members are produced. Automation in software development is inevitable, though not complete, as it plays a vital role in addressing these challenges and improving the security of software applications.

Evaluation of the extent and demanding roles of ethical hacking in cybersecurity

<p>A permitted effort to acquire unlawful connection to computing systems, programs, or information is referred to as ethical hacking. Software developers must check for flaws, compartment focus, define needs and objectives, and create a method that makes the most of their resources. The rationale for this kind of vulnerability evaluation has a direct impact on the overall assessment’s estimate. More specifically, it is known that technological gadgets are necessary to prevent computer criminals from breaking into web applications to control their operations and gain access to confidential knowledge for unintended objectives. This research study provides an analysis to determine the scope and challenging responsibilities of ethical hacking employed in cyber security. Network monitoring is a legitimate need in which authorized developers attempt to breach a company’s frameworks or arrangements for the convenience of the owners to uncover security flaws. It provides information on how organizations may use computer forensics, such as vulnerability assessments using open-source devices, to safeguard their program’s administrators and operations. Numerous tools have been explored for security auditing of the networks which involves Nmap, Nessus, Brutus, Acunetix, etc. As a result, safeguards were put in place to identify these flaws and protect sensitive data from cyber-attacks. Ethical hacking has a bright future for detecting system or application vulnerabilities effectively. Nevertheless, tools utilized in the cyber security field for network or computer application secrecy have some limits namely growing complexity, high cost, security measures restrictions, etc. Hence, there is a wide scope to build new cost-effective cyber secrecy tools for the enhanced secrecy of user data in real time.</p>

Information System Security Audit SIMKA(Sistem Informasi Kearsipan) at Badan Pendapatan Daerah Jawa Barat Kota Bandung III Using COBIT 5 Framework and Standard IS0/IEC 27002

One of the main problems for an agency or a company is the security of information systems. High security is needed to maintain the confidentiality and misuse of information within the organization. To improve the security of business operations and the quality of information technology resources, it is necessary to evaluate to op Badan Pendapatan Daerah Jawa Barat Kota Bandung III, namely SIMKA BAPENDA whose function is to collect data on PKB (pajak kendaraan bermotor) and BBNKB (bea balik nama kendaraan bermotor) which manage the data computerized. The purpose of this study is to carry out a security audit of SIMKA BAPENDA at the Badan Pendapatan Daerah Jawa Barat Kota Bandung III using the COBIT 5 framework and ISO/IEC 27002 to document audit findings of the information system audit of the Badan Pendapatan Daerah Jawa Barat Kota Bandung III to make a report on the audit results. Based on the results of research that has been done through interviews and questionnaires using framework and using the APO13 and DSS05 sub domains, the results show that the Capability Existing is at level 1 while Capability Level is level 3 so the Capability Gap is 2.

The influence of cyber security on financial fraud in the Nigerian banking industry

The study looked at Financial Institution in Nigeria for how cyber security affects financial fraud in Nigerian banks. The study focused on the following topics: the types of electronic frauds committed in the banking industry, the reasons why cyber fraud occurs in banks, the difficulties in preventing cyber fraud in banks, the impact of cyber fraud on Nigerian banks, and potential solutions for preventing cyber fraud in banks. The two hypotheses that the study is based on. Six Nigeria Banks made up the study's population, which used a survey research design. 557 bank employees were sampled using multistage sampling techniques. The bank staff's responses were gathered using a structured questionnaire, which was then, analyzed using the SPSS statistical package for social science version 27. Descriptive analysis was used to analyze the objectives, and multiple regression and Kendal Tau B were used to test the hypotheses. The study's findings indicated that computer viruses, hacking/cracking, phishing, pharming, and accounting fraud by bank employees were the main types of cyber fraud in the banking system. The causes of cybercrime in banks included a lack of line manager or senior manager oversight on deviations from existing electronic processes or controls, current business pressure to meet set targets, collusion between employees and outside parties, insufficient data encryption, the use of third-party services, and parodying. Similarly, the study's findings showed that the challenges impeding the effort to stop cyber fraud in Nigeria's banking system included a lack of standards and national central control, a lack of infrastructure, the internet's vulnerability, a lack of national functional databases, and inadequate awareness by bank customers. A security audit, antivirus and antimalware software, the use of multi-factor authentication, the use of biometrics, and automatic logout were found to be solutions to cybercrime in banks. The findings also showed that financial loss, decreased productivity, and vulnerability of banks' Information and Communication Technology (ICT) systems and networks were effects of cybercrime on banks in Nigeria. According to the study's findings, banks' cyberspace security cannot be overextended in Nigeria, so necessary precautions should be taken to reduce cybercrime in Nigeria Banks. The study recommended that Nigeria Banks implement stringent measures to monitor staff activities, particularly in the confidentiality of customer information, cyber security audit be performed by financial institution regularly, sensitization of bank customers, and Multi-factor authentication, biometrics and automatic log out, and strong firewall should be adopted by Nigeria Financial Institutions.

INFORMATION SYSTEM SECURITY AUDIT USING ISO/IEC 27002:2013 AT UNIVERSITY OF XXX

Information system security audit to find out how the current information system security process is implemented, whether it has been implemented in accordance with information security management system standards. The purpose of this study is to examine the suitability of the current information system security process with the ISO/IEC 27002:2013 security standard and to assess the level of capability and maturity of information system security at university of XXX. This audit research resulted in the finding that the information system security process at university of XXX is currently not in accordance with the ISO/IEC 27002:2013 security standard and is at level 2 (managed) with a capability level value of 1,96 and a maturity level of 2,34.

Similarity-based deduplication and secure auditing in IoT decentralized storage

Data storage is becoming more difficult due to the network technology’s rapid development, especially with the significant advancement in Internet of Things (IoT). To solve this problem, various cloud storage-based deduplication schemes have been extensively studied to alleviate the storage burden of local IoT devices. However, recent evidence has revealed the deficiencies of these centralized data management schemes related to poor adaptability and lack of resistance to the single point of failure. Most existing deduplication approaches only perform deduplication on the same data, lacking consideration of the IoT data similarity characteristics. Also, these approaches keep only one copy of all data stored on the cloud server, making them valid only if the cloud storage provider is fully trustable, and the applicability of the solution is significantly reduced. What is important, outsourcing storage takes away control of data from their owners, security audits thus should also be considered in secure data storage research. To tackle these issues, we propose a similarity-based deduplication and secure auditing in the IoT decentralized storage scheme. Specifically, our scheme utilizes a novel similarity-based deduplication method based on the multi-server storage model to achieve efficient space saving while protecting data security. Furthermore, the proposed scheme ensures the integrity and availability of data by introducing similarity-based proofs of data ownership and similarity-based data integrity auditing. On this basis, our scheme further adopts a similarity-based secure auditing mechanism to achieve decentralized public auditing without the third-party auditor, in which the audit results of outsourced data are shared on blockchain to avoid repetitive audit tasks. We verify the correctness and effectiveness of our proposed scheme through rigorous theoretical analysis and extensive experimental results.

Tracing The Timeline of Network Security From the 1950s To the Present (2023)

The field of network security has evolved significantly over the years, with new threats emerging and security measures adapting in response. Network security problems exist through all the layers of the computer network, and the network security objective is to maintain the confidentiality, authenticity, integrity, dependability, availability, and suitability of the network. The rapid development of computer network systems brings both great convenience and new security threats for users. Network security problems generally include network system security and data security. Specifically, it refers to the reliability of the network system, confidentiality, integrity, and availability of data information in the system. This paper aims to trace the timeline of network security in chronological order, starting from the early days of computing to the present day. The paper will explore the major milestones in the development of network security, including the emergence of viruses, the introduction of firewalls, and the rise of cybercrime. By examining the historical context of these developments, this paper will provide a deeper understanding of the evolution of network security and the challenges that continue to shape the field today. Ultimately, this paper will demonstrate how network security has become an essential component of modern computing, and how its evolution has helped shape the digital world we live in today. Index Terms — Access Control, Anti-Virus, Asymmetric Key, Authentication, Availability, Cipher, Clearance levels, Confidentiality, Data encryption, DevSecOps, Firewalls, Firmware, Hash Function, IDS, Integrity, Intrusion, NAT, Security, Security Audits, SOAR, Symmetric Key, VPN, XDR

Web Security Audit and Penetration Testing: Identifying Vulnerabilities and Strengthening Website Security

Abstract: This research paper presents a comprehensive analysis of the significance of web security audits and penetration testing in bolstering website security to combat the rising tide of cyber threats. In today's digital landscape, where cyber-attacks are becoming increasingly frequent and sophisticated, organizations must proactively assess vulnerabilities in their web applications and infrastructure. Through in-depth security audits and penetration testing, potential weaknesses can be identified and mitigated before they are exploited by malicious actors. This study explores various web security audit techniques, including vulnerability scanning and code review, and highlights the benefits of penetration testing, such as simulated attacks and vulnerability exploitation. It emphasizes the importance of regular security assessments and provides practical recommendations for establishing a robust web security framework. The findings underscore the critical role of web security audits and penetration testing in safeguarding websites, protecting sensitive data, and maintaining the credibility and trustworthiness of online platforms. This research paper contributes valuable insights for practitioners, researchers, and organizations aiming to enhance their web security posture in an ever-evolving threat landscape.

Security challenges in civil registration: safeguarding vital information in an evolving landscape

Civil registration is a fundamental process that captures vital events such as births, deaths, marriages, and divorces, enabling governments to create accurate demographic databases and deliver essential services to their citizens. However, in today's digital age, civil registration systems face numerous security challenges that jeopardize the integrity and confidentiality of vital information. This paper highlights some of the key security challenges encountered in civil registration systems and outlines potential strategies to address them. Firstly, the digitization of civil registration processes has opened new avenues for cyber threats. Malicious actors may attempt to compromise the security of databases, manipulate or steal vital records, or disrupt services through cyberattacks. Robust cybersecurity measures, including encryption, firewalls, intrusion detection systems, and regular security audits, are essential to safeguard sensitive data and ensure the continuity of civil registration operations. Secondly, the issue of identity theft poses a significant challenge to civil registration security. Fraudulent practices, such as the creation of fake identities or the alteration of existing records, can undermine the trustworthiness of the system and lead to the misallocation of resources. The implementation of identity verification mechanisms, such as biometrics or unique identifiers, can enhance the accuracy and integrity of civil registration data while reducing the risk of identity fraud. Thirdly, ensuring the privacy and confidentiality of individuals' personal information is critical in civil registration systems. With the increasing digitization and interconnectedness of data, there is a heightened risk of unauthorized access or data breaches. Strong data protection regulations, robust access controls, and encryption techniques can help mitigate these risks, fostering public trust and confidence in civil registration processes. Moreover, the challenge of inclusivity must be addressed to ensure the effectiveness and reliability of civil registration systems. Marginalized populations, including refugees, migrants, and those residing in remote areas, may face barriers in accessing civil registration services, leaving them vulnerable to identity-related challenges. Deploying mobile registration units, leveraging innovative technologies, and promoting community engagement are strategies that can improve inclusivity and extend the benefits of civil registration to all individuals.

Secure auditing and deduplication with efficient ownership management for cloud storage

More and more users opt to outsource their data to the cloud due to its popularity, which also brings some problems. One is that users cannot know whether the data stored in the cloud is intact since they no longer have physical control over it. The other is that the data stored in the cloud are often duplicated, which clearly wastes cloud storage resources. To solve the above problems, cloud auditing technology and secure deduplication technology have been widely studied. Furthermore, cloud auditing schemes supporting secure deduplication have also been proposed. However, data ownership management is rarely considered in these schemes. Once the data ownership changes, the revoked user should not be able to obtain the original ciphertext stored in the cloud to recover the original data. To solve this problem, we propose a cloud auditing scheme that supports cross-user secure deduplication with efficient data ownership management. We design a lazy update strategy to reduce update frequency and delegate the update task to the cloud, which greatly reduces the computing cost of ownership management. When the data ownership changes, the cloud does not need to update the original ciphertext immediately. It will decide whether to update the original ciphertext based on the value of a preset flag. Experimental results and the security analysis demonstrate the effectiveness and security of the proposed scheme.

Retracted: Design of a Network Security Audit System Based on Log Data Mining

Retracted: Design of a Network Security Audit System Based on Log Data Mining

Astraea: Anonymous and Secure Auditing Based on Private Smart Contracts for Donation Systems

Many regions are in urgent need of facial masks for slowing down the spread of COVID-19. To fight the pandemic, people are contributing masks through donation systems. Most existing systems are built on a centralized architecture which is prone to the single point of failure and lack of transparency. Blockchain-based solutions neglect fundamental privacy concerns ( <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">donation privacy</i> ) and security attacks ( <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">collusion attack, stealing attack</i> ). Moreover, current auditing solutions are not designed to achieve donation privacy, thus not appropriate in our context. In this work, we design a decentralized, anonymous, and secure auditing framework <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Astraea</i> based on private smart contracts for donation systems. Specifically, we integrate a Distribute Smart Contract (DiSC) with an SGX Enclave to distribute donations, prove the integrity of donation number (intention) and donation sum while preserving donation privacy. With DiSC, we design a Donation Smart Contract to refund deposits and defend against the stealing attack the collusion attack from malicious collector and transponder. We formally define and prove the privacy and security of Astraea by using security reduction. We build a prototype of Astraea to conduct extensive performance analysis. Experimental results demonstrate that Astraea is practically efficient in terms of both computation and communication.

DIGITAL TRANSFORMATION VULNERABILITIES: ASSESSING THE RISKS AND STRENGTHENING CYBER SECURITY

Digital transformation has revolutionized the way organizations operate, enabling them to leverage advanced technologies for increased efficiency and productivity. However, along with the benefits, digital transformation also brings new vulnerabilities and risks, particularly in the realm of cybersecurity. This abstract aims to provide an overview of the vulnerabilities associated with digital transformation and highlight the importance of assessing risks and strengthening cybersecurity measures to mitigate potential threats. The rapid adoption of cloud computing, Internet of Things devices, and interconnected systems has expanded the attack surface for cybercriminals. Organizations must recognize the potential vulnerabilities introduced by these technologies, such as data breaches, system failures, and unauthorized access. Understanding the specific risks associated with digital transformation is crucial for developing effective cybersecurity strategies. Assessing risks involves evaluating the organization’s digital infrastructure, identifying potential weak points, and determining the likelihood and potential impact of various threats. This process enables organizations to prioritize cybersecurity efforts and allocate resources effectively. It also involves evaluating the security measures in place, including firewalls, intrusion detection systems, encryption protocols, and employee training programs, to ensure they are up to date and resilient against emerging threats. Strengthening cybersecurity requires a multi-layered approach that encompasses technical measures, organizational policies, and a culture of security awareness. Implementing robust security controls, such as regular software updates, network segmentation, and access controls, helps fortify digital systems against attacks. Additionally, establishing incident response plans and conducting regular security audits aids in identifying vulnerabilities and responding swiftly to cyber incidents. Furthermore, fostering a culture of cybersecurity awareness among employees is essential. Educating staff on best practices, such as strong password management, phishing awareness, and safe browsing habits, empowers them to become the first line of defence against cyber threats.

Theory and practice in secure software development lifecycle: A comprehensive survey

Software development security refers to the practice of integrating security measures and considerations throughout the software development lifecycle to ensure the confidentiality, integrity, and availability of software systems. It involves identifying, mitigating, and eliminating security vulnerabilities and threats that could be exploited by attackers. The goal of this paper is to survey the various concepts and methodologies directed towards software security, and the identification of any missing gaps. Based on the findings, it is noted that the development of secure software requires a proactive and comprehensive approach. It begins with establishing secure design principles and incorporating security requirements from the initial stages of development. Here, secure coding practices, such as input validation, output encoding, and secure authentication and authorization mechanisms, are employed to prevent common security vulnerabilities. In addition, regular security testing, including penetration testing and vulnerability scanning, helps identify and address potential weaknesses in the software. Normally, code reviews and security audits are conducted to ensure adherence to secure coding practices and identify any security flaws. It is important that security training and awareness programs be provided to developers and other stakeholders to foster a security-conscious culture. To minimize potential vulnerabilities, secure configuration management, which involves properly configuring servers, networks, and dependencies may be utilized. On the other hand, regular updates and patching are essential to address known security vulnerabilities in software components. To guide their software development security practices, organizations may follow established security standards and frameworks such as ISO 27001 or NIST Cybersecurity Framework. By prioritizing software development security, organizations can protect sensitive data, prevent unauthorized access, and mitigate the risk of security breaches and incidents. In the long run, this helps build trust with users and stakeholders, enhances the reputation of the software, and reduces the potential impact of security incidents on the organization.

Audit Keamanan Sistem Informasi Manajemen Rumah Sakit Dengan Framework COBIT 2019 Pada RSUD Palembang BARI

This study examines the implementation of information system at RSUD Palembang BARI with the aim of enhancing information system security. In this context, a security audit is conducted using the COBIT 2019 framework. The COBIT 2019 domains and processes utilizing include EDM03, APO12, APO13, APO14, and DSS05. The research involves the identification and evaluation of information security risks, determination of necessary security controls, and ensuring compliance with the information security standards established by COBIT 2019. The findings indicate that the level of information system security at RSUD Palembang BARI is at level 3 (Defined), with a gap analysis difference of 1 level below the expected target. Based on the above results, efforts to improve and enhance the information system security at RSUD Palembang BARI are still needed. The use of information system security techniques such as vulnerability scanning, penetration testing, WAF, IDS and IPS, and data encryption, as well as improving security in terms of server physical aspects such as installing CCTV and restricting user access with access cards or fingerprints, can be implemented to ensure compliance with relevant information security standards. Consideration for obtaining security certifications, like ISO 27001, should also be taken. Additionally, the quality of human resources in terms of policy-making and the ability of employees to address threats and attacks on information system security should be improved through training and strengthening coordination among employees.&#x0D;

Exploring the Relationship Between Cybersecurity Culture and Cyber-Crime Prevention: A Systematic Review

Cybercrime requires a multidimensional approach addressing technical, organisational, and human factors to prevent cyber-attacks. This systematic review highlights the significance of a strong cybersecurity culture in mitigating the risks of cyberattacks and enhancing an organisation's resilience. Implementing training and awareness programmes, establishing leadership support and accountability mechanisms, and fostering employee engagement are strategies for promoting a strong cybersecurity culture. However, fostering a robust culture of cybersecurity can be challenging and requires the participation of various stakeholders. Training and awareness programmes can significantly improve employee cybersecurity knowledge and behaviour, and leadership support is essential for establishing a cybersecurity culture. It is possible to enforce employee compliance with cybersecurity policies and procedures through accountability mechanisms, such as consequences for noncompliance and periodic security audits. Involving employees in the creation of cybersecurity policies and procedures, as well as recognising and rewarding responsible behaviour, can increase employee engagement and investment in cybersecurity. Although technical measures such as firewalls and encryption are essential for defending against cyber-attacks, a strong cybersecurity culture is necessary to mitigate cybercrime risks and enhance an organisation's resilience. Future research should identify and evaluate effective strategies for cultivating a robust cybersecurity culture in the context of preventing cybercrime. Cybersecurity should be a top priority for businesses and individuals, who must take preventative measures against cyber-attacks. By fostering a robust culture of cybersecurity, businesses can increase their resilience and reduce the risks of cybercrime.

MOSTO: A toolkit to facilitate security auditing of ICS devices using Modbus/TCP

The integration of the Internet into industrial plants has connected Industrial Control Systems (ICS) worldwide, resulting in an increase in the number of attack surfaces and the exposure of software and devices not originally intended for networking. In addition, the heterogeneity and technical obsolescence of ICS architectures, legacy hardware, and outdated software pose significant challenges. Since these systems control essential infrastructure such as power grids, water treatment plants, and transportation networks, security is of the utmost importance. Unfortunately, current methods for evaluating the security of ICS are often ad-hoc and difficult to formalize into a systematic evaluation methodology with predictable results. In this paper, we propose a practical method supported by a concrete toolkit for performing penetration testing in an industrial setting. The primary focus is on the Modbus/TCP protocol as the field control protocol. Our approach relies on a toolkit, named MOSTO, which is licensed under GNU GPL and enables auditors to assess the security of existing industrial control settings without interfering with ICS workflows. Furthermore, we present a model-driven framework that combines formal methods, testing techniques, and simulation to (formally) test security properties in ICS networks.