Security Vulnerability Assessment Research Articles

A Literature Survey on System Security and Network Vulnerability Assessment

This abstract outlines a detailed study on improving network security through vulnerability assessment and penetration testing, using tools like Nessus, Nmap, Metasploit, on the Kali Linux OS. The methodology involves identifying vulnerabilities, conducting simulated attacks, and developing a bash script to address false positives from Nessus scans. The research aims to enhance network security, provide practical recommendations, and contribute to cybersecurity practices, with a focus on both internal and external network security. Keywords: Vulnerability Assessment, Pentest, Nessus, Metasploit, Kali Linux

Development of fragility models for process equipment affected by physical security attacks

The vulnerability of chemical and process facilities toward physical security attacks depends on the equipment resistance against such attacks and on the performance of Physical Protection Systems (PPS) in place. To enhance the protection against intentional attacks, the development of quantitative vulnerability metrics is essential, nevertheless current standard approaches only offer qualitative or semi-quantitative evaluations. The aim of the present work is to develop a quantitative methodology for the assessment of chemical and process facilities vulnerability towards external acts of interference. The proposed methodology is based both on the evaluation of equipment structural integrity in response to different types of specific impact vectors characterizing intentional attacks and on the quantitative performance assessment of related PPS. In particular, specific fragility models were developed for impact vectors associated with improvised explosive devices, firearms, and incendiary weapons. The novel fragility models were implemented in a comprehensive security vulnerability assessment (SVA) based on Bayesian Networks, in which the contribution of PPS performance was also considered. A case study was defined and analyzed to exemplify the application of the proposed approach. The results obtained allowed for the identification of the most critical security-related escalation scenarios and thus for an improved quantitative SVA.

Use and influence of food and nutrition security vulnerability assessment and analysis reports in Zimbabwe

Background: Vulnerability assessment and analysis have gained increasing significance as they provide essential data to guide governments on food insecurity issues. Aims: This review was aimed at establishing the use and influence of food and nutrition security vulnerability assessment and analysis data and reports in Zimbabwe. Methods: A total of 18 databases and search engines were explored. The inclusion criteria were English articles published after 31 December 2016 to 15 February 2022. Results: A final list of 65 scientific publications and 32 grey literature documents was found from the literature search. From the academic publications citing the Zimbabwe Vulnerability Assessment Committee (ZimVAC) reports or products, the most popular thematic areas were food and nutrition security (36%, 24/67), climate change 18% (12/65), Nutrition 9% (6/65), Resilience 9% (6/65) and Livelihoods 9% (6/65). Regarding grey literature documents citing ZimVAC products, most were humanitarian response appeals by the United Nations Representative Office in Zimbabwe and the Government of Zimbabwe. In scientific literature there was use of ZimVAC information for both conceptual and symbolic purposes and in grey literature it was used mainly for instrumental and symbolic purposes. The results also revealed that several food and nutrition security programs in Zimbabwe have been informed by VAA information presented in the ZimVAC products. Conclusion: The findings in this paper show that VAA data and products are well-cited in both scientific and grey literature. However, as food and nutrition security appear to be the most important theme informed by ZimVAC data, ZimVAC needs to speak to a wider spectrum of policymakers and programmers by illuminating other themes, such as risk reduction and resilience. VAA tools must be adaptable and take into consideration topical issues such as pandemics with evidence generated for policy and programming in real-time. Keywords: Food security; livelihood assessment; vulnerability assessment; Zimbabwe

FSMx-Ultra: Finite State Machine Extraction From Gate-Level Netlist for Security Assessment

Numerous security vulnerability assessment techniques urge precise and fast finite state machines (FSMs) extraction from the design under evaluation. Sequential logic locking, watermark insertion, fault-injection assessment of a System-on-a-Chip (SoC) control flow, information leakage assessment, and reverse engineering at gate-level abstraction, to name a few, require precise FSM extraction from the synthesized netlist of the design. Unfortunately, no reliable solutions are currently available for fast and accurate extraction of FSMs from the highly unstructured gate-level netlist for effective security evaluation. The major challenge in developing such a solution is precise recognition of FSM state flip-flops in a netlist having a massive collection of flip-flops. In this paper, we propose FSMx-Ultra, a framework for extracting FSMs from extremely unstructured gate-level netlists. FSMx-Ultra utilizes state-of-the-art graph theory concepts and algorithms to distinguish FSM state registers from other registers and then constructs gate-level state transition graphs (STGs) for each identified FSM state register using automatic test pattern generation (ATPG) techniques. The results of our experiments on 14 open-source benchmark designs illustrate that FSMx-Ultra can recover all FSMs quickly and precisely from synthesized gate-level netlists of diverse complexity and size utilizing various state encoding schemes.

A collaborative management mechanism for UPIDs operation against MAD attacks

With the user-side heterogeneous power IoT devices (UPIDs) integrating into power systems, the cyber security of UPIDs brings a hidden danger to the power system due to their high-wattage terminals, and there is a new attack plan that can leverage such terminal botnets in order to manipulate the power demand, referred to as Manipulation of demand (MAD) attacks. To this end, a collaborative management mechanism for UPIDs operation is needed to mitigate the malicious impact of MAD attacks. Firstly, taking into account the vulnerability of the deployed cyber security defense measures, a cyber security vulnerability assessment method for UPIDs is proposed, which provides a criterion for the security control strategy. Besides, the security control strategy is constructed considering the security factors in the cyber domain and the physical domain, ensuring the reliability of power systems. The effectiveness of the proposed collaborative management mechanism is verified by simulations on a modified IEEE 14-bus system, highlighting the importance of the active defense scheme against MAD attacks.

A Cyber-Physical Power System Risk Assessment Model Against Cyberattacks

With the integration of cyber devices into power systems, such as information communication technology devices and intelligent electronic devices, there are currently a large number of software vulnerabilities (SVs) in cyber devices, which are probably used to obtain the authority of cyber devices for malicious attackers and be carried out subsequently severe attacks on power systems. Thus, it is inappropriate to only consider the power risks as the risk assessment for the system with the strong coupling between cyber systems and power systems. In this article, we investigate a dynamic risk assessment model for the cyber-physical power system (CPPS) against cyberattacks, combining the network security vulnerability of the supervisory control and data acquisition (SCADA) system in a substation and physical consequences in power systems caused by it under malicious control. By construction, a dynamic network security vulnerability assessment method for the SCADA system is well studied by considering SVs and deployed network security defense measures, which is also corrected by the propagation characteristics. Moreover, we estimate physical consequences by minimum shedding loads in N-1 contingencies caused by the SCADA system in a substation under malicious control. Finally, simulations on modified IEEE 14-bus and IEEE 118-bus systems verify the proposed model's effectiveness, highlighting the importance of network security in CPPS.

New hybrid method for vulnerability assessment in floodplain areas exposed to dam break

AbstractNatural and man‐made factors can cause dam failure, which constantly threatens downstream assets. Flood risk assessment is typically developed according to the hydraulic and geographic characteristics of floodplain regions. However, previous approaches have not considered asset values and the impacts of flooding on them, including threat probability and consequences. This report presents a new integrated hybrid model based on security vulnerability assessment and hydraulic analysis of floods and uses the source‐pathway‐receptor‐consequences (SPRC) approach to comprehensively examine all factors. A questionnaire survey was used for performing threat analysis and attractiveness analysis and determining the asset values and consequences. A geographical information system was applied to superimpose layers based on the SPRC approach in five different scenarios based on piping discharge and downstream flow in the case of a dam break. These scenarios were developed considering the basin water level. The results illustrate that residential areas have the highest vulnerability, and farmlands exhibit the lowest exposure to flooding caused by dam failure. Based on the attraction to terrorism, criticality due to consequences, and flooding characteristics, high‐risk zones were identified for implementing mitigation or protection countermeasures.

Robots Security Assessment and Analysis Using Open-Source Tools

The Internet of things (IoT) has revolutionized many aspects of the world, including industrial systems, automobiles, home automation, and surveillance, to name a few. IoT has offered a multitude of conveniences for our daily lives, such as being able to control our thermostats remotely, view our home surveillance cameras while away, or have a smart television that can surf the web. However, the widespread adoption of IoT devices combined with their vast device vulnerabilities results in significant security risks reinforcing the need for more robust default security controls and public awareness. As such, this paper aims to discover and document security vulnerabilities in the Asus Zenbo Junior IoT robot, along with providing a few best practices when securing smart home devices. This work presents an experiment using several security vulnerability assessment tools such as Nmap and OpenVAS scans to assess cybersecurity vulnerability currently present on Zenbo based on the 4P forensic investigative framework. The result of the experiment shows multiple open ports were discovered, along with miscellaneous information that an attacker could use to their advantage to attack the Zenbo robot. Based on the result, this work presents various security precautions that can help users protect against cyber-attack.

Identification of cyber-risks for the control and safety instrumented systems: a synergic framework for the process industry

Malicious interferences to Industrial Automation and Control Systems (IACS) such as the Basic Process Control System (BPCS) and the Safety Instrumented System (SIS) of chemical and process facilities may initiate events with severe consequences such as major accident scenarios (e.g., loss of containment of hazardous substances) and production outages. Existing security vulnerability and risk assessment (SVA/SRA) methodologies, as well as the cybersecurity risk assessment approach proposed by ISA/IEC 62443 series of standards, do not provide any practical method or guideline supporting cyber-risk identification. Moreover, an evident lack of procedures addressing the concrete connection between malicious manipulations of the BPCS and SIS and the impacts on the physical process system that can be initiated, is present in the scientific literature. Given the outlined gap, in the present study, a synergic framework of tools is described and applied to a case study (offshore Oil&Gas platform for gas compression), supporting the systematic identification of the risks that can originate as a result of a malicious interference to the BPCS and SIS. The framework consists of a past incident analysis (PIA) and of two rigorous methodologies, PHAROS, focused on major accident hazards, and POROS, addressing also operability issues. The concept of cyber-attack credibility is here introduced to identify the most credible sets of manipulations based on the score of the plant knowledge level required by the attacker and that of the cyber complexity of the attack pattern, allowing to provide valuable information on how to effectively allocate resources for a more secure network architecture.

TECHNICAL AUDIT OF SECURITY OF INFORMATION - TELECOMMUNICATION SYSTEMS OF ENTERPRISES

The content of the audit and vulnerability testing of the information and telecommunication system (ITS) of any enterprise is considered. Based on the results of the information security audit, the overall security of the company's ITS is assessed. It is proposed to assess the security of IT using penetration testing in the following areas: penetration testing from outside and inside the information infrastructure, social engineering testing of the company's personnel and testing for resistance to DDoS attacks; assessment of the security of the mobile application, web resource and wireless networks. The proposed general algorithm for IT infrastructure penetration testing (analysis of vulnerabilities and security of information resources) in the form of stages: initialization, passive and active intelligence, operation and post-exploitation, systematization and presentation of the results of security assessment, risk and vulnerability assessment, recommendations regarding them elimination. In stages all operations are carried out without causing real damage to the ITS. The purpose of a technical audit is shown, which covers the components of the ITS and can be considered as an independent examination or a procedure for their investigation in order to assess the condition and identify reserves. Technical audit as a result of checking the software and technical part of the resource provides an opportunity to form a list of key problems and get comprehensive recommendations for their elimination. It is noted that in accordance with modern requirements, technical audit can be used as an audit in the form of remote technical support, and information security audit can be considered as a variant of technical audit. Conducting an information security audit includes: analysis of risks associated with the possibility of information security threats to resources; assessment of the current level of ITS security; localization of "bottlenecks" in the ITS protection system; assessment of ITS compliance with existing standards in the field of security; providing recommendations on the implementation of new and improving the effectiveness of existing ITS security mechanisms. The content of the detailed report of the technical audit of the enterprise's ITS security has been revealed.

Roles and Challenges of AI-Based Cybersecurity: A Case Study

Nowadays, organizations face complex cyber-attacks that are difficult to counter with traditional protections. Therefore, many modern organizations tend to use AI-based cybersecurity systems to secure their assets and infrastructure and to reduce the level of potential risks.
 Because of the lack of clarity of the AI roles in cybersecurity and the ambiguity of the related challenges, this study aims to explore the most prominent roles of AI-based cybersecurity related to information security in the prevention phase, the detection phase and the response phase. The study also aims to determine the most prominent challenges facing AI-based cybersecurity.
 To achieve the goals of this study, we adopt a case-study methodology that origins from the general framework which is information security and ends with the specific framework which is AI-based cybersecurity. After designing a matrix to analyze the case study, the study concludes nine important roles for AI-based cybersecurity distributed over the three phases. Three roles are in the prevention phase, which are automated assessment of security vulnerabilities, awareness and training and authentication. Two roles are in the detection phase; namely, detection of intrusion and security breaches and detection of spams and phishing and four rules are in the response stage, which are analyzing malware, automating routine tasks, deploying traps and topple attackers and isolating important assets.
 The study also identifies eight elements that represent the most prominent challenges facing AI-based cybersecurity: regulations and principles, trust, accountability, privacy, bias, training datasets, human resources and financial costs. In conclusion, the study presents a set of recommendations drawn from the results.

Projectile perforation models for the vulnerability assessment of atmospheric storage tanks

Chemical and process plants storing large quantities of hazardous materials (flammable and/or toxic) may be attractive targets of intentional malicious attacks threatening the life and health of workers and population, as well as the environment and the availability of critical infrastructures. Quantification of the vulnerability of industrial facilities against shooting attacks received scarce attention in the context of Security Vulnerability Assessment (SVA) or Security Risk Assessment (SRA) methodologies. Specific damage models for projectile impact on equipment items storing relevant quantities of hazardous materials are not available in the literature. The current study aims at filling this gap by reviewing a wide set of empirical and analytical perforation models and validating them against experimental data from ballistic experimental tests. According to specific statistical parameters, the most suitable perforation models were selected in order to be used in the definition of quantitative methods for the analysis of the shooting attacks to atmospheric storage equipment. The application of the selected models to the assessment of the vulnerability to perforation of steel atmospheric storage tanks showed important differences between handguns and rifles as regards the thickness that can be successfully perforated. The results allowed for the definition of inherent safety thresholds for the perforation thickness that can be used in the context of vulnerability assessment of critical assets within SVA/SRA.

Design of a Network Security Audit System Based on Log Data Mining

The purpose of network security auditing is to safeguard network and information security through the assessment of network security vulnerabilities. Data mining is mainly used to mine potential information from massive amounts of log data, which can provide both accurate and valuable auxiliary data for network security auditing and relevant information for monitoring and management of terminals in different network environments. Firstly, the theory of data mining technology is explained, secondly, some data mining algorithms applied to network security audit are discussed, and finally, the design difficulties and functions of the network security audit system based on data mining are studied, aiming to provide reference for securing network and identifying hidden risks.

Security Threat and Vulnerability Assessment and Measurement in Secure Software Development

Security is critical to the success of software, particularly in today's fast-paced, technology-driven environment. It ensures that data, code, and services maintain their CIA (Confidentiality, Integrity, and Availability). This is only possible if security is taken into account at all stages of the SDLC (Software Development Life Cycle). Various approaches to software quality have been developed, such as CMMI (Capability maturity model integration). However, there exists no explicit solution for incorporating security into all phases of SDLC. One of the major causes of pervasive vulnerabilities is a failure to prioritize security. Even the most proactive companies use the “patch and penetrate” strategy, in which security is accessed once the job is completed. Increased cost, time overrun, not integrating testing and input in SDLC, usage of third-party tools and components, and lack of knowledge are all reasons for not paying attention to the security angle during the SDLC, despite the fact that secure software development is essential for business continuity and survival in today's ICT world. There is a need to implement best practices in SDLC to address security at all levels. To fill this gap, we have provided a detailed overview of secure software development practices while taking care of project costs and deadlines. We proposed a secure SDLC framework based on the identified practices, which integrates the best security practices in various SDLC phases. A mathematical model is used to validate the proposed framework. A case study and findings show that the proposed system aids in the integration of security best practices into the overall SDLC, resulting in more secure applications.

Analysis of events involving the intentional release of hazardous substances from industrial facilities

Industrial infrastructures, in particular those where hazardous substances are stored or handled, may be the target of malicious acts aiming at the disruption of normal operations. In the present study a toolbox of complementary and synergic techniques (Correspondence Analysis (CA), Fishbone Diagrams, Cause-Consequence Chains, Adversary Sequence Diagram, Root Cause Analysis) was applied to the in-depth analysis of physical security- and cybersecurity-related events that affected the process industry. The unprecedented original set of information obtained provides novel insights concerning these events. Clear correlations among security threats, including cyber-threats, and specific industrial sectors, as well as among the final scenarios and the different security threats from which they originate were identified by CA. In particular, vandalism resulted strongly correlated with the transportation of hazardous substances, and theft of materials with oil and gas pipelines. When considering chemical and petrochemical sites, cyber-attacks and the use of improvised explosives resulted to be the most common attack modes performed by the threat actors. Personnel and vehicle gateways resulted key elements when designing the Physical Protection System (PPS) of a facility. Insiders having the permission to enter the site bypass such controls, and were responsible of several successful attacks. Overall, the results confirm the concreteness of security-related events in the process industry and provide an original structured and detailed insight on the attack patterns experienced to date. Moreover, the results and the data obtained provide a novel set of baseline information for the application of SVA (Security Vulnerability Assessment) or SRA (Security Risk Assessment) methodologies in facilities where hazardous substances are stored or processed.

Assessment of Information Security Vulnerabilities in Common Seismological Equipment

Abstract Modern seismic and Global Navigation Satellite Systems stations are nowadays equipped with Internet of Things devices that acquire, process, and transmit various geophysical parameters in near-real time. This technological advance has introduced a new threat paradigm for common seismological devices. Such threats can be assessed with standard information security methods and practices. This article aims to identify security weaknesses, describe weak security points and potential attacks on such environments, and anticipate the countermeasures needed. Real tests and attacks have been applied to demonstrate the lack of data encryption and user authentication processes, the risks posed by unencrypted communication protocols, unsafe practices regarding settings and passwords, and poor design implementations. All these factors may impact and possibly disrupt the daily operation of seismic observatories because they can lead to falsifying data, altering configurations, or producing malicious false alarms. These in turn may cause unnecessary public concern or distrust, financial losses, or even national security issues. For all these reasons, several countermeasures and solutions are also proposed and evaluated to address each of the identified vulnerabilities.

Addressing Web Application Security Issues and Vulnerabilities Assessment Pen Testing

The world relies heavily on the Internet, and every organization uses web applications extensively for information sharing, business purposes such as online sales, money transfer, etc., and Exchange services. Nowadays, providing security for web applications is the greatest challenge in the corporate world because web applications will be the main way for their daily business and if the web application is affected, then daily business and reputation will be affected. As many organizations have been using the web application service to share or store sensitive information about their clients and assets. So, Web Applications are inclined to security attacks and new security vulnerabilities have grown in the last two decades in a web application and have become an important target for attackers. So, it is very vital to secure a web application. The vulnerabilities in web applications will incur due to the security misconfigurations, programming mistakes, improper usage of security measures, etc. So, vulnerability assessment and pen testing will help to figure out the different vulnerabilities present in web applications. The websites are also using to deliver the critical services to its customers so it must run every time without any interception, to do this VAPT will play a crucial role. This paper reviews about vulnerability assessment and pretesting steps and types, website vulnerabilities like SQL Injection, Cross-Site scripting, file inclusion, cross-site request forgery, and broken authentication with types and remediations and also discuss how the effect of these vulnerabilities on a web application.

A Security Assessment Model for Electrical Power Grid SCADA System

Due to the wide application of SCADA systems in national critical infrastructure, their cyber security issues and vulnerabilities have been a primary concern; whereas, the impact and consequences of cyber-attacks to these systems have the potential to result in catastrophic consequences in the physical domain. Therefore, estimating possible attack impacts and identifying system vulnerabilities are major concern in SCADA management and operations. However, it is quite difficult to plan, execute and review vulnerability analysis in critical infrastructure systems as well as in industrial control systems (such as SCADA system) due to its complexity, large-scale and heterogeneity. Consequently, a consistent domain-specific conceptual model is required to establish a generic framework for cyber security analysis to examine and investigate security threats on cyber-physical systems, the role of the entities within the system as well as system operations. The main contribution of this work is to present a multi-facets model to support cyber security analysis practices such as penetration testing, vulnerability assessment and risk analysis. The proposed model presents a common insight among different SCADA configurations, implementations and the employed protocols to handle its complexity, heterogeneous and scale. To demonstrate the usability as a proof of concept and applicability of the proposed model, the paper also presents an example illustrating how the proposed model can be employed to carry out security vulnerability assessment.

New Attack Potential Measurement Method to Kaizen Event for Web Application Security Vulnerabilities

With recognition of the importance of web application security, there is a need for research on an action program for measurement and improvement of web application security. Therefore, the main purpose of this study was to formulate a Kaizen program suitable for measurement and improvement of web application security vulnerabilities. An improvement working procedure is introduced to implement the Kaizen program. Further, an augmented attack potential measurement method is proposed to measure the effectiveness of the formulated Kaizen program. The proposed new attack potential measurement method is considered to be an umbrella under which several novel techniques and methods are included, such as OWASP’s web application security vulnerabilities assessment method, ISO/IEC 18045 attack potential ratings method and fuzzy evaluation method. The numerical results of an example are presented to show that the augmented attack potential measurement method is not only comparable but also distinguishable. It is more reasonable and effective than that of the traditional method for measuring web application security improvement. Finally, conclusions are made and suggestions for future work are proposed. To cite this document: Kuo-Sui Lin, New Attack Potential Measurement Method to Kaizen Event for Web Application Security Vulnerabilities, International Journal of Electronic Commerce Studies, Vol.10, No.2, pp.89-112, 2019. Permanent link to this document: http://dx.doi.org/10.7903/ijecs.1536

Tackling uncertainty in security assessment of critical infrastructures: Dempster-Shafer Theory vs. Credal Sets Theory

Securing critical infrastructures is a complex task. Required information is usually scarce or inexistent, and experts’ judgments may be inaccurate and biased. In this paper, two methodologies dealing with data scarcity, imprecision, and uncertainty are presented: Evidential network and Credal network. Evidential network is a graphical technique based on Dempster-Shafer Theory to explicitly model the propagation of epistemic uncertainty among variables while Credal network is an extension of Bayesian network to deal with sets of probabilities, known as Credal sets, based on experts’ judgments. Both methodologies constitute robust frameworks to account for high degree of imprecision on data, producing informative results despite the low-informative input. In the present study, the power in expressing uncertainty of these two methodologies have been showed, and their differences have been described through their application to a case study of security vulnerability assessment. Results demonstrate the substantial equivalence of the two methodologies in prognostic analysis, thus, an approximate updating procedure of Evidential network through equivalent Credal network has been proposed, to overcome the lack of possibility to compute updating in the context of Dempster-Shafer Theory.