Taxonomy of attacks on industrial control protocols

Industrial control systems (ICS) are highly distributed information systems used to control and monitor critical infrastructures such as nuclear plants, power generation and distribution plants, Oil and Gas and many other facilities. The main architecture principles of ICS are; real time response, high availability and reliability. For these specific purposes, several protocols has been designed to ensure the control and supervision operations. Modbus and DNP3 are the most used protocols in the ICS world due to their compliance with real time needs. With the increasing of the connectivity to the internet world for business reasons, ICS adopted Internet based technologies and most of communication protocols are redesigned to work over IP. This openness exposed the ICS components as well as communication protocols to cyber-attacks with a higher risk than attacks on traditional IT systems. In order to facilitate the risk assessment of cyber-attacks on ICS protocols we propose a taxonomy model of different identified attacks on Modbus and DNP3.the model is based on the threat origin, threat type, attack type, attack scenario, vulnerability type and the impact of the attack. We populate this Taxonomy model with identified attacks on Modbus and DNP3 from previous academic and industrial works.

[1]  John D. Howard,et al.  An analysis of security incidents on the Internet 1989-1995 , 1998 .

[2]  Peter Kulchyski.  and , 2015 .

[3]  Siv Hilde Houmb,et al.  Estimating ToE Risk Level Using CVSS , 2009, 2009 International Conference on Availability, Reliability and Security.

[4]  Kymie M. C. Tan,et al.  A defense-centric taxonomy based on attack manifestations , 2004, International Conference on Dependable Systems and Networks, 2004.

[5]  Sujeet Shenoi,et al.  A Taxonomy of Attacks on the DNP3 Protocol , 2009, Critical Infrastructure Protection.

[6]  D. L. Lough,et al.  A taxonomy of computer attacks with applications to wireless networks , 2001 .

[7]  S. Shankar Sastry,et al.  A Taxonomy of Cyber Attacks on SCADA Systems , 2011, 2011 International Conference on Internet of Things and 4th International Conference on Cyber, Physical and Social Computing.

[8]  Karen A. Scarfone,et al.  SP 800-82. Guide to Industrial Control Systems (ICS) Security: Supervisory Control and Data Acquisition (SCADA) systems, Distributed Control Systems (DCS), and other control system configurations such as Programmable Logic Controllers (PLC) , 2011 .

[9]  Sujeet Shenoi,et al.  Attack taxonomies for the Modbus protocols , 2008, Int. J. Crit. Infrastructure Prot..

[10]  V.K. Wei,et al.  A taxonomy for attacks on mobile agent , 2001, EUROCON'2001. International Conference on Trends in Communications. Technical Program, Proceedings (Cat. No.01EX439).

[11]  Adronis Niyonkuru,et al.  Security in Embedded Systems: Design Challenges , 2011 .

[12]  Himanshu Khurana,et al.  Towards A Taxonomy Of Attacks Against Energy Control Systems , 2008, Critical Infrastructure Protection.

[13]  Eric D. Knapp,et al.  Industrial Network Security: Securing Critical Infrastructure Networks for Smart Grid, SCADA, and Other Industrial Control Systems , 2011 .

[14]  L. Johnson,et al.  Minimum Security Requirements for Federal Information and Information Systems , 2006 .

[15]  Ray Hunt,et al.  A taxonomy of network and computer attacks , 2005, Comput. Secur..

[16]  Karen A. Scarfone,et al.  Guide to Industrial Control Systems (ICS) Security , 2015 .