Supervisory control and data acquisition (SCADA) systems have their own constrains and specifications. These systems control many of our critical industrial infrastructures, yet they are hardly secured. The biggest problem in securing these systems is the lack of cryptography support especially that most SCADA systems work in real-time which is not compatible with most cryptography algorithms. Additionally, a SCADA network may include a huge amount of embedded devices with little computational powers which adds to the cost of any security improvement. In this paper we present a new approach that would secure SCADA communications by coding information without the need of the complex cryptography algorithms. The reconfigurable information transmitter agent (RITA) protocol that we present does not need the already installed devices to be modified nor replaced, it only needs to add costless electrical chips to these devices. This approach can also be used to secure any type of communication that respects the protocol's constraints.
Update On The Cern. Computing And Network Infrastructure For Controls. (Cnic)...ESS BILBAO
This document summarizes the implementation of a security policy at CERN to protect its control systems from cyber threats. It discusses establishing separate network domains, centralized installation schemes for Linux and Windows systems, and user training. Authentication is based on role-based access control. Incident response involves the security team and domain administrators. The implementation uses a defense-in-depth approach across multiple levels to minimize risks to CERN's operations and assets from threats exploiting vulnerabilities in its increasingly standard IT-based control infrastructure.
Routeco cyber security and secure remote access 1 01RoutecoMarketing
There is typically a 15:1 ratio of industrial devices to enterprise devices within a manufacturing plant. The industrial internet of things presents opportunities for growth but also increased risks of disruption through threats like theft, natural disasters, unauthorized access, and malware. A defense-in-depth security approach is recommended, incorporating physical security, network segmentation, firewalls, authentication, and monitoring to protect industrial control systems.
IRJET- SDN Simulation in Mininet to Provide Security Via FirewallIRJET Journal
This document discusses implementing a firewall application in a Software Defined Networking (SDN) environment using Mininet and the POX controller. The authors create an SDN network topology in Mininet with hosts and switches. They develop an OpenFlow-based firewall that checks incoming packets against rules defined in the POX controller. This allows filtering of traffic and blocking of unauthorized access in a centralized, software-based way without dedicated hardware. The firewall implementation and experiment results using this SDN testbed are presented.
NERC-CIP’s most recent release, version 5, focuses primarily on BES substations and their critical Cyber Assets (CA), by establishing an Electronic Security Perimeter (ESP) around the substation’s control system. RAD’s Megaplex, a major building block in RAD’s Service Assured Networking (SAN) solutions for power utilities, is strategically located to manage all electronic access to the substation and the cyber assets within it from external and internal attacks.
This paper reviews Megaplex’ 3-tier ESP protection and outlines how it helps power utilities boost their compliance with NERC CIP 005 and 007 requirements
This document provides an overview of industrial control systems (ICS) and SCADA security. It introduces the speakers and defines key ICS terminology. It discusses the evolution of ICS and protocols like Modbus and S7. It outlines ICS components and the differences between IT and OT environments. It also summarizes various tools that can be used for ICS reconnaissance and protocol interaction, and provides an agenda for hands-on lab sessions covering topics like port scanning, protocol analysis and attacks.
Infrastructure Attacks - The Next generation, ESET LLCInfosec Europe
The document discusses the Stuxnet malware attack and its implications. It analyzes how Stuxnet used multiple zero-day vulnerabilities to target Siemens industrial control systems. While initially semi-targeted, its promiscuous spreading demonstrated how infrastructure attacks could be conceived on a massive scale. The attack highlighted vulnerabilities in critical systems and their connections to other networks. It established a template for sophisticated cyberattacks against infrastructure that governments and security professionals must address.
Network Architecture review in context of Information security helps to understand how to actually review the components of network with respect to best practices.
This document provides recommendations for securing SCADA and ICS devices that use the DNP3 protocol. It suggests assessing risks, understanding network configurations, applying software patches, disabling unnecessary functions, implementing defense in depth with measures like firewalls and encryption, and ensuring proper physical security. It also stresses the importance of employee training and working with vendors to implement security best practices like protocol testing and use of authentication.
DTS Solution - Software Defined Security v1.0Shah Sheikh
The document discusses software defined networking (SDN) and network virtualization. It explains that SDN separates the control plane and data plane, allowing network control through external systems rather than individual device configuration. Network virtualization decouples applications from hardware and allows for logical network topologies on the same physical infrastructure through resource isolation. OpenFlow is presented as a standard for SDN implementation, and tools like Open vSwitch, Mininet and OpenDaylight are discussed. Challenges around scalability, reliability and consistency with the separation of planes are also covered.
Presentation on findings of the annual survey of ICS Security professionals. Includes participant demographics, greatest ICS security threats, and security initiatives.
A Study of Intrusion Detection and Prevention System for Network SecurityIRJET Journal
This paper proposes a hybrid intrusion detection and prevention system (IDPS) using a distributed architecture with network IDPS (NIDPS), host IDPS (HIDPS), kernel IDPS (KIDPS) and Arduino boards. The IDPS probes are spatially and semantically distributed according to detection techniques. Simulation results show that the embedded Arduino system has the fastest response time for network analysis, while software-based systems are better for directly protecting hosts. The hybrid system ensures the best response time by combining different probes and distributing them to cover various scenarios. Further work could improve the Arduino system's prevention capabilities by using it as a proxy.
ZONeSEC is a European project that ran from 2014 to 2018 to develop an open framework for enhancing the cybersecurity of wide area surveillance systems that monitor critical infrastructure. The project involved 19 partners from 9 countries. It developed novel sensors, integrated legacy sensors, and implemented a system of systems architecture with distributed processing units and a common operational picture. Three on-site integration pilots were conducted to test the system on highways, water pipelines, and gas pipelines. The final user conference in October 2017 aimed to create awareness of the solution and collect feedback from critical infrastructure operators.
This document provides an overview of programmable logic controllers (PLCs) and supervisory control and data acquisition (SCADA) systems. It defines what PLCs and SCADA are, discusses their components and programming, and lists some common uses. PLCs are microprocessor-based controllers that interface between field devices and control industrial processes using ladder logic programming. SCADA systems are software controllers that acquire data from remote locations using RTUs and provide monitoring and limited control of industrial processes. The document outlines the major features and applications of both systems.
This document provides an overview of how Fortinet solutions can help secure industrial control systems (ICS) in accordance with IEC 62443 standards. It describes common ICS vulnerabilities and challenges, and recommends implementing network segmentation, access controls, and multi-layered security using Fortinet products to monitor traffic and enforce security policies across different ICS zones. Specific Fortinet products mentioned include the FortiGate firewall, FortiAuthenticator for authentication, and FortiAnalyzer for logging and reporting.
This document proposes using Software Defined Networking (SDN) to improve security in Internet of Things (IoT) networks. It discusses how SDN allows centralized control and programmability that can be used to implement security applications and dynamically enforce security policies. The document presents a framework that uses an SDN controller and edge node running virtual machines. It collects network flow data and uses an anomaly detection algorithm to identify malicious flows based on variance from expected values. When anomalies are detected, security policies are applied through the SDN controller to mitigate the threats, such as rate limiting or blocking malicious traffic flows. Simulation results show the effectiveness of the anomaly detection algorithm improves as the time window size increases.
Smart grids is an added communication capabilities and intelligence to traditional grids,smart grids are enabled by Intelligent sensors and actuators, Extended data management system,Expanded two way communication between utility operation system facilities and customers,Network security ,National integration ,Self healing and adaptive –Improve distribution and transmission system operation,Allow customers freedom to purchase power based on dynamic pricing ,Improved quality of power-less wastage ,Integration of large variety of generation options.
We have seen the more complex and critical infrastructure the more vulnerable they are. From the Year of 1994 we have seen lots of incidents where SmartGrid were Hacked the latest and booming incident was Stuxnet Worm which targeted Nuclear Power System of Iran and Worldwide.There are different types of Attacks we will see. Security needed for Smart Grid.
This document discusses cyber physical systems (CPS), which integrate computing systems with physical processes. It provides examples of CPS like shipping, healthcare, energy and smart grids. It discusses security issues that are unique to CPS compared to traditional IT systems, including availability, integrity and timeliness. The document outlines two real-world incidents involving CPS - the Stuxnet attack on Iran's nuclear facilities and the kAndyKAn3 worm attacking a toy factory. It also covers CPS components like sensors, PLCs and HMIs. In closing, it discusses design principles and open research questions around CPS security.
1) The document discusses security challenges in software defined networks (SDNs) including threats to the application plane, control plane, and data plane due to the separation of the control and data planes in SDNs.
2) It describes various security approaches and platforms that can secure each plane and provide network-wide security in SDNs.
3) The paper analyzes SDN security according to several dimensions and highlights both present and future security challenges in SDNs to guide further research on secure SDN architectures.
Light sec for utilities and critical infrastructure white paperGeorge Wainblat
The document discusses LightSEC, a cyber security solution from ECI that provides comprehensive protection for utilities and critical infrastructure. It consists of a suite of security services that incorporate threat detection, prevention, and mitigation technologies. These services are delivered through a cloud-based platform called Mercury that uses network function virtualization for flexible deployment. LightSEC also includes a threat management platform called LightSEC-V that aggregates security data from across the solution to provide a consolidated view of risks.
WAVEFORM COMPARISON AND NONLINEARITY SENSITIVITIES OF FBMC, UFMC AND W-OFDM S...csandit
Recently, new waveforms for the 5th generation cellular system have been studied in many ways. UFMC, FBMC (filter bank multi-carrier) and W-OFDM (window orthogonal frequency division multiplexing) waveforms are very strong candidates as a new waveform for 5G system. In this paper, we have evaluated the spectrum characteristic and BER performance of the waveforms under the effect of nonlinear HPA. Also, we like to show the comparison of the timefrequency resources of each system because it would be very important to estimate the spectral efficiency and communication throughput. As simulation results, it is confirmed that OOB power of each system increases, and OOB power increase of FBMC system is the biggest. Additionally, we have confirmed that performance of every system is degraded by strength of HPA nonlinearity, and every system needs the PAPR reduction method for the nonlinear
distortion compensation and power saving, even though it would be more complicated. Comparison table for the time-frequency resources requirement for the each modulation
systems is included.
AN EMPIRICAL STUDY OF USING CLOUD-BASED SERVICES IN CAPSTONE PROJECT DEVELOPMENTcsandit
Cloud computing is gaining prominence and popularity in three important forms: Software as a Service, Platform as a Service, and Infrastructure as a Service. In this paper, we will present
an empirical study of how these cloud-based services were used in an undergraduate Computer Science capstone class to enable agile and effective development, testing, and deployment of sophisticated software systems, facilitate team collaborations among students, and ease the project assessment and grading tasks for teachers. Especially, in this class, students and teachers could leverage time, talent, and resources collaboratively and distributedly on his/her own schedule, from his/her convenient location, and using heterogeneous programming platforms thanks to such a completely All-In-Cloud environment, which eliminated the necessity of spending valuable development time on local setup, configuration, and maintenance, streamlined version control and group management, and greatly increased the collective productivity of student groups. Despite of the relatively steep learning curve in the beginning of the semester, all nine groups of students benefitted tremendously from such an All-In-Cloud experience and eight of them completed their substantial software projects successfully. This paper is concluded with a vision on expandin and standardizing the adoption of the Cloud ecosystem in other Computer Science classes in the future.
LIVE VIRTUAL MACHINE MIGRATION USING SHADOW PAGING IN CLOUD COMPUTINGcsandit
Cloud Computing shares computing resources to execute application. Cloud systems provide high-specification resources in the form of services, leading to the provision of user convenience and greater ease for personal-computer users; however, expansions of the cloudsystem service necessitate a corresponding enhancement of the technology that is used for server-resource management. In this paper, by monitoring the resources of a cloud server, we sought to identify the causes of server overload and degradation, followed by the running of a dynamic-page-migration mechanism. According to this process, we designed the proposed migration architecture for the minimization of user inconvenience
ALBAY EMERGENCY RESPONSE AND REPORT TOOL (ALERRT)csandit
Resilient public alert and warning tools are essential to save lives and protect property during times of national, regional, and local emergencies. Nowadays, immediate emergency alerts became one of the priority in both national and local government. The Provincial Government of Albay is geared towards becoming the most liveable province of the Philippines, which means that it would be known for good education, good healthcare and good environment where people are healthy, happy, employed and lives to their full potential. To achieve this goal, disaster risk reduction and climate change adaptation must be anchored well so as to move to its destination of shared socioeconomic advancement. Supporting this vision, this study focuses on the design and development of a mobile based Albay Emergency Reporting and Response Tool (ALERRT). It is a mobile based resilient form of emergency alert notification that aids the concerned citizens of any emergencies, accidents and concerns that require immediate response from the government sector concerned.
A DYNAMIC ROUTE DISCOVERY SCHEME FOR HETEROGENEOUS WIRELESS SENSOR NETWORKS B...csandit
With the development of new networking paradigms and wireless protocols, nodes with different capabilities are used to form a heterogeneous network. The performance of this kind of networks is seriously deteriorated because of the bottlenecks inside the network. In addition, because of the application requirements, different routing schemes are required toward one particular application. This needs a tool to design protocols to avoid the bottlenecked nodes and adaptable to application requirement. Polychromatic sets theory has the ability to do so. This paper demonstrates the applications of polychromatic sets theory in route discovery and protocols design for heterogeneous networks. From extensive simulations, it shows the nodes with high priority are selected for routing, which greatly increases the performance of the network. This demonstrates that a new type of graph theory could be applied to solve problems of complex networks.
EXPLORING CRITICAL SUCCESS FACTORS FOR CYBERSECURITY IN BHUTAN’S GOVERNMENT O...csandit
This paper presents the results of open-ended survey exploring the critical success factors for cybersecurity implementation in government organisations in Bhutan. Successful implementation of cybersecurity depends on a thorough understanding of cyber threats and challenges to the organisational information assets. It also depends on identification of a responsible, dedicated personnel to lead and direct cybersecurity initiatives. Furthermore, it is important to know the critical areas of cybersecurity activities for management to target, prioritise and execute. Understanding of what key things need to be done right by the responsible agency and its leader, at a particular time and in particular context, can lead to better decision making and resource optimisation including skills and knowledge. The survey findings indicate that, among other factors, awareness and training, policy and standards, and adequate financing and budgetary commitment to cybersecurity projects are three most important success factors. Channelling an organisation’s limited resources to these few factors is expected to enhance cybersecurity posture and its management. The research outcome has implications to both government and private organizations in Bhutan.
AN EFFICIENT RECOVERY SCHEME FOR BUFFER-BASED B-TREE INDEXES ON FLASH MEMORYcsandit
Recently, flash memory has been widely used because of its advantages such as fast access speed, nonvolatile, low power consumption. However, erase-before-write characteristic causes the B-tree implementation on flash memory to be inefficient because it generates many flash operations. To address this problem, variants of buffer-based B-tree index have been proposed for flash memory which can reduce a number of write operations. Since these B-trees use a main-memory resident index buffer to temporarily store newly created index units, their data may be lost if a system crash occurs. This study introduces a novel recovery scheme for the
buffer-based B-tree indexes on flash memory, called ERS. ERS can minimize the risk of losing data by deploying logging and recovery policies. The experimental results show that ERS yields a good performance and helps the buffer-based B-tree indexes improve the reliability.
A BINARY TO RESIDUE CONVERSION USING NEW PROPOSED NON-COPRIME MODULI SETcsandit
Residue Number System is generally supposed to use co-prime moduli set. Non-coprime moduli sets are a field in RNS which is little studied. That's why this work was devoted to them. The resources that discuss non-coprime in RNS are very limited. For the previous reasons, this paper analyses the RNS conversion using suggested non-coprime moduli set.
Software reverse engineering is an active threat against software programs. One of the popular techniques used to make software reverse engineering harder is obfuscation. Among various control flow obfuscations methods proposed in the last decade there is a lack of inter-functional control flow obfuscation techniques. In this paper we propose an inter- unctional control flow obfuscation by manipulating return instructions. In our proposed method each function is split into different units, with each unit ending with a return instruction. The linear order in which functions appear in the program is obscured by shuffling these units there by creating an interfunctional control flow obfuscation. Experimental results show that the algorithm performs well against automated reverse engineering attacks.
SHARP OR BLUR: A FAST NO-REFERENCE QUALITY METRIC FOR REALISTIC PHOTOScsandit
There is an increasing demand on identifying the sharp and the blur photos from a burst of series or a mass of collection. Subjective assessment on image blurriness takes account of not only pixel variation but also the region of interest and the scene type. It makes measuring image sharpness in line with visual perception very challenging. In this paper, we devise a noreference image sharpness metric, which combines a set of gradient-based features adept in estimating Gaussian blur, out-of-focus blur and motion blur respectively. We propose a datasetadaptive logistic regression to build the metric upon multiple datasets, where over half of the samples are realistic blurry photos. Cross validation confirms that our metric outperforms thestate- of-the-art methods on the datasets with a total of 1577 images. Moreover, our metric is very fast, suitable for parallelization, and has the potential of running on mobile or embedded devices.
DMIA: A MALWARE DETECTION SYSTEM ON IOS PLATFORMcsandit
iOS is a popular operating system on Apple’s smartphones, and recent security events have
shown the possibility of stealing the users' privacy in iOS without being detected, such as
XcodeGhost. So, we present the design and implementation of a malware vetting system, called
DMIA. DMIA first collects runtime information of an app and then distinguish between
malicious and normal apps by a novel machine learning model. We evaluated DMIA with 1000
apps from the official App Store. The results of experiments show that DMIA is effective in
detecting malwares aimed to steal privacy.
WI-FI FINGERPRINT-BASED APPROACH TO SECURING THE CONNECTED VEHICLE AGAINST WI...csandit
This paper presents a Wi-Fi fingerprint-based approach to secure connected vehicles against wireless attacks. The approach generates Wi-Fi fingerprints by analyzing radio frequency features like error vector magnitude from devices. It estimates a device's distance using RSSI and verifies fingerprints by comparing radio frequency signatures. The prototype achieves 2.7% false acceptance for different chipsets and 10.4% for same chipsets. The approach detects MAC spoofing by analyzing a device's Wi-Fi signal characteristics.
SECURITY FOR SOFTWARE-DEFINED (CLOUD, SDN AND NFV) INFRASTRUCTURES – ISSUES A...csandit
This document discusses the security challenges of software-defined infrastructures including cloud, SDN, and NFV technologies. It outlines several issues such as insecure interfaces/APIs, malicious insiders, account hijacking, virtualization vulnerabilities, and service interruptions for cloud computing. For NFV, the key challenges discussed are hypervisor security issues that could allow attackers to access VMs and compromise the entire infrastructure. The document argues that these technologies introduce both traditional security risks as well as new technology-specific risks, and that a software-defined security approach is needed to address challenges across integrated cloud, SDN, and NFV platforms.
AN EFFICIENT DEPLOYMENT APPROACH FOR IMPROVED COVERAGE IN WIRELESS SENSOR NET...csandit
Wireless Sensor Networks (WSNs) are experiencing a revival of interest and a continuous advancement in various scientific and industrial fields. WSNs offer favorable low cost and readily deployable solutions to perform the monitoring, target tracking, and recognition of physical events. The foremost step required for these types of ad-hoc networks is to deploy all the sensor nodes in their positions carefully to form an efficient network. Such network should satisfy the quality of service (QoS) requirements in order to achieve high performance levels. In
this paper we address the coverage requirement and its relation with WSN nodes placement problems. In fact, we present a new optimization approach based on the Flower Pollination Algorithm (FPA) to find the best placement topologies in terms of coverage maximization. We have compared the performance of the resulting algorithm, called FPACO, with the original practical swarm optimization (PSO) and the genetic algorithm (GA). In all the test instances, FPACO performs better than all other algorithms.
DESIGN OF A SECURE DISASTER NOTIFICATION SYSTEM USING THE SMARTPHONE BASED BE...csandit
The number of disaster occurrences around the world based on the climate changes due to the global warming has been indicating an increase. To prevent and cope with such disaster, a number of researches have been actively conducted to combine the user location service as well as the sensor network technology into the expanded IoT to detect the disaster at early stages. However, due to the appearance of the new technologies, the scope of the security threat to the pre-existing system has been expanding. In this thesis, the D-SASS using the beacon to provide the notification service to the disaster-involved region and the safe service to the users is proposed. The LEA Algorithm is applied to the proposed system to design the beacon protocol collected from the smartphone to safely receive the notification information as well as to provide the confidentiality during the data transfer between smartphone and notification server.
PERFORMANCE COMPARISON DCM VERSUS QPSK FOR HIGH DATA RATES IN THE MBOFDM UWB ...csandit
This document compares the performance of dual carrier modulation (DCM) versus quadrature phase shift keying (QPSK) for high data rates in a multiband orthogonal frequency division multiplexing (MB-OFDM) ultra wideband (UWB) system. Simulation results show that using DCM provides better performance than QPSK, with a gain of around 0.7 dB for a bit error rate of 10-3 at 320 Mbps data rates. DCM offers additional diversity and coding gains over QPSK, making it more efficient for high data transmission rates in MBOFDM UWB systems.
Técnicas e didática para a educação cidadãjovemsenador
O documento discute técnicas e didática para educação cidadã. Aborda marketing social e sua evolução para educação cidadã, os pilares da educação segundo Delors, e a importância do professor como facilitador da aprendizagem dos alunos na era digital.
The Effect Of Benevolent Leadership On Organizational Citizenship Behavior (O...theijes
This study was conducted to examine the effect of benevolent leadership (ethics sensitivity, spirituality, positive engagement, and community responses) to organizational citizenship behavior (OCB), either directly, or through mediation Ethics Climate. The study was based on a survey of 200 respondents. Respondents were used in this study came from Department of Education and Culture in Kendari. The research data used cross sections data so it is possible perception of respondents is different because of the time and place, so it is advisable to research will be able to use time series. Statistical Package for the Social Sciences used to test the hypothesis. The results showed that ethics sensitivity has significant positive effect on OCB. Ethics Climate mediates the relationship between ethics sensitivity and OCB. Spirituality has no effect on OCB. Ethics Climate does not mediate the relationship between spirituality and OCB. Positive engagement does not affect the OCB. Ethics Climate does not mediate the relationship between positive Positive engagement and OCB. Community response had no effect on OCB. But Ethics Climate response mediates the relationship between community and OCB. Ethics Climate has significant and positive effect on OCB. Keywords: Benevolent Leadership (sensitivity of ethi
This document provides an overview of SCADA (Supervisory Control and Data Acquisition) systems. It discusses what SCADA is, its architecture and components, functionality, and how it is used to control industrial processes. Security issues are also covered, along with the evolution of SCADA systems from early monolithic designs to modern distributed and networked architectures. The future of SCADA is described as incorporating more sophisticated capabilities through artificial intelligence and greater network integration.
This document discusses trends in threats to SCADA (Supervisory Control and Data Acquisition) systems. It notes that as SCADA systems increasingly use commercial off-the-shelf software and connect to the internet, they have become more vulnerable to cyber threats. The document outlines how SCADA systems work and components like RTUs, PLCs, and HMIs. It also discusses issues like the mistaken belief that SCADA systems are secure due to physical security or isolation from the internet. The conclusion suggests that as capabilities and opportunities for threats increase, the future operational environment will be more vulnerable if an actor emerges with the intent to cause harm.
SCADA Systems Vulnerabilities and Blockchain Technologyijtsrd
SCADA systems are one of the most important part of industrial operations. Before SCADA, plant personnel had to monitor and control industrial process via selector switches, pushbuttons and dials for analog signals. As manufacturing grew and sites became more remote, relays and timers were used to assist supervision. With the onset of technology and advent of network based protocols, these systems became more reliable, fast and it became easy to troubleshoot problems. Indeed progress also brings vulnerabilities, which was no new for SCADA. The IP protocols brought threat to the security of these systems. The devastation that cyber predators on SCADA can inflict, could be illustrated by the Stuxnet virus attack. This paper discusses what SCADA systems are, their uses, protocols being used by these systems, vulnerabilities and ways to combat those vulnerabilities. It focusses on the use of Blockchain Technology as a step in security of such systems. Diksha Chhonkar | Garima Pandey "SCADA Systems: Vulnerabilities and Blockchain Technology" Published in International Journal of Trend in Scientific Research and Development (ijtsrd), ISSN: 2456-6470, Volume-4 | Issue-4 , June 2020, URL: https://www.ijtsrd.com/papers/ijtsrd31586.pdf Paper Url :https://www.ijtsrd.com/computer-science/computer-security/31586/scada-systems-vulnerabilities-and-blockchain-technology/diksha-chhonkar
This document proposes a secure communication framework for embedded networking. The framework aims to be platform neutral and hardware independent. It incorporates a secured database containing all possible system events. Embedded systems can authenticate and access this database. The framework also protects the communication channel by encrypting transmissions, secure handshaking, and using self-adaptive frame structures. It references event indexes from the database rather than transmitting actual information. The database is dynamically recreated on each power-on to change event indexes and improve security. The framework is designed to be easily implemented using proven security technologies while providing modest protection for embedded network devices.
SCADA systems are used to monitor and control equipment and processes in industries like oil/gas, water treatment, and manufacturing. They gather data in real-time from remote locations and send control commands back. SCADA has evolved through 3 generations from standalone monolithic systems to distributed systems on local networks to today's networked systems using open standards and wide area networks. Security issues need to be addressed like encrypting communications, securing devices, auditing networks, and implementing threat protection. The future of SCADA involves more sophisticated systems that can handle huge data volumes and territories with some having artificial intelligence capabilities.
Critical Information Infrastructure Systems WorldwideAngela Hays
The document discusses the training that the author underwent at Finetech Controls Pvt. Ltd., which covered the fundamentals of industrial automation including components like switches, sensors, controllers, drives, and programmable logic controllers. The training also included how to operate and program PLCs to remotely control industrial processes, as well as the basics of variable frequency drives for motor speed and rotation control. The author was educated on the principles, applications, and installation of automation equipment used in manufacturing and material handling processes.
protection on lineman while working on transmission line reportRavi Phadtare
This document describes a system to protect linemen working on transmission lines. The system uses a microcontroller connected to a GSM module and circuit breaker. When a lineman needs to work on a line, they call the microcontroller using a GSM phone. This automatically switches off the power to that line. When work is complete, the lineman calls again to restore power. The microcontroller compares the caller's number to a stored number to authenticate them. This system aims to prevent electrical accidents by allowing linemen to remotely control the power supply while working.
The Internet of Things (IoT) offers many industries significant new opportunities, but it also exposes them and their customers to a host of security issues. Securing the IoT requires new ways of thinking that can defend the enterprise and its customers against attackers and privacy abuses.
Sfa community of practice a natural way of buildingChuck Speicher
A community of practice is natural way of building something through intuitive learning exercises ( lean development methodology) that people lack the knowledge to accomplish on their own.
These barriers to enabling new markets have always existed from ancient times to present day. The "community of practice" bridges technology processes and people to naturally solve what people need to know and learn quickly.
Scada Industrial Control Systems Penetration Testing Yehia Mamdouh
Scada Industrial Control Systems Penetration Testing
Start from Types of Scada Networks, then Penetration testing, finally what Security should be follow
The document discusses penetration testing of SCADA industrial control systems. It begins with an overview of SCADA systems, including what they are, where they are used, benefits, and basic concepts like the communication between the SCADA server and RTUs/PLCs. It then covers SCADA protocols like Modbus and DNP3. The document outlines various attack vectors like denial of service attacks, unauthorized access, and vulnerabilities in common protocols. It proposes a penetration testing methodology that involves discovery, protocol analysis, data manipulation, and security recommendations like firewalls, IDS, and training to improve SCADA security.
SCADA.pptx supervisory control and data aquasitionRapidAcademy
The document discusses the history and components of SCADA (Supervisory Control and Data Acquisition) systems. It describes how early SCADA systems involved direct connections between sensors and control panels, while modern systems involve remote terminal units, programmable logic controllers, telemetry, and computer software. The key components of a SCADA system include remote terminal units that interface with field sensors, communication systems to transfer data, master stations to display and control the system, and software for user interfaces, alarms, data storage and more.
This document discusses the cyber security risks of smart grids and proposes an integrated security framework to address these risks. Smart grids integrate information infrastructure with electrical infrastructure, improving performance but also increasing vulnerability to cyber attacks. The framework features security agents, managed security switches, and a security manager to provide layered protection, intrusion detection, and access control across the power automation network in a scalable and extensible manner. This integrated approach is needed as power systems have different security needs than traditional IT networks.
IRJET - Data Security in Cloud Computing using Homomorphic AlgorithamIRJET Journal
This document discusses using homomorphic encryption to securely store and process data in the cloud. It begins with an introduction to cloud computing and data security challenges. The proposed system would encrypt user data before transferring it to the cloud server using homomorphic encryption. This allows computations to be performed on the encrypted data without decrypting it first, protecting data privacy. The document reviews related work on authentication schemes and secure file storage using encryption. It presents the proposed system architecture and concludes that homomorphic encryption can help address cloud computing security issues by allowing operations on encrypted user data.
This presentation explains the ANSI/ISA-99 and IEC 62443 standards for industrial control systems (ICS). It describes the Zone and Conduit security model and how it is used in an plant or factory. As well, the issues of security configuration errors are discussed. A case history of zone security deployment for a Safety Integrated System in a refinery is provided. For additional information see www.tofinosecurity.com.
The document discusses cyber security challenges for industrial control systems (ICS) and SCADA networks. As ICS were connected to networks and the internet, it increased opportunities for remote hacking and destruction. The disconnect between traditional IT security practices and operational needs of ICS led to vulnerabilities. Common security strategies like network isolation are no longer effective due to widespread connectivity. Recent attacks have shown that hackers can compromise ICS equipment directly and cause physical damage. The document argues industry must adopt new security technologies and policies tailored for ICS in order to address growing threats.
Practical analysis of the cybersecurity of European smart gridsSergey Gordeychik
This paper summarizes the experience gained during a series of
practical cybersecurity assessments of various components of Europe’s
smart electrical grids.
SCADA forensic tools open source. What are they What they doSo.pdfebrahimbadushata00
SCADA forensic tools open source. What are they? What they do?
Solution
SCADA stands for Supervisory Control and Data Acquisition.
This technology is used to mainly ensure the operations and functionality of the control systems
used in many industries.
It is a software application program which is used to gathering of the data in real time from
remote locations so as to control the equipment and conditions in such device environments.
SCADA is mainly used in Transportation, Telecommunications, power plants, Gas refining
industries and as well in water and waste control by government agencies too.
they include software and hardware components, which gather and inputs the data into a
computer machine and processes it.
It also records all the log events into a file and stores in the local hardisk/server.
These SCADA Systems/applications also warn when conditions become hazardous by sounding
alarams.
As these systems are operated in huge network environments there is a very high possibility of
attacks.
In recent years there has been an increasing number of attacks directly targeting these systems
including the well published networks.
Therefore , there is a need to have forensic analysis of these systems to determine, if breah has
occured and the extent to which the system is compromised and also the details of how the
functional operations and assets are affected.
Apart from normal threats there are many cyber threats against SCADA systmes with
sophisticated malware attacks, SQL Injection, cross-site scripting, and the buffer overflow
attacks being the most common type of vulnerability.
Digital forensic is an important part of an incident response strategy in an IT forensic
investigation following an incident and will provide an effective response in a forensic manner.
Investigative Steps:
1 Examination: Deals with the identitfy of potential sources of evidence, including the systems,
the network and connected devices.
2 Identification: identify the types of systems to be investigated, which includes OS, serail
numbers and model types of the PLC\'s, the network design and the implementation.
3 Collection: Collect the potential evidence from the memory systems that are suspected to be
part of the SCADA system which is being investigated.
4 Documentation: It is very critcial to keep accurate documentation of the investigation to ensure
chain of custody. Records need to be kept of the evidence.
The existing tools for SCADA Systems are:.
Dawn of the Intelligence Age by Dr. Anton RavindranGSTF
The document discusses various topics related to cloud security including:
- Key attributes of cloud computing such as shared resources, broad network access, and metered usage.
- Common cloud security issues such as loss of control and lack of trust in multi-tenant environments.
- Major cloud security incidents including outages at companies like Amazon, Verizon, and Sony Pictures.
- The growing market size of the global cloud security industry, projected to reach $963 million by 2014.
- Recommendations for managing security risks in the cloud such as utilizing multiple availability zones.
Scada system architecture, types and applicationsUchi Pou
This document discusses the architecture, types, and applications of SCADA (Supervisory Control and Data Acquisition) systems. It describes the basic components of SCADA systems including human-machine interfaces, programmable logic controllers, remote terminal units, communication infrastructure, and SCADA programming. It outlines the four generations of SCADA systems from early monolithic to modern networked and internet-based systems. Finally, it provides examples of SCADA applications in manufacturing, wastewater treatment, power systems, and wireless SCADA systems.
Similar to RITA SECURE COMMUNICATION PROTOCOL: APPLICATION TO SCADA (20)
Conservation of Taksar through Economic RegenerationPriyankaKarn3
This was our 9th Sem Design Studio Project, introduced as Conservation of Taksar Bazar, Bhojpur, an ancient city famous for Taksar- Making Coins. Taksar Bazaar has a civilization of Newars shifted from Patan, with huge socio-economic and cultural significance having a settlement of about 300 years. But in the present scenario, Taksar Bazar has lost its charm and importance, due to various reasons like, migration, unemployment, shift of economic activities to Bhojpur and many more. The scenario was so pityful that when we went to make inventories, take survey and study the site, the people and the context, we barely found any youth of our age! Many houses were vacant, the earthquake devasted and ruined heritages.
Conservation of those heritages, ancient marvels,a nd history was in dire need, so we proposed the Conservation of Taksar through economic regeneration because the lack of economy was the main reason for the people to leave the settlement and the reason for the overall declination.
Understanding Cybersecurity Breaches: Causes, Consequences, and PreventionBert Blevins
Cybersecurity breaches are a growing threat in today’s interconnected digital landscape, affecting individuals, businesses, and governments alike. These breaches compromise sensitive information and erode trust in online services and systems. Understanding the causes, consequences, and prevention strategies of cybersecurity breaches is crucial to protect against these pervasive risks.
Cybersecurity breaches refer to unauthorized access, manipulation, or destruction of digital information or systems. They can occur through various means such as malware, phishing attacks, insider threats, and vulnerabilities in software or hardware. Once a breach happens, cybercriminals can exploit the compromised data for financial gain, espionage, or sabotage. Causes of breaches include software and hardware vulnerabilities, phishing attacks, insider threats, weak passwords, and a lack of security awareness.
The consequences of cybersecurity breaches are severe. Financial loss is a significant impact, as organizations face theft of funds, legal fees, and repair costs. Breaches also damage reputations, leading to a loss of trust among customers, partners, and stakeholders. Regulatory penalties are another consequence, with hefty fines imposed for non-compliance with data protection regulations. Intellectual property theft undermines innovation and competitiveness, while disruptions of critical services like healthcare and utilities impact public safety and well-being.
In May 2024, globally renowned natural diamond crafting company Shree Ramkrishna Exports Pvt. Ltd. (SRK) became the first company in the world to achieve GNFZ’s final net zero certification for existing buildings, for its two two flagship crafting facilities SRK House and SRK Empire. Initially targeting 2030 to reach net zero, SRK joined forces with the Global Network for Zero (GNFZ) to accelerate its target to 2024 — a trailblazing achievement toward emissions elimination.
A brand new catalog for the 2024 edition of IWISS. We have enriched our product range and have more innovations in electrician tools, plumbing tools, wire rope tools and banding tools. Let's explore together!
Response & Safe AI at Summer School of AI at IIITHIIIT Hyderabad
Talk covering Guardrails , Jailbreak, What is an alignment problem? RLHF, EU AI Act, Machine & Graph unlearning, Bias, Inconsistency, Probing, Interpretability, Bias
Development of Chatbot Using AI/ML Technologiesmaisnampibarel
The rapid advancements in artificial intelligence and natural language processing have significantly transformed human-computer interactions. This thesis presents the design, development, and evaluation of an intelligent chatbot capable of engaging in natural and meaningful conversations with users. The chatbot leverages state-of-the-art deep learning techniques, including transformer-based architectures, to understand and generate human-like responses.
Key contributions of this research include the implementation of a context- aware conversational model that can maintain coherent dialogue over extended interactions. The chatbot's performance is evaluated through both automated metrics and user studies, demonstrating its effectiveness in various applications such as customer service, mental health support, and educational assistance. Additionally, ethical considerations and potential biases in chatbot responses are examined to ensure the responsible deployment of this technology.
The findings of this thesis highlight the potential of intelligent chatbots to enhance user experience and provide valuable insights for future developments in conversational AI.
2. 38 Computer Science & Information Technology (CS & IT)
SCADA systems are considered secured by isolation, still, they can be attacked from the inside.
Also, due to the augmented connectivity to the outside, it is wise to consider effective security
measurements before being able to have authorized outside access.
While security protocols are implemented in many systems, most of SCADA systems are still
unsecured. Most companies that rely on SCADA systems do not consider securing these systems
because of the expected high costs. This high cost is the consequence of cryptography use which
also breaks the real-time constraint of SCADA systems.
Our proposal is to replace cryptography with a measurement that is expected to have a satisfying
security level with a very low cost (power, time, and space). Our approach does not need for the
already installed system to be replaced nor upgraded which means that the SCADA system would
be available during the shift from unsecured to secured.
In this article, we will present the concept of our proposal while unfolding the first and most basic
version of our protocol.
2. SCADA
SCADA systems can be found in modern industrial facilities such as water pipes, power plants,
oil refineries, chemical factories and nuclear facilities. These systems use coded signals over
communicating channels to monitor and control numerous devices on multiple and distant sites.
Unlike standard networks, most of the SCADA nodes are special purpose embedded computing
devices with limited capacities such as remote terminal units (RTUs) and programmable logic
controllers (PLCs). These nodes exchange data (exp. temperature is x, water level is y, etc.) and
commands (exp. turn off water) between each others and with the supervisory system. The
supervisory system can also build statistics about the system and how it is being used based on
the received data.
Figure 1 presents a general SCADA network and its communication to a second SCADA, a local
network, and the Internet.
Figure 1. General SCADA network presentation
In addition to using special purpose embedded computing devices, other SCADA properties also
affect their security as well, we are mainly interested by the following [1]:
3. Computer Science & Information Technology (CS & IT) 39
• Non-stop availability: Devices are required to work non-stop for years, exp. traffic lights.
• Geolocation: Nodes can be very sparse and geographically extensive, exp. water pipelines.
• Hard conditions: Nodes may exist in hard physical conditions, exp. chemical factories.
• Performance: Devices must have a hard real-time constraint, exp. microchips industries.
Many security problems are caused by the properties mentioned above: The use of special
purpose devices with limited input/output choices causes communicated messages to be easily
predictable. Cryptography is hardly supported since performance would be dramatically reduced.
Renewing and updating devices would be very expensive, this is caused by the geolocation of the
devices and the availability constraint. The geolocation constraint also allows possible
unexpected links to the outside reducing system security. And finally, the geolocation and hard
conditions of devices discourage temper resistance. Any approach to secure SCADA systems
should consider those properties and specifications.
SCADA properties are not the only aspects causing security problems, many of the choices (made
by SCADA manufacturers and users) that characterize current SCADA systems also reduce
SCADA security [1]:
• Using open standards which grant attackers more knowledge of the system.
• Using COTS (commercial off-the-shelf) hardware and software (which lacks of security).
• Using fail-safe constraints increases safety while decreasing security.
• Protocols vulnerabilities, whether conceptual or caused by implementation errors.
3. RELATED WORK
Many efforts were put to secure SCADA communication [2,3,4,5]. In the technical and research
world, these efforts led to solutions which would insure a high level of security in SCADA. In
practice, the proposed solutions are expensive and their requirements are not met in the SCADA
networks. Since none of these solutions is proven to be perfect, no one would take the risk and
pay the elevated price, which is in some cases changing their whole SCADA system. The
imperfection of these solutions would mean constant updates and upgrades that SCADA
managers would not risk. For these reasons, we think that any SCADA security solution that
desires to pass from the research world to practice should have perfection properties. Also a good
security solution for SCADA systems would not need to replace the already installed materials.
The only known perfectly secure cryptosystem is the Vernam cipher, also called the one-time
pad. Gilbert Vernam patented this invention in the USA in July 1919 [6]. A few years later, a
variation of the one-time pad was patented in Germany by Siemens and Halske [7]. The one-time
pad is based on a list of shared keys that can only be used once. If implemented in SCADA
systems, the list of shared keys need to be updated constantly which is very time consuming in
most cases (exp. water pipes).
In 1949, Claude Shannon proved that the one-time pad is indeed unbreakable and that any
unbreakable system must have the same essential characteristics as the one-time pad [8]. The
most essential characteristic of the one time-pad is the use of a different key for each encryption.
4. 40 Computer Science & Information Technology (CS & IT)
To the best of our knowledge, there are no other cryptosystems that were considered unbreakable
since the one-time pad.
4. PROTOCOL
In this section we will explain the principles of the protocol and its characteristics. We will also
demonstrate the communication schema, and finally we show some details of the needed security
measurements for the protocol to work effectively.
4.1. Principles of the Protocol
The most important principle of our protocol is the secret sharing between two entities that we
call security boxes. These security boxes are considered twins, our security relies on the
possibility for these twins to share and maintain a secret which is similar to a symmetric key in
the case of cryptographic algorithms.
The shared secret is a table of randomly pre-initialized values, along with a secret algorithm with
predefined random operations. To make sure the performance is almost intact, the chosen
operations are simple binary compositions (exp. binary XOR) and substitutions. Also, most of the
operations take place after sending/receiving a message and not before. That way, the message is
sent and processed with almost no security related latency.
The 2-security boxes are initialized together before being placed each on the entry/outlet of any
type of device that needs its communication secured. A security box can be an embedded device
or an algorithm implemented on another already existent device such as a computer program, a
smart phone application, etc. Any communication between the 2 devices would go through both
security boxes, the first security box translates the communicated message to a matching secret
message and the second security box would reveal the match for the received secret. After
sending or receiving a secret message, a security box would change the secret table.
Figure 2 represents a synchronous version of the communication using our security protocol. The
twins Agent A and Agent B communicate synchronous messages. In our latest version of the
protocol asynchronous communication is possible. Each time a security box sends or receives a
message it changes the used value in the table using function f. Function f's output depends not
only on the input but on the current state of the security box (ex. whole table, number of
communicated messages, etc.). This dependency exists for security reasons so outputs would not
be redundant or have a pattern.
4.2. Characteristics
The security boxes transform a plain message to a secret message/code and vice versa to ensure
that messages in the channel are unintelligible to any eavesdropper that may be analysing channel
communication. Only intelligible messages are accepted by the security boxes.
The security boxes can be used as a middle-ware between 2 devices, the translation from plain to
secret message and vice versa can be different from one side to the other to make sure both
devices send and receive messages they understand.
The security boxes can also be used as a middle-ware between the devices and the
communication channel, no matter what form of message the device produces. The security box
transforms a produced message into a secret message that respects the protocol used in the
5. Computer Science & Information Technology (CS & IT) 41
communication channel without the need to change or adjust the secured device itself. The only
modifications are the ones we do to the security box itself.
Figure 2. Simple Synchronous Method
A very important aspect of the security boxes is that they do not require any changes from the
devices being secured. It is up to the security box to adjust itself depending on the secured
devices. To do so, the security device can either be a general box which would require
configuration depending on the secured devices. This would increase the flexibility of the box
while reducing its performance and security level. The second method is to have boxes specially
designed depending on the requirements of the secured devices. Although the second method
provides less flexibility, it insures maximum performance and security. While the second method
seems extreme with its need to recreate a security box depending on the requirements, it is
feasible since the part that would change in the security box is very small and easy to modify.
4.3. Communication Schema
Figure 3 describes the communication schema using our protocol. A and B are communicating in
a synchronous fashion. A creates a clear message clm and sends it to A.mySecurityBox which
codes it into a matching coded message com and forwards it to the communication channel before
updating the secret table using the contents of com and other variables. B.mySecurityBox is
waiting for this message, it receives com, generates clm and sends it to B before updating its own
version of the secret table using the same variables and operations. Finally B would answer by
creating a new clm (response) and sending it to A in the same fashion.
6. 42 Computer Science & Information Technology (CS & IT)
Figure 3. Communication Schema
4.4. Function Necessities and Security Measurements
The size of the secret table depends on the requirements of the secured devices and the different
possible signals. For example, to control a lamp with 3 possible commands and 3 possible
responses, we need a table of 3 values (for the most basic implementation of our mechanism).
The cryptosystem needs to insure confusion and diffusion [8]. To make sure that the minimum
required confusion and diffusion is offered we use substitution boxes. It is also considered
important that the transformation of the secret table is irreversible. This would reduce the
possibilities of future analytical attacks.
It is clear that the values in the table should be different one from the other at any point of time or
the same value would have multiple meanings which results in an ambiguous message.
A list of unacceptable/undesired values contains values considered to decrease the security of our
system such as zero in addition to any value with Hamming weight equal to 1 or even 2. these
values are never used in the secret tables.
Getting a substitution box output should be normalized regarding time, power, etc. If we have a
substitution box of the form X = numberOfRows and Y = numberOfColumns, and we are
searching for the output OUT(row=x,col=y) then we should also search for a phantom output
OUT(row=X-x,col=Y-y) without actually using it.
Any list/table search should consider the same approach. Looking for the value x in list T should
have phantom = T[l-i] where l is the length of T and i is the index of x in T.
Although most phantom outputs are used after sending/receiving, they still affect the performance
and power consumption of our approach. Therefore, phantom outputs should only be used when
side channel attacks are considered as threats to the system.
5. DISCUSSIONS
In this section we will analyse the robustness of our approach and show an effective way of
implementing it on already installed systems.
7. Computer Science & Information Technology (CS & IT) 43
5.1. Robustness Analysis
Consider the following: A and B communicating using our protocol, they use a table of 3 values.
A sends a message with value X1 to B and replaces X1 with X2, X1 is intercepted by an attacker.
From the attacker's (let us call him C) point of view, X1 has no signification other than a strange
signal being sent from A to B, since C cannot understand the meaning of this signal then the
confidentiality requirement is respected.
The integrity requirement is also respected since if C tries to change X1, or to invent a message
and send it to B, it has a negligible chance of succeeding. The success probability is actually a/(2b
– c) where a is the number of possible values (3 in our example), b is the number of used bits 32,
and c is the number of unacceptable values 1+32 if we only refuse values with hamming weight
equal to 0 and 1. 3 / (232
– 33) = 6 * 10-10
which is 6 times lesser then the probability of gaining
the jackpot Mega Millions multi-state lottery in the United States.
If C tries to redirect X1 to A, A would not accept it since X1 was replaced by X2 and does not have
any meaning to A any longer. The only thing C can do is to interrupt messages from A to B and B
to A. Interrupted messages cannot be replaced, therefore, if A and B use a time constraint (the
system knows something wrong if no message is received for t seconds) then both devices would
know there is an undergoing attack or a connection problem.
5.2. Installation Method
Let us consider devices A and B are already functioning in our system, we wish to secure the
communication between these 2 devices. If we do not want to break the communication between
the devices we proceed as follows:
First we add the security box to A by switching the cables connecting A to the security box, and
adding a cable between A and its security box. The security box would simply forward messages
from A without securing them. Then we add the security box to B, once installed the security box
would send a notification to A's security box to start securing messages. After the secured
communication is well established, unsecured messages would stop being accepted.
While a security box is being installed on a machine, this machine will not be able to send and
receive messages only for the instance of cables switching.
In addition to the security boxes, we use port boxes (Figure 4). The current ports would simply
route the messages to the correct channel. The ports may also be used to scramble the messages
which would add to the system security while slightly affecting performance.
The structure of a secret message would contain the following information: ID of the sender
(portID_A, boxID_A, and deviceID_A), ID of the receiver (portID_B, boxID_B, and deviceID_B),
sequences of the message (box_seq and device_seq), and finally the coded data itself. Additional
information can be added to the message if needed. Some information can also be reduced if it is
found heavy for a system. For example, we can remove boxID_A since it is boxID_B's twin and
the only one who could have sent the readable message. In some cases, a box and a device can
have the same ID and messages sequences which would also reduce the size of the secret
message.
Figure 4. Using Port Boxes
8. 44 Computer Science & Information Technology (CS & IT)
6. GENERAL STRUCTURE
The connection between a device and a security box should not be exposed to other devices,
entities, or the outside since it is unsecured. The connection between a port and a security box
should be a single line or messages would be routed wrongly, messages passing this connection
are already secured. The communication between ports can pass through any type of channels
(wireless, Internet, etc.), messages are secured during this communication.
Our protocol can be used to support communication between multiple devices (Figure 5).
Consider the following security boxes twins: A and AA, B and BB, C and CC. Devices 1 and 2
communicate with devices 4 and 5 through A and AA. Device 5 communicates also with device 3
using 2 twins: B,BB and C,CC. Device 3 and device 5 cannot communicate with each others.
If a message is sent from Device 3 to device 5 passes by the first twin B,BB and a second message
passes by the second twin C,CC, there is a chance for the second message to arrive before the first
one, therefore it is unsafe to have devices communicate with each others using multiple security
boxes unless both devices 3 and 5 have the capacity of readjusting the order of received
messages.
Finally, we have Port 1 communicating with ports 2 and 3.
In conclusion we have the following:
• A security box can secure multiple applications/devices.
• A port can be connected to multiple security boxes and communicate with multiple ports.
• A device can communicate with multiple devices using the same security box.
• A device can communicate with a device using multiple security boxes if both devices have a
measurement that keeps track of the correct messages order.
Figure 5. General Structure
7. IMPLEMENTATION
In this section we show an example of how the protocol can be used, and exhibit our simulation.
9. Computer Science & Information Technology (CS & IT) 45
7.1. Example
Let us consider the following example that do not mention the use of port boxes (Figure 6).
Figure 6. Lamp Control Example
We have a smart phone with many applications, one of which would control a lamp through a
wireless communication channel. We need to make sure the communication between the lamp
and the application is secured from any attack. The attacks may take advantage of the wireless
insecurity or an insecure application installed on the smart phone. We create 2 security boxes: one
would be an embedded device that is installed on the lamp's input/output, the second security box
would be an algorithm on the smart phone and controls the input/output of the lamp control
application.
Any communicated message between the lamp and the application would be translated into a
secret message that has no meaning to any outsider (attacker) which guarantees confidentiality.
Changing this message would result in a meaningless message which insures the integrity of the
communication.
Figure 7. Simple Synchronous Method Example
In this example (Figure 7), we are using a table of 3 items, having 3 possible indexes means 3
different signals (information) sent and 3 different signals received. In the following we have:
TURNON = ISON = 0, TURNOFF = ISOFF = 1, STATUSCHECK = OK = 2.
The first and most basic method consists on changing a value after using it. Agent_A (ID=468)
and Agent_B (ID=834) start with a shared secret table T and a secret function f. A (ID=43) starts
by sending a CHECKSTAT order, which is index = 2. Instead of actually sending 2, Agent_A
would send T[2] which is 16. After sending 16, Agent_A would change T[2] using f to obtain 37.
Since 37 replaced 16, it would have the same index in the table T, and since the index is the actual
indicator of the meaning of a message, then 37 would have the same meaning as 16 but with a
10. 46 Computer Science & Information Technology (CS & IT)
different visible value. In other words, the next time A sends a CHECKSTAT order, or receives an
OK response, the visible value in the message would be 37.
7.2. Simulation
To test our protocol, we created a simulation of the lamp example using a python script on an
Intel i5 CPU (2.60GHz*4) with 4GB of ram. We used the last version of the protocol which
includes the following:
• All data are in 16-bits (table values, substitution-boxes values, coded messages, etc.)
• Asynchronous communication between twin security boxes.
• Many additional security measurements to make sure the security requirements are fulfilled.
• An improved version of the f function responsible for changing the secret table.
• Dynamic substitution boxes.
• An improved and secured use of messages sequencing.
• Possibility to send and receive unanticipated messages instead of expected signals only. This
option reduces the performance.
• A resend option to be able to resend unreceived or erroneous messages.
During our simulations we were able to test different architectures with multiple devices, security
boxes, and ports. Simulations were successful and showed no direct patterns on millions of
communicated messages.
With all the security measurements implemented, we were able to communicate 4000 messages
per second for each twins.
8. CONCLUSION
The SCADA community is looking for a security protocol that has a low cost and does not need
constant upgrades. The protocol should also respect the constraints of SCADA such as the low
computational power and the real-time environment.
Our security protocol can be a solution to SCADA security since on one side it has a good level
of security based on simple operations and on the other side it does not require for the already
installed system to change nor to stop working.
The most important security concerns (confidentiality, integrity, and availability) are taken into
consideration. The simplicity of the used functions would outplay cryptographic algorithms in the
matter of performance especially in the case of embedded devices.
No direct patterns were found, still, we have to continue analysing our protocol for indirect
patterns.
We have already advanced in the design of the protocol to be able to communicate normal
messages instead of a pre-set of values. We have also added a number of security measurements
that consider potential attacks on the basic version of the protocol.
We may find uses of our protocol outside of the SCADA community if the requirements are met
and the constraints are respected. For the moment, we focus our work on SCADA systems.
We are currently tuning our simulation to achieve the best possible performance.
We will soon implement our latest version of the protocol on a SCADA platform that we acquire.
We have also considered collecting the communicated packages and diffuse them for white hat
analysis.
11. Computer Science & Information Technology (CS & IT) 47
We consider doing some security analysis to test the robustness of our protocol against specific
attacks such as correlation and differential power analysis.
We are working with other partners that wish to implement our security protocol in their latest
project which aims to put sensors on the repeaters of submarine communication lines to observe
and forward information to a research centre.
ACKNOWLEDGEMENTS
The authors would like to thank research engineer Ciprian Teodorov for his encouragements,
reviews, and valuable comments. The authors would also like to thank all colleagues that
influenced this work.
FUNDING
Funded by the French Government Defence procurement and technology agency - Information
department (DGA-MI) and the urban community “Brest Métropole” (BMO).
REFERENCES
[1] Igure, V.M., Laughter, S.A. and Williams, R.D., 2006. Security issues in SCADA networks.
Computers & Security, 25(7), pp.498-506.
[2] Pollet, J., 2002, November. Developing a solid SCADA security strategy. In Sensors for Industry
Conference, 2002. 2nd ISA/IEEE (pp. 148-156). IEEE.
[3] Bowen, C.L., Buennemeyer, T.K. and Thomas, R.W., 2005, June. Next generation SCADA security:
best practices and client puzzles. In Proceedings from the Sixth Annual IEEE SMC Information
Assurance Workshop (pp. 426-427). IEEE.
[4] Chandia, R., Gonzalez, J., Kilpatrick, T., Papa, M. and Shenoi, S., 2007, March. Security strategies
for SCADA networks. In International Conference on Critical Infrastructure Protection (pp. 117-131).
Springer US.
[5] Nicholson, A., Webber, S., Dyer, S., Patel, T. and Janicke, H., 2012. SCADA security in the light of
Cyber-Warfare. Computers & Security, 31(4), pp.418-436.
[6] Vernam, G.S., 1919. Secret signaling system. U.S. Patent 1,310,719.
[7] Verfahren, 1923. Device and circuit for News About averaging in cipher. Google Patents DE 371,087.
Available: https://www.google.com/patents/DE371087C?cl=en
[8] Shannon, C.E., 1949. Communication theory of secrecy systems. Bell system technical journal, 28(4),
pp.656-715.
AUTHORS
Fadi Obeid is a PhD student at ENSTA Bretagne. He is currently researching security solutions for
SCADA systems. He received his masters degree in information security and cryptology from the
university of Limoges in 2013. He is mainly interested in side channel analysis, security properties
verification using model checking, and unbreakable security protocols.
Philippe Dhaussy is a professor at CNRS Lab-STICC within ENSTA Bretagne. His expertise and his
research interests include model-driven software engineering, formal validation for real time systems and
embedded software design. He has an engineer degree in computer science from ISEN (French Institute of
Electronics and Computer Science) in 1978 and received his PhD in 1994 at Telecom Bretagne (France)
12. 48 Computer Science & Information Technology (CS & IT)
and his HDR in 2014. From 1980 to 1991, he had been software engineer and technical coordinator in
consulting companies (Atlantide group), mainly in real-time system developments. He joined ENSTA-
Bretagne in 1996, as professor. He has over 60 publications in the areas of software engineering and
computer science. He has been co-supervisor for five PhD students, has been and is involved in several
research projects as work package coordinator.