A Taxonomy of Attacks on the DNP3 Protocol

Abstract

Distributed Network Protocol (DNP3) is the predominant SCADA protocol in the energy sector-more than 75% of North American electric utilities currently use DNP3 for industrial control applications. This paper presents a taxonomy of attacks on the protocol. The attacks are classified based on targets (control center, outstation devices and network/communication paths) and threat categories (interception, interruption, modification and fabrication). To facilitate risk analysis and mitigation strategies, the attacks are associated with the specific DNP3 protocol layers they exploit. Also, the operational impact of the attacks is categorized in terms of three key SCADA objectives: process confidentiality, process awareness and process control. The attack taxonomy clarifies the nature and scope of the threats to DNP3 systems, and can provide insights into the relative costs and benefits of implementing mitigation strategies.

New Security Development and Trends to Secure the SCADA Sensors Automated Transmission during Critical Sessions

“…Due to open connectivity, DNP3 has been vulnerable to Internet attacks; most DNP3 devices are configured, and communicate without any proper authentication mechanism or have little protection in the SCADA network against vulnerabilities [23][24][25][26][27][28][29][30]. Cryptography based security mechanisms [31] have been proposed for DNP3 by DNP3 users group, in which symmetric and asymmetric methods are defined and a detailed description of challenge-response technique is made to examine the security goals (or parameters), such as authentication and integrity, and to protect the transmission against attacks, such as replay, spoofing, and modification attacks [8,32,33], at the application layer. However, many limitations are accounted for in DNP3 security design and development, and most of the work is in initial phases or still in the development phases.…”

Recovery Measure against Disabling Reassembly Attack to DNP3 Communication

“…The DNP3 protocol is widely used in the Industrial Control Systems (ICS) network. More than 75% of power utilities in North America reported using the DNP3 protocol as part of their Supervisory Control and Data Acquisition (SCADA) system [9]. Therefore, we chose the DNP3 protocol to describe attacks and recovery measures.…”

A cyber-physical experimentation environment for the security analysis of networked industrial control systems

“…Nowadays CIs, or more specifically Networked Industrial Control Systems (NICS), are exposed to significant cyber-threats; a fact that has been highlighted by many studies on the security of Supervisory Control And Data Acquisition (SCADA) systems [1,2,3]. For example, the recently reported Stuxnet worm [4] is the first malware specifically designed to attack NICS.…”

“…For example, the recently reported Stuxnet worm [4] is the first malware specifically designed to attack NICS. Its ability to reprogram the logic of control hardware in order to alter the operation of industrial processes demonstrated how powerful such threats can be; it served Email addresses: bela.genge@jrc.ec.europa.eu (Béla Genge), christos.siaterlis@jrc.ec.europa.eu (Christos Siaterlis), igor.nai@jrc.ec.europa.eu (Igor Nai Fovino), marcelo.masera@jrc.ec.europa.eu (Marcelo Masera) 1 Currently, the author affiliations have changed as described in the author bios as a wakeup call for the international security community. Stuxnet raised many open questions, but most importantly it highlighted the lack of an efficient scientific approach to conduct experiments that measure the impact of cyber threats against both the physical and the cyber parts of CIs.…”