Analysis of ICS and SCADA Systems Attacks Using Honeypots

Abstract

Supervisory control and data acquisition (SCADA) attacks have increased due to the digital transformation of many industrial control systems (ICS). Operational technology (OT) operators should use the defense-in-depth concept to secure their operations from cyber attacks and reduce the surface that can be attacked. Layers of security, such as firewalls, endpoint solutions, honeypots, etc., should be used to secure traditional IT systems. The three main goals of IT cybersecurity are confidentiality, integrity, and availability (CIA), but these three goals have different levels of importance in the operational technology (OT) industry. Availability comes before confidentiality and integrity because of the criticality of business in OT. One of the layers of security in both IT and OT is honeypots. SCADA honeypots are used as a layer of security to mitigate attacks, known attackers’ techniques, and network and system weaknesses that attackers may use, and to mitigate these vulnerabilities. In this paper, we use SCADA honeypots for early detection of potential malicious tampering within a SCADA device network, and to determine threats against ICS/SCADA networks. An analysis of SCADA honeypots gives us the ability to know which protocols are most commonly attacked, and attackers’ behaviors, locations, and goals. We use an ICS/SCADA honeypot called Conpot, which simulates real ICS/SCADA systems with some ICS protocols and ICS/SCADA PLCs.

A systematic literature review on past attack analysis on industrial control systems

“…For example, an attacker can alter the temperature sensor readings and send inaccurate data to the control system. Actual temperatures deviate from the perceived values, potentially leading to equipment malfunctions, product defects, or safety hazards 45 . In literature, it has been observed that researchers have made an effort to study integrity attacks on ICS from multiple dimensions.…”

“…Actual temperatures deviate from the perceived values, potentially leading to equipment malfunctions, product defects, or safety hazards. 45 In literature, it has been observed that researchers have made an effort to study integrity attacks on ICS from multiple dimensions. The authors, Do et al, 8 Min/Max attacks are the mathematical ways of modeling simple IntA.…”

A Survey of Security Challenges in Cloud-Based SCADA Systems

“…These challenges range from human errors and insuffi-cient resources for physical devices to proprietary protocols and insecure legacy systems. Insecure legacy control interfaces, connections to the internet, connected industrial IoT (IIoT) devices, and various bring-your-own devices (BYODs) [23], along with accidents due to negligence and equipment failures [24], can all serve as entry points to the systems for cyberattacks, introducing vulnerabilities. In addition, unprotected virtual machines, the unavailability of cloud infrastructure [25], account or service traffic hijacking [26], security concerns of industrial automation and analysis devices, inadequate software security mechanisms in many industrial sensors running real-time processes [23], and the omission of proper backdoor capabilities by some manufacturers for managing and updating industrial devices [27] are significant vulnerability factors that organizations need to consider after transitioning to a cloud-based infrastructure.…”

“…Another factor contributing to the vulnerability of cloud-based SCADA systems to various security threats is the lack of protection in some traditional SCADA communication protocols, such as Modbus/TCP , International Electrotechnical Commission (IEC) 60870-5 series, IEC 61850, and DNP3 [15]. These protocols do not support authentication and encryption mechanisms [4,23] and suffer from a lack of protection controls [2]. As a result, these protocols expose system applications running on the cloud to attackers and permit intruders' easy access to private credentials, such as IP addresses and usernames, during cloud use.…”

“…In [23], the authors introduced the SCADA honeypots, specifically a low-interaction honeypot called Conpot, to detect potential malicious activities within SCADA networks. Besides network segmentation, access controls, and intrusion detection systems, organizations can employ honeypots to address the risks of Operational Technology (OT) (e.g., PLCs, RTUs, HMIs, etc.)…”