LASARUS: Lightweight Attack Surface Reduction for Legacy Industrial Control Systems

Abstract

Many operational Industrial Control Systems (ICSs) were designed and deployed years ago with little or no consideration of security issues arising from an interconnected world. It is well-known that attackers can read and write sensor and actuator data from Programmable Logic Controllers (PLCs) as legacy ICS offer little means of protection. Replacing such legacy ICS is expensive, requires extensive planning and a major programme of updates often spanning several years. Yet augmenting deployed ICS with established security mechanisms is rarely possible. Legacy PLCs cannot support computationally expensive (i.e., cryptographic) operations while maintaining real-time control. Intrusion Detection Systems (IDSs) have been employed to improve security of legacy ICS. However, attackers can avoid detection by learning acceptable system behaviour from observed data. In this paper, we present LASARUS, a lightweight approach that can be implemented on legacy PLCs to reduce their attack surface, making it harder for an attacker to learn system behaviour and craft useful attacks. Our approach involves applying obfuscation to PLC data whenever it is stored or accessed which leads to a continuous change of the target surface. Obfuscation keys can be refreshed depending on the threat situation, striking a balance between system performance and protection level. Using real-world and simulated ICS data sets, we demonstrate that LASARUS is able to prevent a set of well-known attacks like random or replay injection, by reducing their passing rate significantly-up to a 100 times.

DpGuard: A Lightweight Attack Detection Method for an Industrial Bus Network

“…We made the following practical assumptions: we did not consider attacks originating from outside the ICS, such as those originating from side channels [25,26]. Existing work [27,28] and practice have addressed the PLC man-in-themiddle (MITM) problem via non-PLC diode gateways [29], which are therefore out of the scope of this work. Moreover, DpGuard relies on the window host, and its own security was not considered in this work.…”