Twin Based Continuous Patching To Minimize Cyber Risk

Abstract

Digital twins are virtual replicas to simulate the behavior of physical devices before they are built and to support their maintenance. We extend this technology to cybersecurity and integrate it with adversary emulation to define a remediation policy that selects and schedules patches for the vulnerabilities of an information and communication infrastructure before threat actors can exploit them. Distinct twins model, respectively, the infrastructure and threat actors. The former twin describes the infrastructure modules, their vulnerabilities, and the elementary attacks actors can implement. The attributes of the twin of a threat actor describe its attack surface, its goals, how it selects attacks, and it handles attack failures. The Haruspex software platform builds the twins of the infrastructure and those of the threat actors, and it automates the emulation of an actor. In this way, it can discover the attack paths the actor implements without disturbing the infrastructure. In each path, the actor composes elementary attacks to reach its goal. Multiple emulations can discover all the paths of an actor by covering stochastic factors such as attack success or failure. The knowledge of these paths enables the remediation policy to minimize the patches to deploy. Since new vulnerabilities continuously become public, new countermeasures are needed. A twin-based approach supports a continuous remediation process to handle changes in the infrastructure, new vulnerabilities, and new threat actors because the platform can update the twins and run adversary emulations. If new attack paths exist, the platform applies the remediation policy. Experimental data confirm the effectiveness of this approach.

Leveraging Digital Twin Technology for Enhanced Cybersecurity in Cyber–Physical Production Systems

“…Nevertheless, there is a limited effort in integrating DTs into cybersecurity assessments, especially in the area of mitigation prioritization [15]. In this paper, we focus on using DT in vulnerability analysis and virtual patches to support the prioritization of potential mitigation strategies.…”

“…Digital twin (DT) [14]-based methods emerge as a solution to address the gaps of asset management complexities [9,10] and vulnerable component patch prioritization [15], while protecting the monitoring of industrial assets [16,17]. DT methods, by functioning as virtual replicas of physical components, offer critical insights by aggregating asset-specific data and enabling analytics [18,19], or act as service providers through additive manufacturing [20].…”