A new model approach for security rule recommendation based on Purdue architecture-aware topology inference and asset communication for ICS

Öz

Industrial control systems (ICS) have complex communication structures with different network architectures due to their operating structure. Although secure network architecture constraints are defined by global standards, different industrial network architectures emerge due to different interpretations. Within the scope of cyber security, ICS network segmentation and extraction of communication rules between assets are important security issues supported by international standards. In this study, a method is proposed in which the network locations of the entities and the services they offer to each other are defined by matrices, independently of the preferred network architectures, and the process-based access rules on the Firewall are derived from the results obtained from the created matrices. The network architecture and assets in the CENTER [1] infrastructure were used as test scenarios for this method, which offers flexible modeling without process dependency. As a result of the developed inference method, it was determined that the architecture used in the test environment and the process-based Firewall rules matched one-to-one. In addition, the widely used Defense in Depth (DiD) strategy, the security compliance recommended by NIST 800-82, and IEC 62443 standards were also tested.

Anahtar Kelimeler

• Topology inference
• ICS architecture
• secure architecture
• ICS modelling

EKS için Purdue mimarisi uyumlu topoloji çıkarımı ve varlık iletişimine dayalı güvenlik kural önerisi yapan yeni bir model yaklaşımı

Öz

Endüstriyel kontrol sistemleri (EKS), çalışma yapısı gereği farklı ağ mimarilerinde olan karmaşık iletişim yapısına sahip sistemlerdir. Güvenli ağ mimarisi kısıtları, global standartlar ile tanımlansa da farklı yorumlamalardan dolayı birbirinden farklı endüstriyel ağ mimarileri ortaya çıkmaktadır. Siber güvenlik kapsamında EKS ağ segmentasyonu ve varlıklar arası iletişim kurallarının çıkarımı uluslararası standartlar ile desteklenen önemli bir güvenlik konusudur. Bu çalışmada tercih edilen ağ mimarilerinden bağımsız bir şekilde varlıkların bulundukları ağ konumlarının ve birbirlerine sundukları hizmetlerin matrisler ile tanımlandığı ve oluşturulan matrislerden elde edilen sonuçlar ile de Firewall (Güvenlik Duvarı) üzerinde proses temelli erişim kurallarının çıkarımının yapıldığı bir yöntem önerilmiştir. Proses bağımlılığı olmayan, esnek bir modelleme sunan bu yöntem için test senaryosu olarak CENTER [1] altyapısındaki ağ mimarisi ve varlıkları kullanılmıştır. Geliştirilen çıkarım yöntemi sonucunda test ortamında kullanılan mimari ile proses temelli Firewall kurallarının birebir örtüştüğü tespit edilmiştir. Ayrıca yaygın kullanılan Derinlemesine Savunma (Defence in Depth-DiD) stratejisi, NIST 800-82 ve IEC 62443 standartlarının önerdiği güvenlik uyumu da test edilmiştir.

Anahtar Kelimeler

• Topoloji çıkarımı
• EKS mimarisi
• güvenli mimari
• EKS modelleme

Kaynakça

1. 1. Kritik Altyapılar Ulusal Test Yatağı Merkezi. https://center.sakarya.edu.tr/. Erişim tarihi Şubat 02, 2024.
2. 2. SANS, ICS410 SCADA Reference Model. https://sansorg.egnyte.com/dl/eQu4hT5fCW Yayın tarihi Eylül 1, 2021. Erişim tarihi Şubat 11, 2024.
3. 3. Fortinet. OT asset visibility and network topology. https://docs.fortinet.com/document/fortigate/7.6.0/administration-guide/880597/ot-asset-visibility-and-network-topology. Erişim tarihi Şubat 11, 2024.
4. 4. Checkpoint. Blueprint for Securing Industrial Control Systems. https://www.checkpoint.com/downloads/products/cp-industrial-control-ics-security-blueprint.pdf Yayın tarihi Mayıs, 2020. Erişim tarihi Şubat 11, 2024.
5. 5. David Garton. https://www.energy.gov/sites/default/files/2022-10/Infra_Topic_Paper_4-14_FINAL.pdf. Yayın tarihi Aralık 12, 2019. Erişim tarihi Mart 15, 2024.
6. 6. Stephen Mathezer. Introduction to ICS Security Part 3. https://www.sans.org/blog/introduction-to-ics-security-part-3/. Yayın tarihi Ekim 1, 2021. Erişim tarihi Mart 15, 2024.
7. 7. Makrakis G. M., Kolias C., Kambourakis G., Rieger C., Benjamin J, Industrial and Critical Infrastructure Security: Technical Analysis of Real-Life Security Incidents, IEEE Access, 9, 165295–165325, 2021.
8. 8. Klaer B., Sen O., Van Der Velde D., Hacker I., Andres M., Henze M., Graph-based model of smart grid architectures, International Conference on Smart Energy Systems and Technologies (SEST), İstanbul- Türkiye, 5-7 Eylül, 2020.

9. 9. ISA. Quick Start Guide: An Overview of ISA/IEC 62443 Standards Security of Industrial Automation and Control Systems. https://gca.isa.org/hubfs/ISAGCA%20Quick%20Start%20Guide%20FINAL.pdf. Yayın tarihi Haziran, 2020. Erişim tarihi Mart 15, 2024.
10. 10. Casola V., De Benedictis A., Mazzocca C., Montanari R., Designing Secure and Resilient Cyber-Physical Systems: A Model-Based Moving Target Defense Approach, IEEE Trans. Emerg. Top. Comput., 12 (2) 631–642, 2024.
11. 11. Carreño I. L., Scaglione A., Zlotnik A., Deka D., Sundar K., An adversarial model for attack vector vulnerability analysis on power and gas delivery operations, Electr. Power Syst. Res.,189, 106777, 2020.
12. 12. Hou T., Wang T., Lu Z., Liu Y., Combating Adversarial Network Topology Inference by Proactive Topology Obfuscation, IEEE/ACM Trans. Netw., 29 (6) 2779–2792, 2021.
13. 13. Sharma P., Bucci D. J., Brahma S. K., Varshney P. K., Communication Network Topology Inference via Transfer Entropy, IEEE Trans. Netw. Sci. Eng., 7 (1) 562–575, 2020.
14. 14. Testi E., Favarelli E., Pucci L., Giorgetti A., Machine Learning for Wireless Network Topology Inference, 13th International Conference on Signal Processing and Communication Systems (ICSPCS), Australia, 1-7, 2019.
15. 15. Sheng C., Yao Y., Fu Q., Yang W., A cyber-physical model for SCADA system and its intrusion detection, Comput. Networks, 185, 107677, 2021.
16. 16. Elbüz A., Osmanoğlu M., ve Tanrıöver Ö., A SysML-based approach for designing an ideal blockchain-based data trading platform, Journal of the Faculty of Engineering and Architecture of Gazi University. 39 (1), 509–519, 2023.
17. 17. Checkpoint. Claroty Continuous Threat Detection & Check Point Next-Generation Firewall. https://web-assets.claroty.com/resource-downloads/2021_q1_global_check_point_ngfw_integration_brief.pdf. Erişim tarihi Mart 15, 2024.
18. 18. Seno L., Cheminod M., Bertolotti I. C., Durante L. and Valenzano A., Improving performance and cyber-attack resilience in multi-firewall industrial networks, IEEE 18th International Conference on Factory Communication Systems (WFCS), Pavia- Italy, 1-8, 2022.
19. 19. Alicea M., Alsmadi I., Misconfiguration in firewalls and network access controls: Literature review, Futur. Internet, 13 (11), 2021.
20. 20. D. Ranathunga, M. Roughan, P. Tune, P. Kernick, and N. Falkner, ForestFirewalls: Getting Firewall Configuration Right in Critical Networks (Technical Report), Available: http://arxiv.org/abs/1902.05689, 2019
21. 21. Keith Stouffer, Michael Pease, CheeYee Tang, Timothy Zimmerman, Victoria Pillitteri, and Suzanne Lightman, Adam Hahn, Stephanie Saravia, Aslam Sherule, Michael Thompson, Guide to Operational Technology (OT) Security. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r3.pdf. Yayın tarihi Eylül, 2023. Erişim tarihi Mart 15, 2024.
22. 22. Forescout. How to Effectively Implement ISA 99 / IEC 62443. https://tech-resource.biz-tech-insights.com/landing-pages/Forescout/How_to_Effectively_Implement/how-to-effectively-implement-isa-99-iec-62443-lp.pdf. Erişim tarihi Mart 15, 2024.
23. 23. Ozcelik I., Iskefiyeli M., Balta M., Toker F. S., Testbed Infrastructure Proposal (Center Energy) for Electricity Power Grid and Defence in Depth Practice on The Proposal, IJISS, 11 (2), 52–68, 2022.
24. 24. Uslar M., Rohjans S., Neureiter C., Andrén F.P., Velasquez J., Steinbrink C., Efthymiou V., Migliavacca G., Horsmanheimo S., Brunner H., Strasser T.I, Applying the smart grid architecture model for designing and validating system-of-systems in the power and energy domain: A European perspective, Energies, 12 (2), 2019.
25. 25. Hooshyar H., Vanfretti L., A SGAM-based architecture for synchrophasor applications facilitating TSO/DSO interactions, IEEE Power Energy Soc. Innov. Smart Grid Technol. Conf., Washington DC- USA, 23-26 Nisan, 2017.
26. 26. Elkhawas A. I., Azer M. A., Security Perspective in RAMI 4.0, 13th Int. Conf. Comput. Eng. Syst. Cairo- Egypt, 151–156, 18-19 Aralık, 2019.
27. 27. Ma Z., Hudic A., Shaaban A., Plosz S., Security viewpoint in a reference architecture model for cyber-physical production systems, IEEE European Symposium on Security and Privacy Workshops (EuroS&PW), Paris- Fransa, 153-159, 26-28 Nisan, 2017
28. 28. IEC. IEC 62443 Background. https://syc-se.iec.ch/deliveries/cybersecurity-guidelines/security-standards-and-best-practices/iec-62443/. Erişim tarihi Mart 25, 2024.
29. 29. Muhammad Yousuf Faisal. OT Security Dozen Part 3: Network Security Architecture & Segmentation. https://gca.isa.org/blog/ot-security-dozen-part-3-network-security-architecture-segmentation. Erişim tarihi Nisan 15, 2024.
30. 30. Siddhant Shrivastava. BlackEnergy- Malware for Cyber-Physical Attacks. https://itrust.sutd.edu.sg/wp-content/uploads/2016/10/itrust-analysis-blackenergy.pdf Yayın tarihi Mayıs, 2016. Erişim tarihi Ocak 25, 2024.
31. 31. S4Events. Havex Deep Dive. https://www.youtube.com/watch?v=SyupAcnURtA Yayın tarihi Eylül 4, 2017. Erişim tarihi Mart 25, 2024.
32. 32. MITRE ATT&CK. Assets. https://attack.mitre.org/assets/. Erişim tarihi Mart 25, 2024.
33. 33. Michael Assante; Tim Conway; Robert Lee. Analysis of the Cyber Attack on the Ukrainian Power Grid. https://ics.sans.org/media/E-ISAC_SANS_Ukraine_DUC_5.pdf. Yayın tarihi Mart 18, 2016. Erişim tarihi Şubat 5, 2024.
34. 34. CISA. Safety System Targeted Malware (Update B) https://www.us-cert.gov/sites/default/files/documents/MAR-17-352-01 HatMan- Safety System Targeted Malware %28Update B%29.pdf. Yayın tarihi Şubat 27, 2019. Erişim tarihi Şubat 5, 2024.
35. 35. Dragos Inc. CRASHOVERRIDE: Analysis of the Threat to Electric Grid Operations https://www.dragos.com/wp-content/uploads/CrashOverride-01.pdf. Yayın tarihi 2017. Erişim tarihi Şubat 5, 2024.
36. 36. Ozcelik I., Iskefiyeli M., Balta M., Akpinar K. O., Toker F. S., CENTER Water: A Secure Testbed Infrastructure Proposal for Waste and Potable Water Management, 9th Int. Symp. Digit. Forensics Secur. Elazığ- Türkiye, 1-7, 28- 29 Haziran, 2021.
37. 37. Robert M. Lee, Tim Conway. The Five ICS Cybersecurity Critical Controls. https://sansorg.egnyte.com/dl/R0r9qGEhEe. Yayın tarihi Ekim, 2022. Erişim tarihi Şubat 5, 2024.
38. 38. Joe Slowik. Anatomy of an attack: Detecting and defeating Crashoverride. https://www.virusbulletin.com/uploads/pdf/magazine/2018/VB2018-Slowik.pdf. Yayın tarihi Ekim 12, 2018. Erişim tarihi Şubat 5, 2024.
39. 39. Christopher Nourrie. Pivoting Between Corporate IT and OT Networks with Network Shell. https://www.dragos.com/blog/pivoting-between-corporate-it-and-ot-networks-with-network-shell/. Yayın tarihi Eylül 3, 2022. Erişim tarihi Şubat 5, 2024.