Vulnerability modelling for hybrid industrial control system networks

Attiq Ur-Rehman, Iqbal Gondal, Joarder Kamruzzaman, Alireza Jolfaei*

*Corresponding author for this work

Research output: Contribution to journalArticle

Abstract

With the emergence of internet-based devices, the traditional industrial control system (ICS) networks have evolved to co-exist with the conventional IT and internet enabled IoT networks, hence facing various security challenges. The IT industry around the world has widely adopted the common vulnerability scoring system (CVSS) as an industry standard to numerically evaluate the vulnerabilities in software systems. This mathematical score of vulnerabilities is combined with environmental knowledge to determine the vulnerable nodes and attack paths. IoT and ICS systems have unique dynamics and specific functionality as compared to traditional computer networks, and therefore, the legacy cyber security models would not fit these advanced networks. In this paper, we studied the CVSS v3.1 framework’s application to ICS embedded networks and an improved vulnerability framework, named CVSSIoT-ICS, is proposed. CVSSIoT-ICS and CVSS v3.1 are applied to a realistic supply chain hybrid network which consists of IT, IoT, and ICS nodes. This hybrid network is assigned with actual vulnerabilities listed in the national vulnerability database (NVD). The comparison results confirm the effectiveness of CVSSIoT-ICS framework as it is equally applicable to all nodes of a hybrid network and evaluates the vulnerabilities based on the distinct features of each node type.

Original languageEnglish
Number of pages16
JournalJournal of Grid Computing
DOIs
Publication statusE-pub ahead of print - 4 Jul 2020

Keywords

  • Industrial control system
  • Internet of things (IoT)
  • Security
  • Supply chain
  • Vulnerability modelling

Fingerprint Dive into the research topics of 'Vulnerability modelling for hybrid industrial control system networks'. Together they form a unique fingerprint.

Cite this