Selecting suitable industrial security systems based on current threats
Poster: Towards Selecting Threat Appropriate Industrial Intrusion Detection Systems
Cryptography and Security
Summary
Industrial control systems face many changing cyber threats that need quick and effective responses to keep operations safe. The authors propose a way to share threat information so that the best intrusion detector can be chosen for the specific situation. They tested different detectors on various attacks and found their effectiveness varies a lot depending on the attack type. This shows it could be helpful to pick detectors based on the current threat to improve industrial security.
What this means in practice
- •For industrial network security teams: Improve detection accuracy by selecting intrusion detectors that suit current threat types from shared intelligence.
- •For critical infrastructure operators: Adapt security monitoring to evolving attacks by choosing appropriate detection systems informed by counter-threat intelligence sharing.
Authors
Stefan Lenz, Johannes Weidmann, Martin Henze
Abstract
As the threat landscape against industrial control systems is dynamic, effective security requires detection strategies capable of timely reactions to these evolving threat situations. To address this problem, we propose the idea of a counter-threat intelligence sharing based mechanism to select appropriate detectors for current circumstances. To highlight the potential of this mechanism, we conduct attack-level performance evaluations of various intrusion detection systems. Results show the variance of intrusion detection performance depending on the attack scenario, emphasizing the benefits of such a mechanism for industrial control system security