Industrial control systems audited for late recovery attack risks
RISK: Auditing Industrial Control Systems for Too-Late-to-Recover Vulnerabilities
Cryptography and Security
Summary
Industrial control systems manage important processes like factories and power plants, and it's crucial to keep them secure. Most security checks focus on spotting attacks, but this paper looks at what happens after an attack is detected: can the system still recover safely? The authors discovered a type of vulnerability where an attack can drain the system's ability to recover before it even gets noticed, making recovery impossible. They built a tool called RISK that automatically finds these hard-to-detect attack scenarios and tested it in labs and a real fertilizer plant, finding critical issues missed by other tools.
What this means in practice
- •For industrial control system operators: Identify hidden vulnerabilities that prevent safe recovery after attacks in critical infrastructure environments.
- •For security tool developers: Enhance existing ICS security products by integrating comprehensive audits of detection and recovery phases.
Authors
Syed Ghazanfar Abbas, Gang Wang, Dongyan Xu
Abstract
The security of industrial control systems (ICS) is important. Yet most ICS security efforts focus on the detection of ICS attacks, with much less attention to the recovery after detection. In this paper, we address this underexplored area by jointly auditing the detection and recovery of ICS. Specifically, we define the too-late-to-recover (TLTR) vulnerability, which allows an attack to drain the available recovery margin before being detected, such that the subsequent recovery procedure will fail to bring the ICS back to a safe state due to the insufficient margin. To audit an ICS for TLTR vulnerabilities, we develop RISK, an automated framework that discovers and validates possible TLTR attack scenarios. RISK holistically models and analyzes, statically and dynamically, the PLC control logic, attack detection policies, recovery procedures, and operational behaviors of an ICS to generate TLTR attack scenarios with concrete attack parameters. We evaluate RISK on three ICS testbeds as well as a real-world fertilizer production plant. Across the three testbeds, a total of 392 TLTR attacks are generated and confirmed, whereas only a small fraction of them can be discovered by existing ICS vetting tools. In the real-world plant, RISK identified a critical TLTR vulnerability which was validated by plant engineers.