Safety responses can create attack paths in industrial control systems
Safety Graph: When Safety Responses Become Attack Surfaces in Cyber-Physical Systems
Cryptography and Security
Summary
Industrial control systems, like those managing factories or chemical plants, use safety measures to stop accidents. This paper shows that these safety measures can sometimes be used by hackers as new ways to move deeper into the system and cause more damage. The authors created a new method called Safety Graph that combines different ways to model how attacks and failures spread. They tested it using a chemical plant simulation and found it can spot attack pathways that older models miss. This tool could help operators better understand and protect against complex cyber-physical attacks.
What this means in practice
- •For industrial control operators: Identify hidden attack pathways caused by safety mechanisms to improve system defenses against complex cyber attacks.
- •For chemical plant safety teams: Use Safety Graph modeling to simulate cascading cyber-physical failures during safety events for better risk assessment.
Authors
Rakesh Podder, Philip D. Hopkins, Sarath Sreedharan, Indrakshi Ray, Indrajit Ray
Abstract
Modern industrial control systems (ICS) are susceptible to cyber attacks triggering safety failures in the operational technology (OT) layer. The traditional way to mitigate any failure in OT is to implement safety responses. However, we show in this work that these responses can open up new attack surfaces, thereby vastly expanding the scope of lateral movement. Existing frameworks model cyber-to-physical escalation but provide no mechanism to reason about how these safety responses to OT-failures can trigger new cascading cyber attacks in the Information Technology (IT) layer. To enable such reasoning, we introduce Safety Graph (SG), a formal framework unifying three paradigms - Attack Graphs (AG), Fault Trees (FT), and Event Trees (ET) - over a shared propositional state space, capturing the full bidirectional IT-OT cascade. We provide a sound and complete compilation of SG to a classical AI planning problem, performing plan search using A* to find cross-layer cascade paths. Through a Web3D modeling and simulation of the Tennessee Eastman chemical process plant, which is a widely used chemical engineering benchmark serving as a standard for testing control, monitoring and fault propagation, we demonstrate that the planning compilation of SG automatically discovers safety-response-induced lateral movements, and identifies the responsible barriers that are unidentifiable under existing models. A complexity and scalability analysis characterizes how the planning compilation of SG scales with model size and cascade depth. To the best of our knowledge, SG is the first framework to formally model IT-OT attacks and enable operators to explore the problem of cyber attacks triggering cascading failures in ICS.