We perform a detailed survey and analysis of the most significant attacks that have targeted Industrial Control Systems over the past decade, based on detailed incident reports from scientific and non-traditional resources. This work is the first that considers together a comprehensive set of real world cyber-attacks with the purpose of deriving a set of common features focusing particularly on the process control network. Each attack is decomposed to provide a comprehensive overview followed by a discussion of the commonalities identified across attacks. To achieve this, each attack is modelled using Attack Trees with Sequential AND, and mapped to the ICS Cyber Kill Chain. We focus on the methods of intrusion rather than the identification of actors. This paper can be read in two parts, firstly an analysis of each attack, and secondly a discussion of the derived commonalities. The resulting commonalities can be used to develop improved detection strategies to detect modern adversarial techniques and tactics.
Tool for generating Attack Trees with Sequential AND https://gitlab.com/PMaynard/attack-tree-generator and attack tree sources.
Oxford Journal of Cybersecurity (2020)
Attack Trees, Black Energy, Control System, CrashOverride, Duqu2.0, German Steel Mill, Havex, ICS, SCADA, Security, Sequential AND, Stuxnet, TRISIS, Ukraine Power Outages
@journal{
author = "Peter Maynard and Kieran McLaughlin and Sakir Sezer",
title = "Decomposition and Sequential-AND Analysis of Known Cyber-Attacks on Critical Infrastructure Control Systems",
journal = "Oxford Journal of Cybersecurity",
year = "2020",
doi = "https://doi.org/10.1093/cybsec/tyaa020"
}