Security analysis of an IACS environment: pentesting, exploitation and evaluation of a specialized cyber-detection platform
Monteiro, José Diogo Lopes Teixeira
MSc Thesis · 2019 · University of Coimbra
Supervisors: Paulo Alexandre Ferreira Simões, Tiago José dos Santos Martins da Cruz
Abstract
Industrial Automation and Control Systems (IACS) are used to support Essential Services and Critical Infrastructures and their management process. These systems have benefited, in recent years, with the introduction of increased interconnectivity. Nonetheless, as this management process was introduced to maintain the same infrastructure, which was developed to work in a closed environment, it also raised new security concerns. Securing these critical systems is a vital mission, as failures in these systems can translate directly into the real-world, impacting the physical environment. In order to monitor these systems and ensure its security, an Intrusion and Anomaly Detection System (IADS) was developed in the scope of the Advanced Tools to assEss and mitigate the criticality of ICT compoNents and their dependencies over Critical InfrAstructures (ATENA) project that aims to provide distributed monitorization and anomaly detection. It detects security events through a set of probes deployed on different segments of the infrastructure that are posteriorly analysed and reported to the operator. This thesis aims to give insight on how to perform a security analysis of a testbed while also testing the IADS framework as part of its validation process. These tests consist on triggering a diversity of security events and verifying if they are properly identified and reported. The primary focus is on understanding the testbed and producing attacks that can trigger those events. As a contingency, if the platform was not capable of detecting them, a probe responsible for recognising the attack is developed and deployed, as part of the platform’s security threats mitigation policy.