A post by Professor Chris Hankin, Director ISST
Operational Technology (OT), as distinct from Information Technology (IT), refers to the hardware and software that controls an industrial process. Despite increasing similarities between OT and IT architectures and components there are quite fundamental differences in the make-up of cyber attacks on each. In To Kill a Centrifuge, an in-depth technical analysis of the Stuxnet attack, Ralph Langner has already identified three distinct layers of a sophisticated cyber-physical attack: the IT, the Industrial Control Systems (ICS) and the physical layers. The SANS Institute in the U.S. has recently published an anatomy of cyber attacks on ICS, involving two multi-phase stages: 1) cyber intrusion preparation and execution – what can be thought of as intelligence gathering; and 2) ICS attack development and execution.
Since it is generally the physical damage that grabs headlines, and there hasn’t been much news about attacks on ICS, one must assume that a significant proportion of the incidents reported to ICS-Cert each year (roughly 250) are intelligence gathering operations. The recent attack on the Ukrainian power grid may have added a third, post-attack stage – a distributed denial of service (DDoS) attack on the energy company to prevent reporting of outages and slow down the restoration of power.
Against this backdrop, the UK government sponsored Research Institute in Trustworthy ICS (RITICS) is addressing three key questions:
- Can we develop frameworks for assessing the physical harm that might arise from cyber attacks?
- Can we better communicate risk that arises from cyber threats?
- Can we develop new defensive measures?
RITICS is hosted at Imperial College London and is a partnership of 5 universities: Imperial, Queen’s University Belfast, the University of Birmingham, Lancaster University and City University London.
We are approaching Question 1 with use-cases from transport and energy; Question 2 with use-cases from transport, energy and water; and Question 3 with use-cases from energy. It is still early days in our work, but we hope to offer new insights and techniques to ICS providers, owners and operators – and we are open to new industrial partners.
