Abstract
AbstractWhen protecting the Industrial Control Systems against cyber attacks, it is important to have as much information as possible to allocate defensive resources properly. In this paper we estimate the Time-To-Compromise of different Industrial Control Systems attack techniques by MITRE ATT&CK. The Time-To-Compromise is estimated using an equation that takes into consideration the vulnerability data that exists for a specific asset and category of vulnerability. The vulnerability data is derived from an Industrial Control Systems specific vulnerability dataset. As a result, we present the mapping of the attack techniques to assets and categories of vulnerability, which makes it possible to apply specific vulnerabilities to the technique. We also present the method of how to estimate the Time-To-Compromise of the techniques and finally the values of Time-To-Compromise. After mapping the attack techniques to assets and category of vulnerability we are able to estimate the Time-To-Compromise and discuss its trustworthiness.
Funder
Swedish national research Center on Resilient Information and Control Systems
Royal Institute of Technology
Publisher
Springer Science and Business Media LLC
Subject
Computer Science Applications,Computer Networks and Communications,Computer Graphics and Computer-Aided Design,Computational Theory and Mathematics,Artificial Intelligence,General Computer Science
Reference16 articles.
1. Micro T. New Critical Infrastructure Facility Hit by Group Behind TRITON (2019). https://www.trendmicro.com/vinfo/pl/security/news/cyber-attacks/new-critical-infrastructure-facility-hit-by-group-behind-triton Accessed 13 Feb 2023
2. Andreeva O, Gordeychik S, Gritsai G, Kochetova O, Potseluevskaya E, Sidorova SI, Timorin AA. Industrial Control Systems Vulnerability Statistics (2017). https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2016/07/07190426/KL_REPORT_ICS_Statistic_vulnerabilities.pdf Accessed 13 Feb 2023
3. Rencelj Ling E, Ekstedt M. Estimating the Time-To-Compromise of Exploiting Industrial Control System Vulnerabilities. In: Proceedings of the 8th International Conference on Information Systems Security and Privacy - ICISSP, pp. 96–107. SciTePress, Portugal (2022). https://doi.org/10.5220/0010817400003120.INSTICC
4. MITRE ATT &CK: ICS Techniques (2022). https://attack.mitre.org/techniques/ics/ Accessed 13 Feb 2023
5. McQueen MA, Boyer WF, Flynn MA, Beitel GA. Time-to-compromise model for cyber risk reduction estimation. In: Gollmann D, Massacci F, Yautsiukhin A, editors. Quality of Protection. Boston, MA: Springer; 2006. p. 49–64.