Characterizing and Modeling Patching Practices of Industrial Control Systems-Reference-Cited by-同舟云学术

Characterizing and Modeling Patching Practices of Industrial Control Systems

Published:2017-09-18 Issue:1 Volume:45 Page:9-9
ISSN:0163-5999
Container-title:ACM SIGMETRICS Performance Evaluation Review
language:en
Short-container-title:SIGMETRICS Perform. Eval. Rev.

Author:

Wang Brandon¹,Li Xiaoye¹,de Aguiar Leandro P.²,Menasche Daniel S.³,Shafiq Zubair¹

Affiliation:

1. University of Iowa, Iowa City, IA, USA

2. Siemens Corporation, Princeton, NJ, USA

3. Federal University of Rio de Janeiro (UFRJ), Rio de Janeiro, Brazil

Abstract

Industrial Control Systems (ICS) are widely deployed in mission critical infrastructures such as manufacturing, energy, and transportation. The mission critical nature of ICS devices poses important security challenges for ICS vendors and asset owners. In particular, the patching of ICS devices is usually deferred to scheduled production outages so as to prevent potential operational disruption of critical systems. In this paper, we present the results from our longitudinal measurement and characterization study of ICS patching behavior. Our analysis of more than 100 thousand Internet-exposed ICS devices reveals that fewer than 30% upgrade to newer patched versions within 60 days of a vulnerability disclosure. Based on our measurement and analysis, we further propose a model to forecast the patching behavior of ICS devices.

Publisher

Association for Computing Machinery (ACM)

Subject

Computer Networks and Communications,Hardware and Architecture,Software

Link

https://dl.acm.org/doi/pdf/10.1145/3143314.3078524

Reference4 articles.

1. Xuan Feng Qiang Li Haining Wang and Limin Sun. 2016. Characterizing industrial control system devices on the Internet. In IEEE ICNP. Xuan Feng Qiang Li Haining Wang and Limin Sun. 2016. Characterizing industrial control system devices on the Internet. In IEEE ICNP.

2. Wolfgang Kandek. 2009. The laws of vulnerabilities 2.0. (2009). BlackHat Las Vegas NV USA. Wolfgang Kandek. 2009. The laws of vulnerabilities 2.0. (2009). BlackHat Las Vegas NV USA.

3. John Matherly. 2017. Shodan. https://www.shodan.io. (2017). John Matherly. 2017. Shodan. https://www.shodan.io. (2017).

4. Ariana Mirian Zane Ma David Adrian Matthew Tischer Thasphon Chuenchujit Tim Yardley Robin Berthier Joshua Mason Zakir Durumeric J Alex Halderman and others. 2016. An Internet-Wide View of ICS Devices. In IEEE PST. Ariana Mirian Zane Ma David Adrian Matthew Tischer Thasphon Chuenchujit Tim Yardley Robin Berthier Joshua Mason Zakir Durumeric J Alex Halderman and others. 2016. An Internet-Wide View of ICS Devices. In IEEE PST.

Cited by 3 articles. 订阅此论文施引文献订阅此论文施引文献，注册后可以免费订阅5篇论文的施引文献，订阅后可以查看论文全部施引文献

1. Sensitivity Analysis for Vulnerability Mitigation in Hybrid Networks;Electronics;2022-01-12

2. What We Know About Bug Bounty Programs - An Exploratory Systematic Mapping Study;Lecture Notes in Computer Science;2021

3. Analysis and research on network security and privacy security in ubiquitous electricity Internet of Things;Computer Communications;2020-05