Security of Cyber-Physical Systems

Security Models for Cyber-Physical Systems

There are five well known classes of methods for cyber risk assessment and management for CPSs (Henry et al. 2016). An Expert Elicited Model method involves computational models to assess risk based on expert elicited identification and characterization of cyber system attributes such as network data flows and the estimation of the susceptibility of those resources and data flows to different types of compromise. This approach possesses significant appeal for many applications, including cases involving complicated networks for which little design information is readily available and cases in which a relatively quick analysis is needed. One major drawback of this approach is lack of completeness. Second, the Attack Graph method advocates construction of attack trees or graphs, either by hand or through automated interrogation of a system of interest. This approach has many advantages. Principal among these is a very light data requirement. Models in this class do not suffer precision or fidelity shortcomings because they are constructed directly from system data without abstraction or aggregation. Another advantage of this approach is flexibility. Third, game theoretic models explicitly account for the interaction of attackers and defenders in a game theoretic framework. Models in this class are much more varied, and the approach is much less mature than the expert elicited and graph-based approaches described previously. Games can inform how the playing field can be better tilted in favor of the defender by adopting architectural changes and new access control policies. The fourth method is Petri Net models, which are favored by the authors of this chapter. This chapter’s Petri net approach is derived from the Attack Graph school of thought. A Petri net is a directed bipartite graph, in which a cyber attack is modeled as the successive exploitation of vulnerabilities on hosts to escalate and then exploit privileges on the network. The final method described involves stochastic games overlaid on Petri nets, creating a much more powerful, and more challenging, approach. In this model, transitions based on attacks corresponding to network defense measures replace exploit-specific transitions.

Security models can be useful for estimating risk and other security metrics. Metrics are defined as measurable properties of a system that quantify the degree to which objectives of the system are achieved. Metrics can provide cyber defenders of a CPS with critical insights regarding the system. Metrics are generally acquired by analyzing relevant attributes of that system.

In terms of cyber security metrics, CPSs tend to have unique features: in many cases, these systems are older technologies that were designed for functionality rather than security. They are also extremely diverse systems that have different requirements and objectives. Therefore, metrics for CPSs must be tailored to a diverse group of systems with many features and perform many different functions.

As described in the previous section, in our ARL CPS research, we visualize three layers for the control system: physical, cyber, and process. See Figure 2, for example, which we used to describe our intrusion detection methodology. We use the same 3-layer model to construct a security model for CPSs. Our current approach is to use game-theoretical methods similar to Zhu & Basar (2015), who have developed elegant game-theoretic methods for the physical and cyber layers (a 2-layer model).

Game theory has been successfully used for security models for cyber systems. A simplistic cyber encounter between an attacker and a defender (security engineer) can be described by a zero-sum game between two players who both have complete information about the cyber system and their opponent. The rational moves of the two players are well-defined by saddle-points (Nash equilibria points) once the costs and awards are defined over all game strategies. There are some important differences between CPS attack scenarios and a simplistic security game.

As mentioned, CPSs are not merely cyber networks. They are connected to physical systems and are affected by the physical systems. Attacks focused on the physical system can penetrate into the cyber network. In addition, the operator of the control process is an important player to consider. He or she dutifully monitors critical elements of the process and makes optimal choices to maintain system operability given policy constraints dictated by the system owner. There are clearly more players and more systems to consider than the attacker and defender in the simplistic game. Our three-game model in which defender and attacker play in the cyber regime, physical control devices and perturbations (intentional or accidental) play in the physical regime, and operator and system owner play in an abstracted process regime. All three regimes and all players can affect each other in this complex game.

Next, one nominally assumes that if all of the information in the game is readily available to the players, the players will choose the optimal path so that they suffer the least cost. If cost is a monetary measure, this may not be true, especially for state-sponsored attackers. Their defensive opponent however may indeed act to minimize monetary costs. Even if cost measures were completely known of all players, players are inefficient and often not rational. They can be coerced by psychological affects or swayed by political demands of their peers and supervisors. For extended attacks, multiple humans may play the part of a single actor. Human behavior can be modelled in some circumstances so that these uncertainties can be taken into account.

Lastly, assuming costs and behavior can be modelled well, the attacker will often not have complete knowledge of the three regimes when they begin their attack. They may have done some reconnaissance work, but will be missing important pieces of information. This lack of information will affect their instantaneous strategy, and their path taken through attack space may be highly dependent on the amount of information available. Incomplete-information game models using Bayesian methods can be used to accommodate this effect.

After the analytical model for the 3-layer games is developed, we can use linear methods to solve models for internal variables of the game-theoretical model. As expected, the plant operator or plant SME will need to collaborate with the security engineer to configure the game parameters, but internal security model parameter can be used to construct security metrics which can be compared between systems. This can be compared with security metrics based on hardware vulnerability assessments when the systems have diverse hardware.