A Bio-Immunology Inspired Security Model to Defend Industrial Control Systems from Advanced Persistent Threats

Abstract

Industrial Control Systems (ICS) control critical industrial processes. For example, there are ICS networks that control electricity, water distribution, food, and pharmaceutical and beverage production. Historically, ICS networks were safe from network attacks because they were not interconnected to business Information Technology (IT) networks and the Internet. However, with the passage of time, ICS were interconnected to business networks. Because traditional IT networks are built on the TCP/IP suite, ICS became susceptible to network attacks that already existed in TCP/IP networks and to ICS specific attacks. Successful attacks in ICS networks may compromise the ICS infrastructure, system configurations and components. ICS security standards and frameworks were drafted and approved by different organisations for use in the implementation of ICS security. ICS can be secured using these standards or any other means as recommended by ICS security experts. Even though ICS are secured using these recommended methods, they are still being successfully attacked by Advanced Persistent Threats (APTs). APTs are targeted attacks which are successful because they do not attack any system that they might be in but become active in only those systems they were designed for. APTs have the ability to circumvent available security control and regular intrusion detection systems, and in addition, antiviruses are not able to detect APTs. There is no known technique available to identify APTs that attack ICS because APTs are discovered after they have been in the system for some time and usually only after they have executed their payload. Subsequently, this means that present ICS security implementations are not capable of defending ICS when they are attacked by APTs. By design, ICS security systems should be capable of defending ICS components from any attacks. They are likened to the biological immune system which is responsible for detecting and protecting the biological body from harmful microorganisms. The biological immune system’s most crucial function is that of preventing infections and eradicating already established