The integration of smart grid technologies in energy infrastructures is a significant shift towards efficient, sustainable and reliable electricity management, but it also brings cyber security challenges to the forefront. This study delves into the cyber security vulnerabilities of key smart grid assets such as smart meters, advanced metering infrastructure systems and distributed energy resources such photovoltaic systems, virtual power plants and battery parks. A comprehensive threestep methodology is employed to identify attack vectors, analyze attack tactics and specify the appropriate mitigation strategies. The confidentiality, integrity and availability model and MITRE ATT&CK framework are employed to identify the four main attack vectors and specify the appropriate mitigation strategies based on established security principles. The results highlight the need to implement robust security measures to safeguard smart grid assets and offer strategic guidance for addressing the cyber security challenges. The study enriches the discourse on smart grid security by providing actionable insights for improving energy system reliability and resilience.
The widespread adoption of networked devices, sophisticated automation and data-driven processes in industry – also known as Industry 4.0 – has boosted the quantity and quality of manufacturing products. However, the benefits come with substantial increases in the attack surfaces of manufacturing processes and systems. In addition to affecting the quality and readiness of critical products, attacks against manufacturing processes and systems can have severe physical consequences, including human injury and death. This chapter presents the results of remote network-based control injection attacks on a computer numerical control mill. The focus is on the impacts of attacks during computer numerical control mill operation. A machine-agnostic, affordable and scalable solution for attack monitoring is developed by considering the physical effects of the attacks on wax workpieces. A simple threshold-based method for detecting attacks is demonstrated and its effectiveness is evaluated.
Cyber attacks on industrial control systems have increased dramatically due to the adoption of open, heterogeneous industrial protocols that enable remote connectivity to industrial plants. Of particular concern are attacks that impair physical processes, leading to production loss, service outages, equipment damage, human injury and environmental pollution. Given the plethora of consequences induced by cyber attacks on industrial control systems, it is vital to compute the risks associated with the attacks to enable operators to implement appropriate recovery measures. This chapter presents a probabilistic risk assessment methodology that leverages multiple Bayesian networks to measure the risks associated with cyber attacks on industrial control systems. The Bayesian networks are designed to compute the probabilities of detected cyber attacks propagating to cyber and physical assets that have not yet been compromised, thereby providing an estimate of the overall risk to the integrity of the entire industrial control system. The proposed risk assessment methodology is evaluated using a real hardware-in-the-loop case study involving a water distribution testbed.
The integrity of democratic elections relies heavily on the security of electronic voting systems. Dominion Voting Systems' ImageCast X and Election Systems & Software's ExpressVote System are among the most widely used electronic voting systems in the United States. This chapter describes efforts to verify reported vulnerabilities and identify new vulnerabilities in the two electronic voting systems at the hardware and software levels. The goal is to increase the understanding of voting system security and identify areas for improvement in order to safeguard upcoming elections.
The introduction of Industry 4.0 and Internet-based technologies has enhanced industrial control system operations but have inadvertently increased their vulnerabilities to cyber attacks. When an industrial control system is compromised, security analysts need to identify the root cause quickly to start the recovery process and develop mitigation strategies. Memory forensics is critical in the incident analysis process to ascertain what occurred. Approaches for analyzing the persistent memory in industrial control devices are limited and almost nonexistent for volatile memory. This chapter proposes an automated methodology for programmable logic controller memory dump analysis using computer vision and deep learning techniques. The methodology converts the sequences of bytes in a programmable logic controller memory dump to red-green-blue pixels and employs a deep learning model that learns the underlying patterns and features of pre-labeled forensic artifacts in images and segments them into distinct regions. The trained model is employed to automatically segment new memory images and identify forensic artifacts. Evaluation of the methodology on a Schneider Electric Modicon M221 programmable logic controller under code injection and code modification attacks demonstrates its ability to detect attack artifacts in memory dumps.
