Running Feature: Control system security technologies for achieving cyber resilience (Part 3) Security verification with attack and defense in industrial control system testbeds | DiGiTAL T-SOUL

First, let’s look at what the red team does. Defending an ICS from an attacker requires knowledge of as many cyber-attack vectors as possible. This is because in recent years there has been a rise in the number of cases in which attackers perform a chain of multiple attacks, such as those in a cyber kill chain^[5], to achieve their ultimate target of stealing information or denial of services. Red teams are needed to deliberate attack scenarios from the perspective of an attacker. An attack scenario refers to a series of attack methods and attack paths that lead from the entry point to the final damage. Additionally, the red teams are needed knowledge to deliberate attack methods and attack goals, taking into account the specific characteristics of ICSs. To do so, it is vital that the red team is knowledgeable about the latest cyber-attack trends and has a high level of skill and know-how regarding ICS security. That is why our researchers and engineers—security experts who are well-versed in trends and technologies—are members of these red teams.

Red teams are using the knowledge they gain through these activities in a growing number of ICS development sites. The Toshiba Group develops a wide range of products and systems, supplying them to customers. Efficiently investigating potential attacks on all Toshiba products and systems is a vital task for ensuring their safety and security.

We are currently researching and developing methods for automated attack path planning and validation based on attackers’ perspectives and the characteristics of ICSs. This is being done by leveraging the expertise of red teams and detailing processes for investigating the ICS attack scenarios thought up by attackers. Specifically, we are automatically generating attack scenarios based on system configuration and vulnerability information and, when it is possible within these scenarios to use existing attack modules, performing these attacks automatically to investigate the strength of system security.  We are researching and developing these technologies under the theme of “cyber-attack emulation technologies.”^[6]

Engineers who develop products and systems can use ICS testbeds with these technologies to evaluate security measures from an attacker’s perspective. Furthermore, by building up hands-on experience with ICS security, we aim to develop an even higher level of ICS security experts.

Next, let’s look at what the blue team does. The blue team investigates and verifies measures for identifying and protecting against the attack surface of sequences of cyber-attacks thought up by the red team, for rapidly identifying and responding to attacks, for minimizing their impact, and for quickly recovering from them. Conducting verification for sequences of attacks is also important in verifying the effectiveness of defense in depth. In addition to this, the blue team is also responsible for verifying the impact on ICS operation and safety that results from implementing security measures for protecting ICSs and from responding to incidents by taking steps such as disconnecting networks.

Specifically, the blue team embeds Toshiba security solutions and the security solutions of startups with cutting-edge technologies in ICS testbeds and evaluates those solutions. For example, the blue team embeds an intrusion detection system for ICSs in the environment and investigates rules and configurations that would enable it to accurately detect cyber-attacks. By doing this, we are developing methods for determining, with a greater level of accuracy, if ICS behavior that is out of the ordinary is non-problematic or it is abnormal behavior caused by a cyber-attack. ICS testbeds are used to launch attacks on new security-related products and services with plans for future commercial release to verify that they provide the benefits expected of them.