Cyber Security Measures for the Industrial Control System in Conjunction with Existing Technology

Modern technology allows devices which used to operate independently to connect to the internet. It increases efficiency and competitiveness of a manufacturing operation process. This technology driven movement is called either Internet of Things (IoT), Industry 4.0 or Industrial Internet, and is expanding worldwide. Accordingly, the operation environment of Industrial Control System (ICS) is changing from closed to open network. Since it used to be designed for the operation in a closed environment, security capability of ICS has not been well considered. However, cyber exploitation of an ICS can result in high impact to the business operation, by causing a physical damage to a facility or a disturbance of manufacturing or research process. Indeed, several ICS related cyber incident were reported in recent years, such as the Ukrainian power facility attack in 2015. We believe that the implementation of additional security measure to ICS is essential for achieving secure and efficient IoT environment. The past incidents suggest that a OPC server which contains hardware communication protocols is valuable for attackers and often targeted. In this paper, we propose a stealth ICS honeypot that conceals vulnerable components such as OPC server, and detects reconnaissance activity. A prototype was implemented in a chemical process testbed, and a experimental penetration test was conducted to confirm its effect. We discuss the importance and challenges of integrating stable IT security solutions into the availability emphasized ICS environment.