Cyber Threat Scenarios for Electrical Systems of Nuclear Power Plants - Gupta, Deeksha; Bajramovic, Edita; Parekh, Mithil; Waedt, Karl (PROCEEDINGS OF THE 26TH INTERNATIONAL CONFERENCE ON NUCLEAR ENGINEERING, 2018, VOL 9, 2018)
CRIS-Team WoS Importer:2019-04-02

Designing Trustworthy Monitoring Systems: Forensic Readiness for Safety and Security - Watson, Venesa; Bajramovic, Edita; Bejiga, Mahlet; Waedt, Karl (Proceedings - 12th International Conference on Reliability, Maintainability, and Safety, ICRMS 2018, 2019)
A monitoring system is typically used to report on the resources and performance of a single system or a network of systems, and itself. Particularly in large, distributed networks, heavy reliance is placed upon monitoring systems to guide human behavior. For instance, the monitoring systems use special indicators to signal an impending or actual event. To address the growing instances of safety and security events in critical infrastructure, monitoring systems are increasingly being designed to target traditional attack vectors. However, consideration must be given to emerging events described as cyber-pranks, which are deliberate actions used to merely mimic an attack that could cause panic or even severe safety events accidentally triggered by the reactive actions of employees. For this paper, a cyber-prank is simulated on an I&C system, then the corrective actions based on the triggered event and the implications of these actions are examined. Modeling of all safety and security related artefacts is needed to assess and simulate the impact of security events on functional safety and nuclear safety. Discussions focus on measures to discern a cyber-prank from an actual attack, and how forensic-readiness can provide additional support in guiding incident response.
CRIS-Team Scopus Importer:2019-06-21
Keywords: cyber-pranks; human behavior; modeling; monitoring system; security events

EXAMPLE OF GRADED AND LIFECYCLE PHASE-SPECIFIC SECURITY CONTROLS FOR NUCLEAR I&C AND EPS USE CASES - Watson, Venesa; Bajramovic, Edita; Lou, Xinxin; Waedt, Karl (PROCEEDINGS OF THE 26TH INTERNATIONAL CONFERENCE ON NUCLEAR ENGINEERING, 2018, VOL 5, 2018)
CRIS-Team WoS Importer:2019-03-29

LAVA: Log Authentication and Verification Algorithm - Bajramovic, Edita; Fein, Christofer; Frinken, Marius; Rösler, Paul; Freiling, Felix (12th International Conference on IT Security Incident Management & IT Forensics (IMF 2023), 2023)

On the feasibility of secure logging for industrial control systems using blockchain - Schorradt, Stefan; Bajramovic, Edita; Freiling, Felix (ACM International Conference Proceeding Series, 2019)
With industrial control systems (ICSs) being increasingly networked, the need for sound forensic capabilities for such systems increases. One vital source of information in forensic investigation are log files. Techniques for secure logging aim to protect log files from manipulation. We investigate how a blockchain can enable secure logging for ICSs.We argue that a blockchain fits well both into general models of secure logging and into the Purdue model for ICSs. We report on experiences from connecting the syslog functionality of a Siemens SIMATIC S7-1500 programmable logic controller to the public Ethereum blockchain network. While the level of manipulation protection is comparably high, the transaction time for the public Ethereum blockchain severely limits the usefulness of this type of secure logging for ICSs.
CRIS-Team Scopus Importer:2019-12-31
Keywords: Blockchain; Industrial Control Systems Security; Secure Logging

Principles of Secure Logging for Safekeeping Digital Evidence - Freiling, Felix; Bajramovic, Edita (2018 11th International Conference on IT Security Incident Management & IT Forensics (IMF), 2018)
The investigation of log files is an essential part of any form of IT incident management and IT forensics. In situations where logs can be manipulated, logging approaches that offer security guarantees are advisable. Within a formal system model, we describe several well-known existing approaches to secure logging and compare them with each other. Furthermore, we formalize the security requirements of secure logging approaches and systematically investigate which combinations of guarantees are achieved by the published approached under increasingly stronger attacker model

Security challenges and best practices for iiot - Bajramovic, Edita; Gupta, Deeksha; Guo, Yun; Waedt, Karl; Bajramovic, Anis (Lecture Notes in Informatics (LNI), Proceedings - Series of the Gesellschaft fur Informatik (GI), 2019)
Security concerns regarding the Industrial Internet of Things (IIoT) are constantly increasing, causing issues in industrial facilities, where heavy machinery and dangerous systems are operated and controlled with connected devices. Some of the recent security incidents e.g. Stuxnet worm (Advanced Persistent Threat) and theft of sensitive information in South Korea Nuclear Power Plant (Insider Threat) have shown that these attacks should be considered as the top threat to IIoT, including nuclear facilities. Yet, as industrial systems become more and more interconnected, comparable cyber-attacks could happen in other industrial domains in the future. Therefore, adequate international standards and best practices can decrease occurrence of such attacks.
CRIS-Team Scopus Importer:2021-04-20
Keywords: Best practices; Iiot; Security; Standards