@article {Roman2023a, title = {Current Perspectives on Securing Critical Infrastructures{\textquoteright} Supply Chains}, journal = {IEEE Security \& Privacy}, year = {In Press}, publisher = {IEEE}, issn = {1540-7993}, author = {Rodrigo Roman and Cristina Alcaraz and Javier Lopez and Kouichi Sakurai} } @article {Syrmakesis2022, title = {Classifying resilience approaches for protecting smart grids against cyber threats}, journal = {International Journal of Information Security}, volume = {21}, year = {2022}, month = {05/2022}, pages = {1189{\textendash}1210}, publisher = {Springer}, address = {Springer Verlag}, abstract = {

Smart grids (SG) draw the attention of cyber attackers due to their vulnerabilities, which are caused by the usage of heterogeneous communication technologies and their distributed nature. While preventing or detecting cyber attacks is a well-studied field of research, making SG more resilient against such threats is a challenging task. This paper provides a classification of the proposed cyber resilience methods against cyber attacks for SG. This classification includes a set of studies that propose cyber-resilient approaches to protect SG and related cyber-physical systems against unforeseen anomalies or deliberate attacks. Each study is briefly analyzed and is associated with the proper cyber resilience technique which is given by the National Institute of Standards and Technology in the Special Publication 800-160. These techniques are also linked to the different states of the typical resilience curve. Consequently, this paper highlights the most critical challenges for achieving cyber resilience, reveals significant cyber resilience aspects that have not been sufficiently considered yet and, finally, proposes scientific areas that should be further researched in order to enhance the cyber resilience of SG.

}, keywords = {Cyber threats, cyber-physical systems, resilience, Smart grids}, issn = {1615-5262}, doi = {https://doi.org/10.1007/s10207-022-00594-7}, url = {https://link.springer.com/content/pdf/10.1007/s10207-022-00594-7.pdf}, author = {Andrew D. Syrmakesis and Cristina Alcaraz and Nikos D. Hatziargyriou~} } @inproceedings {Alcaraz2022c, title = {Collaborative anomaly detection system for charging stations}, booktitle = {The 27th European Symposium on Research in Computer Security (ESORICS 2022)}, volume = {13555}, year = {2022}, month = {09/2022}, pages = {716{\textendash}736}, publisher = {Springer, Cham}, organization = {Springer, Cham}, abstract = {

In recent years, the deployment of charging infrastructures has been increasing exponentially due to the high energy demand of electric vehicles, forming complex charging networks. These networks pave the way for the emergence of new unknown threats in both the energy and transportation sectors. Economic damages and energy theft are the most frequent risks in these environments. Thus, this paper aims to present a solution capable of accurately detecting unforeseen events and possible fraud threats that arise during charging sessions at charging stations through the current capabilities of the Machine Learning (ML) algorithms. However, these algorithms have the drawback of not fitting well in large networks and generating a high number of false positives and negatives, mainly due to the mismatch with the distribution of data over time. For that reason, a Collaborative Anomaly Detection System for Charging Stations (here referred to as CADS4CS) is proposed as an optimization measure. CADS4CS has a central analysis unit that coordinates a group of independent anomaly detection systems to provide greater accuracy using a voting algorithm. In addition, CADS4CS has the feature of continuously retraining ML models in a collaborative manner to ensure that they are adjusted to the distribution of the data. To validate the approach, different use cases and practical studies are addressed to demonstrate the effectiveness and efficiency of the solution.

}, keywords = {Charging station, Collaborative anomaly detection, Machine Learning, Voting system}, doi = {https://doi.org/10.1007/978-3-031-17146-8_35}, author = {Jesus Cumplido and Cristina Alcaraz and Javier Lopez} } @inproceedings {1990, title = {Configuration vulnerability in SNORT for Windows operating systems}, booktitle = {2022 IEEE International Conference on Cyber Security and Resilience (IEEE CSR)}, year = {2022}, month = {08/2022}, pages = {82-89}, publisher = {IEEE}, organization = {IEEE}, address = {https://www.ieee-csr.org}, abstract = {

Cyber-attacks against Industrial Control Systems (ICS) can lead to catastrophic events which can be prevented by the use of security measures such as the Intrusion Prevention Systems (IPS). In this work we experimentally demonstrate how to exploit the configuration vulnerabilities of SNORT one of the most adopted IPSs to significantly degrade the effectiveness of the IPS and consequently allowing successful cyber-attacks. We illustrate how to design a batch script able to retrieve and modify the configuration files of SNORT in order to disable its ability to detect and block Denial of Service (DoS) and ARP poisoning-based Man-In-The-Middle (MITM) attacks against a Programmable Logic Controller (PLC) in an ICS network. Experimental tests performed on a water distribution testbed show that, despite the presence of IPS, the DoS and ARP spoofed packets reach the destination causing respectively the disconnection of the PLC from the ICS network and the modification of packets payload.

}, isbn = {978-1-6654-9952-1}, doi = {https://doi.org/10.1109/CSR54599.2022.9850309}, url = {https://ieeexplore.ieee.org/document/9850309}, author = {Luca Faramondi and Marta Grassi and Simone Guarino and Roberto Setola and Cristina Alcaraz} } @article {alcaraz2019a, title = {Covert Channels-based Stealth Attacks in Industry 4.0}, journal = {IEEE Systems Journal.}, volume = {13}, year = {2019}, month = {12/2019}, pages = {3980-3988}, publisher = {IEEE}, abstract = {

Industry 4.0 advent opens several cyber-threats scenarios originally designed for classic information technology, drawing the attention to the serious risks for the modern industrial control networks.\ To cope with this problem, in this paper we address the security issues related to covert channels applied to industrial networks, identifying the new vulnerability points when information technologies converge with operational technologies such as edge computing infrastructures.\ Specifically, we define two signaling strategies where we exploit the Modbus/TCP protocol as target to set up a covert channel. Once the threat channel is established, passive and active offensive attacks (i.e. data exfiltration and command an control, respectively) are further exploited by implementing and testing them on a real Industrial Internet of Things testbed.\ The experimental results highlight the potential damage of such specific threats, and the easy extrapolation of the attacks to other types of channels in order to show the new risks for Industry 4.0. Related to this, we discuss some countermeasures to offer an overview of possible mitigation and defense measures.

}, issn = {1932-8184}, doi = {https://doi.org/10.1109/JSYST.2019.2912308}, url = {https://ieeexplore.ieee.org/document/8715420?source=authoralert}, author = {Cristina Alcaraz and Giuseppe Bernieri and Federica Pascucci and Javier Lopez and Roberto Setola} } @article {rub2019cose, title = {Current Cyber-Defense Trends in Industrial Control Systems}, journal = {Computers \& Security Journal}, volume = {87}, year = {2019}, month = {11/2019}, publisher = {Elsevier}, type = {SECRYPT 2017 Special Issue}, abstract = {

Advanced Persistent Threats (APTs) have become a serious hazard for any critical infrastructure, as a single solution to protect all industrial assets from these complex attacks does not exist. It is then essential to understand what are the defense mechanisms that can be used as a first line of defense. For this purpose, this article will firstly study the spectrum of attack vectors that APTs can use against existing and novel elements of an industrial ecosystem. Afterwards, this article will provide an analysis of the evolution and applicability of Intrusion Detection Systems (IDS) that have been proposed in both the industry and academia.

}, keywords = {APT, Industrial Control, Industry 4.0, Intrusion Detection, SCADA}, issn = {0167-4048}, doi = {https://doi.org/10.1016/j.cose.2019.06.015}, author = {Juan E. Rubio and Cristina Alcaraz and Rodrigo Roman and Javier Lopez} } @article {Alcaraz2018a, title = {Cloud-Assisted Dynamic Resilience for Cyber-Physical Control Systems}, journal = {IEEE Wireless Communications}, volume = {25}, number = {1}, year = {2018}, month = {02/2018}, pages = {76-82}, publisher = {IEEE}, keywords = {Cloud Computing, Computer architecture, Controllability, Edge computing, Redundancy, resilience}, issn = {1536-1284}, doi = {10.1109/MWC.2018.1700231}, url = {http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=\&arnumber=8304395\&isnumber=8304374}, author = {Cristina Alcaraz} } @article {cazorla2016cyber, title = {Cyber Stealth Attacks in Critical Information Infrastructures}, journal = {IEEE Systems Journal}, volume = {12}, year = {2018}, month = {06/2018}, pages = {1778-1792}, publisher = {IEEE}, abstract = {

Current Critical Infrastructures (CIs) are complex interconnected industrial systems that, in recent years, have incorporated information and communications technologies such as connection to the Internet and commercial off-the-shelf components. This makes them easier to operate and maintain, but exposes them to the threats and attacks that inundate conventional networks and systems. This paper contains a comprehensive study on the main stealth attacks that threaten CIs, with a special focus on Critical Information Infrastructures (CIIs). This type of attack is characterized by an adversary who is able to finely tune his actions to avoid detection while pursuing his objectives. To provide a complete analysis of the scope and potential dangers of stealth attacks we determine and analyze their stages and range, and we design a taxonomy to illustrate the threats to CIs, offering an overview of the applicable countermeasures against these attacks. From our analysis we understand that these types of attacks, due to the interdependent nature of CIs, pose a grave danger to critical systems where the threats can easily cascade down to the interconnected systems.\ 

}, keywords = {Control systems, Countermeasures, Critical Infrastructures, Detection and Protection, Stealth Attacks}, issn = {1932-8184}, doi = {10.1109/JSYST.2015.2487684}, url = {http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=\&arnumber=7445136\&isnumber=8350419}, author = {Lorena Cazorla and Cristina Alcaraz and Javier Lopez} } @article {alcarazlopez-IEEESystems-2017, title = {A Cyber-Physical Systems-Based Checkpoint Model for Structural Controllability}, journal = {IEEE Systems Journal}, volume = {12}, year = {2018}, month = {12/2018}, pages = {3543-3554}, publisher = {IEEE}, abstract = {

The protection of critical user-centric applications,\ such as Smart Grids and their monitoring systems, has become\ one of the most cutting-edge research areas in recent years.\ The dynamic complexity of their cyber-physical systems (CPSs)\ and their strong inter-dependencies with power systems, are\ bringing about a significant increase in security problems that\ may be exploited by attackers. These security holes may, for\ example, trigger the disintegration of the structural controllability\ properties due to the problem of non-locality, affecting, sooner\ or later, the provision of the essential services to end-users.\ One way to address these situations could be through automatic\ checkpoints in charge of inspecting the healthy status of the\ control network and its critical nature. This inspection can be\ subject to special mechanisms\ composed of trustworthy cyberphysical\ elements\ capable of detecting structural changes in the\ control and activating restoration procedures\ with support for\ warning. This is precisely the aim of this paper, which presents\ a CPSs-based checkpoint model with the capacity to manage\ heterogeneous replications that help ensure data redundancy,\ thereby guaranteeing the validity of the checkpoints. As a support\ to this study,\ a theoretical and practical analysis is addressed to\ show the functionality of the approach in real contexts.

}, keywords = {Critical Control Systems, cyber-physical systems, Smart grids, structural controllability}, issn = {1932-8184}, doi = {https://doi.org/10.1109/JSYST.2017.2740719}, url = {http://ieeexplore.ieee.org/document/8057984/}, author = {Cristina Alcaraz and Javier Lopez} } @incollection {1590, title = {Cyber-Physical Systems for Wide-Area Situational Awareness}, booktitle = {Cyber-Physical Systems: Foundations, Principles and Applications}, number = {Intelligent Data-Centric Systems}, year = {2017}, month = {2017}, pages = {305 - 317}, publisher = {Academic Press}, organization = {Academic Press}, chapter = {20}, address = {Boston}, abstract = {

Abstract Cyber-physical systems (CPSs), integrated in critical infrastructures, could provide the minimal services that traditional situational awareness (SA) systems demand. However, their application in SA\ solutions for the protection of large control distributions against unforeseen faults may be insufficient. Dynamic protection measures have to be provided not only to locally detect unplanned deviations but also to prevent, respond, and restore from these deviations. The provision of these services as an integral part of the SA\ brings about a new research field known as wide-area situational awareness (WASA), highly dependent on CPSs\ for control from anywhere across multiple interconnections, and at any time. Thus, we review the state-of-the art of this new paradigm, exploring the different preventive and corrective measures considering the heterogeneity of CPSs, resulting in a guideline for the construction of automated WASA\ systems.

}, keywords = {Control systems, Critical Infrastructure Protection, cyber-physical systems, Detection, Response, restoration, Wide-Area Situational Awareness}, isbn = {978-0-12-803801-7}, doi = {http://dx.doi.org/10.1016/B978-0-12-803801-7.00020-1}, author = {Cristina Alcaraz and Lorena Cazorla and Javier Lopez} } @inproceedings {931, title = {Context-Awareness using Anomaly-based Detectors for Smart Grid Domains}, booktitle = {9th International Conference on Risks and Security of Internet and Systems }, volume = {8924}, year = {2015}, month = {04/2015}, pages = {17-34}, publisher = {Springer International Publishing}, organization = {Springer International Publishing}, address = {Trento}, abstract = {

Anomaly-based detection applied in strongly interdependent systems, like Smart Grids, has become one of the most challenging research areas in recent years. Early detection of anomalies so as to detect and prevent unexpected faults or stealthy threats is attracting a great deal of attention from the scientific community because it offers potential solutions for context-awareness. These solutions can also help explain the conditions leading up\ to a given situation and help determine the degree of its severity. However, not all the existing approaches within the literature are equally effective in covering the needs of a particular scenario. It is necessary to explore the control requirements of the domains that comprise a Smart Grid, identify, and even select, those approaches according to these requirements and the intrinsic conditions related to the application context, such as technological heterogeneity and complexity. Therefore, this paper analyses the functional features of existing anomaly-based approaches so as to adapt them, according to the aforementioned conditions. The result of this investigation is a guideline for the construction of preventive solutions that will help improve the context-awareness in the control of Smart Grid domains in the near future.

}, keywords = {Context-Awareness, Control systems, Prevention, Smart Grid}, isbn = {978-3-319-17126-5}, doi = {10.1007/978-3-319-17127-2_2}, url = {http://link.springer.com/chapter/10.1007\%2F978-3-319-17127-2_2$\#$}, author = {Cristina Alcaraz and Lorena Cazorla and Gerardo Fernandez} } @article {alcaraz2015CRI, title = {Critical Infrastructure Protection: Requirements and Challenges for the 21st Century}, journal = {International Journal of Critical Infrastructure Protection (IJCIP)}, volume = {8}, year = {2015}, month = {01/2015}, pages = {53{\textendash}66}, publisher = {Elsevier Science}, abstract = {

Critical infrastructures play a vital role in supporting modern society. The reliability, performance, continuous operation, safety, maintenance and protection of critical infrastructures are national priorities for countries around the world. This paper explores the vulnerabilities and threats facing modern critical infrastructures with special emphasis on industrial control systems, and describes a number of protection measures. The paper also discusses some of the challenging areas related to critical infrastructure protection such as governance and security management, secure network architectures, self-healing, modeling and simulation, wide-area situational awareness, forensics and learning, and trust management and privacy.

}, keywords = {Challenges, Critical Infrastructure Protection, Requirements, Risk, SCADA Systems, security}, issn = {1874-5482}, doi = {http://dx.doi.org/10.1016/j.ijcip.2014.12.002}, url = {http://www.sciencedirect.com/science/article/pii/S1874548214000791}, author = {Cristina Alcaraz and Sherali Zeadally} } @article {1762, title = {Critical Control System Protection in the 21st Century: Threats and Solutions}, journal = {IEEE Computer}, volume = {46}, number = {10}, year = {2013}, month = {2013}, pages = {74 - 83}, publisher = {IEEE Computer Society}, abstract = {

Information systems, networks, and technologies have become an integral part of modern critical control systems that manage many of today\&$\#$x2019;s critical infrastructures. The continuous operation, maintenance, and protection of critical infrastructures have become a high national priority for governments around the world because our society heavily depends on them for most of our daily activities (travel, power usage, banking transactions, telecommunications, etc) and safety. It is therefore critical that these infrastructures have to be protected from potential accidental incidents or cyberattacks. We present the fundamental architectural components of critical control systems which manage most critical infrastructures. We identify some of the vulnerabilities and threats to modern critical control systems followed by protection solutions that can be deployed to mitigate attacks exploiting these vulnerabilities.

}, issn = {0018-9162}, doi = {10.1109/MC.2013.69}, author = {Cristina Alcaraz and S. Zeadally} }