“The pressure and reactant levels could be made to seem normal to the operators, while the pressure is building toward a dangerous point,” Beyah said. By gaining control of sensors and valve position indicators, the attacker could send false readings that would reassure the operators – while the damage proceeded. Of great concern is the “man-in-the-middle” attack in which a bad actor breaks into the facility’s control system – and also takes control of the sensors and instruments that provide feedback to the operators. The defenders have to watch for signs of attack and make sure security systems remain operational. The attackers might take control of valves in the plant to build up pressure in a reaction vessel to cause an explosion. The simulated chemical processing plant, known as the Graphical Realism Framework for Industrial Control Simulations (GRFICS), allows users to play the roles of both attackers and defenders – with separate views provided. The simulator was developed in part by Atlanta security startup company Fortiphyd Logic, and supported by the Georgia Research Alliance. Our goal is to make sure the good guys get this experience so they can respond appropriately.”ĭetails of the simulator were presented August 8 at Black Hat USA 2018, and August 13 at the 2018 USENIX Workshop on Advances in Security Education. “This system allows operators to learn what kinds of things will happen. “The goal is to give operators, researchers and students experience with attacking systems, detecting attacks and also seeing the consequences of manipulating the physical processes in these systems,” said Raheem Beyah, the Motorola Foundation Professor in the School of Electrical and Computer Engineering at the Georgia Institute of Technology.
Efforts are underway to secure these facilities, and helping operators become more skilled at detecting potential attacks is a key part of improving security. The simulator will also help students and researchers understand better the security issues of industrial control systems.įacilities such as electric power networks, manufacturing operations and water purification plants are among the potential targets for malicious actors because they use programmable logic controllers (PLCs) to open and close valves, redirect electricity flows and manage large pieces of machinery.
A simulator that comes complete with a virtual explosion could help the operators of chemical processing plants – and other industrial facilities – learn to detect attacks by hackers bent on causing mayhem.
0 kommentar(er)
