@article {Roman2023a, title = {Current Perspectives on Securing Critical Infrastructures{\textquoteright} Supply Chains}, journal = {IEEE Security \& Privacy}, year = {In Press}, publisher = {IEEE}, issn = {1540-7993}, author = {Rodrigo Roman and Cristina Alcaraz and Javier Lopez and Kouichi Sakurai} } @article {Syrmakesis2022, title = {Classifying resilience approaches for protecting smart grids against cyber threats}, journal = {International Journal of Information Security}, volume = {21}, year = {2022}, month = {05/2022}, pages = {1189{\textendash}1210}, publisher = {Springer}, address = {Springer Verlag}, abstract = {

Smart grids (SG) draw the attention of cyber attackers due to their vulnerabilities, which are caused by the usage of heterogeneous communication technologies and their distributed nature. While preventing or detecting cyber attacks is a well-studied field of research, making SG more resilient against such threats is a challenging task. This paper provides a classification of the proposed cyber resilience methods against cyber attacks for SG. This classification includes a set of studies that propose cyber-resilient approaches to protect SG and related cyber-physical systems against unforeseen anomalies or deliberate attacks. Each study is briefly analyzed and is associated with the proper cyber resilience technique which is given by the National Institute of Standards and Technology in the Special Publication 800-160. These techniques are also linked to the different states of the typical resilience curve. Consequently, this paper highlights the most critical challenges for achieving cyber resilience, reveals significant cyber resilience aspects that have not been sufficiently considered yet and, finally, proposes scientific areas that should be further researched in order to enhance the cyber resilience of SG.

}, keywords = {Cyber threats, cyber-physical systems, resilience, Smart grids}, issn = {1615-5262}, doi = {https://doi.org/10.1007/s10207-022-00594-7}, url = {https://link.springer.com/content/pdf/10.1007/s10207-022-00594-7.pdf}, author = {Andrew D. Syrmakesis and Cristina Alcaraz and Nikos D. Hatziargyriou~} } @inproceedings {1990, title = {Configuration vulnerability in SNORT for Windows operating systems}, booktitle = {2022 IEEE International Conference on Cyber Security and Resilience (IEEE CSR)}, year = {2022}, month = {08/2022}, pages = {82-89}, publisher = {IEEE}, organization = {IEEE}, address = {https://www.ieee-csr.org}, abstract = {

Cyber-attacks against Industrial Control Systems (ICS) can lead to catastrophic events which can be prevented by the use of security measures such as the Intrusion Prevention Systems (IPS). In this work we experimentally demonstrate how to exploit the configuration vulnerabilities of SNORT one of the most adopted IPSs to significantly degrade the effectiveness of the IPS and consequently allowing successful cyber-attacks. We illustrate how to design a batch script able to retrieve and modify the configuration files of SNORT in order to disable its ability to detect and block Denial of Service (DoS) and ARP poisoning-based Man-In-The-Middle (MITM) attacks against a Programmable Logic Controller (PLC) in an ICS network. Experimental tests performed on a water distribution testbed show that, despite the presence of IPS, the DoS and ARP spoofed packets reach the destination causing respectively the disconnection of the PLC from the ICS network and the modification of packets payload.

}, isbn = {978-1-6654-9952-1}, doi = {https://doi.org/10.1109/CSR54599.2022.9850309}, url = {https://ieeexplore.ieee.org/document/9850309}, author = {Luca Faramondi and Marta Grassi and Simone Guarino and Roberto Setola and Cristina Alcaraz} } @incollection {1844, title = {Risk Assessment for IoT-Enabled Cyber-Physical Systems}, booktitle = {Advances in Core Computer Science-Based Technologies}, year = {2021}, pages = {157-173}, publisher = {Springer International Publishing}, organization = {Springer International Publishing}, address = {Cham}, abstract = {

Internet of Things (IoT) technologies have enabled Cyber-Physical Systems (CPS) to become fully interconnected. This connectivity however has radically changed their threat landscape. Existing risk assessment methodologies often fail to identify various attack paths that stem from the new connectivity/functionality features of IoT-enabled CPS. Even worse, due to their inherent characteristics, IoT systems are usually the weakest link in the security chain and thus many attacks utilize IoT technologies as their key enabler. In this paper we review risk assessment methodologies for IoT-enabled CPS. In addition, based on our previous work (Stellios et al. in IEEE Commun Surv Tutor 20:3453{\textendash}3495, 2018, [47]) on modeling IoT-enabled cyberattacks, we present a high-level risk assessment approach, specifically suited for IoT-enabled CPS. The mail goal is to enable an assessor to identify and assess\ non-obvious(indirect or subliminal) attack paths introduced by IoT technologies, that usually target mission critical components of an CPS.

}, keywords = {Critical Infrastructures, Cyber Physical Systems (CPS), Internet of Things (IoT), Risk assessment Attack paths}, isbn = {978-3-030-41196-1}, doi = {10.1007/978-3-030-41196-1_8}, url = {https://doi.org/10.1007/978-3-030-41196-1_8}, author = {Ioannis Stellios and Panayiotis Kotzanikolaou and Mihalis Psarakis and Cristina Alcaraz} } @article {alcaraz2019a, title = {Covert Channels-based Stealth Attacks in Industry 4.0}, journal = {IEEE Systems Journal.}, volume = {13}, year = {2019}, month = {12/2019}, pages = {3980-3988}, publisher = {IEEE}, abstract = {

Industry 4.0 advent opens several cyber-threats scenarios originally designed for classic information technology, drawing the attention to the serious risks for the modern industrial control networks.\ To cope with this problem, in this paper we address the security issues related to covert channels applied to industrial networks, identifying the new vulnerability points when information technologies converge with operational technologies such as edge computing infrastructures.\ Specifically, we define two signaling strategies where we exploit the Modbus/TCP protocol as target to set up a covert channel. Once the threat channel is established, passive and active offensive attacks (i.e. data exfiltration and command an control, respectively) are further exploited by implementing and testing them on a real Industrial Internet of Things testbed.\ The experimental results highlight the potential damage of such specific threats, and the easy extrapolation of the attacks to other types of channels in order to show the new risks for Industry 4.0. Related to this, we discuss some countermeasures to offer an overview of possible mitigation and defense measures.

}, issn = {1932-8184}, doi = {https://doi.org/10.1109/JSYST.2019.2912308}, url = {https://ieeexplore.ieee.org/document/8715420?source=authoralert}, author = {Cristina Alcaraz and Giuseppe Bernieri and Federica Pascucci and Javier Lopez and Roberto Setola} } @article {IonnaisPanosMihalisAlcarazLopez2018, title = {Survey of IoT-enabled Cyberattacks: Assessing Attack Paths to Critical Infrastructures and Services}, journal = { IEEE Communications Surveys and Tutorials}, volume = {20}, year = {2018}, month = {07/2018}, pages = {3453-3495}, publisher = {IEEE}, abstract = {

As the deployment of Internet of Things (IoT)\ is experiencing an exponential growth, it is no surprise that\ many recent cyber attacks are IoT-enabled: The attacker initially\ exploits some vulnerable IoT technology as a first step towards\ compromising a critical system that is connected, in some way,\ with the IoT. For some sectors, like industry, smart grids,\ transportation and medical services, the significance of such\ attacks is obvious, since IoT technologies are part of critical backend\ systems. However, in sectors where IoT is usually at the enduser\ side, like smart homes, such attacks can be underestimated,\ since not all possible attack paths are examined. In this paper\ we survey IoT-enabled cyber attacks, found in all application\ domains since 2010. For each sector, we emphasize on the latest,\ verified IoT-enabled attacks, based on known real-world incidents\ and published proof-of-concept attacks. We methodologically\ analyze representative attacks that demonstrate direct, indirect\ and subliminal attack paths against critical targets. Our goal is\ threefold: (i) To assess IoT-enabled cyber attacks in a risk-like\ approach, in order to demonstrate their current threat landscape;\ (ii) To identify hidden and subliminal IoT-enabled attack paths\ against critical infrastructures and services, and (iii) To examine\ mitigation strategies for all application domains.

}, keywords = {Critical Infrastructures, Cyber Attacks, Intelligent Transportation Systems, Internet of Things, SCADA, Smart grids, Smart Home, Smart Medical Systems}, issn = {1553-877X}, doi = {https://doi.org/10.1109/COMST.2018.2855563}, url = {https://ieeexplore.ieee.org/document/8410404}, author = {Ioannis Stellios and Panayiotis Kotzanikolaou and Mihalis Psarakis and Cristina Alcaraz and Javier Lopez} } @inproceedings {alcaraz2011critis, title = {PDR: A Prevention, Detection and Response Mechanism for Anomalies in Energy Control Systems}, booktitle = {7th International Conference on Critical Information Infrastructures Security (CRITIS 2012)}, volume = {7722}, year = {2013}, pages = {22{\textendash}33}, address = {Lillehammer, Norway}, abstract = {

\ Prevention, detection and response are nowadays considered to be three priority topics for protecting critical infrastructures, such as energy control systems. Despite attempts to address these current issues, there is still a particular lack of investigation in these areas, and in particular in dynamic and automatic proactive solutions. In this paper we propose a mechanism, which is called PDR, with the capability of anticipating anomalies, detecting anomalous behaviours and responding to them in a timely manner. PDR is based on a conglomeration of technologies and on a set of essential components with the purpose of offering situational awareness irrespective of where the system is located. In addition, the mechanism can also compute its functional capacities by evaluating its efficacy and precision in the prediction and detection of disturbances. With this, the entire system is able to know the real reliability of its services and its activity in remote substations at all times.

}, author = {Cristina Alcaraz and Meltem Sonmez} } @incollection {BC2011Alcaraz, title = {Security Aspects of SCADA and DCS Environments}, booktitle = {Critical Infrastructure Protection: Information Infrastructure Models, Analysis, and Defense}, series = {Advances in Critical Infrastructure Protection: Information Infrastructure Models, Analysis, and Defense. LNCS 7130.}, volume = {7130}, year = {2012}, month = {September 2012}, pages = {120-149}, publisher = {Springer-Verlag}, organization = {Springer-Verlag}, address = {Heidelberger (Berlin, Alemania)}, abstract = {

SCADA Systems can be seen as a fundamental component in Critical Infrastructures, having an impact in the overall performance of other Critical Infrastructures interconnected. Currently, these systems include in their network designs different types of Information and Communication Technology systems (such as the Internet and wireless technologies), not only to modernize operational processes but also to ensure automation and real-time control. Nonetheless, the use of these new technologies will bring new security challenges, which will have a significant impact on both the business process and home users. Therefore, the main purpose of this Chapter is to address these issues and to analyze the interdependencies of Process Control Systems with ICT systems, to discuss some security aspects and to offer some possible solutions and recommendations.

}, keywords = {Critical Information Infrastructure Protection, SCADA Systems}, isbn = {ISBN:978-3-642-28919-4}, issn = {0302-9743}, author = {Cristina Alcaraz and Gerardo Fernandez and Fernando Carvajal}, editor = {Javier Lopez and Stephen. Wolthunsen and Roberto Setola} } @inproceedings {alcaraz2012b, title = {Smart Grid Privacy: Issues and Solutions}, booktitle = {21st International Conference on Computer Communications and Networks (ICCCN)}, year = {2012}, month = {Jul 2012}, pages = {1-5}, publisher = {IEEE Computer Society}, organization = {IEEE Computer Society}, address = {Munich, Germany}, abstract = {

Migration to an electronically controlled electrical grid to transmit, distribute, and deliver power to consumers has helped enhance the reliability and efficiency of conventional electricity systems. At the same time, this digitally enabled technology called the Smart Grid has brought new challenges to businesses and consumers alike. A key component of such a grid is the smart-metering technology, which is used to collect energy consumption data from homes and transmitting it back to power distributors. A crucial concern is the privacy related to the collection and use of energy consumption data. We present an analysis of Smart Grid privacy issues and discuss recently proposed solutions that can protect the privacy of Smart Grid users.

}, keywords = {Computer architecture, Data privacy, Electricity, Home appliances, privacy, security, Smart grids}, isbn = {978-1-4673-1543-2}, doi = {10.1109/ICCCN.2012.6289304}, url = {http://ieeexplore.ieee.org/xpl/articleDetails.jsp?tp=\&arnumber=6289304\&contentType=Conference+Publications\&openedRefinements\%3D*\%26pageNumber\%3D7\%26rowsPerPage\%3D100\%26queryText\%3D\%28smart+grid\%29}, author = {F. Siddiqui and S. Zeadally and Cristina Alcaraz and S. Galvao} }