Modellering av en cyberattack på ett industriellt säkerhetssystem

Sammanfattning: Stuxnet, Havex, BlackEnergy, Crashoverride, and now Triton/Trisis are all examples of cyber security incidents where industrial systems were targeted. The incident Triton/Trisis is new in it’s kind, as the attacker got all the way into the safety industrial system of an oil and gas refinery. Even if the final goal of the attack is still unknown the attacker had the power to put human life directly at risk. Details of the attack are still unknown and research and reverse engineering is still going on of the attack. The purpose of this study is to create an attack graph of the case. By collecting and combining information from publicly available material and grade all the sources by its trustworthiness the study resulted in a two-layered attack graph. Each node and vector in the graph have specified trustworthiness and the nodes contain related sources, tools, and network segments. The study shows that it is possible to construct an attack graph of the case even if details are still missing. Furthermore, it shows that the specific malicious code was tailor-made, but the steps needed to reach the safety industrial system itself were largely possible with the help of publicly available tools. As a result, the whole industrial industry needs to prepare for an escalation of cyber security incidents.