Industrial control protocols in the Internet core: Dismantling operational practices

Marcin Nawrocki, Thomas C. Schmidt and Matthias Wählisch

International Journal of Network Management, 2022, vol. 32, issue 1

Abstract: Industrial control systems (ICS) are managed remotely with the help of dedicated protocols that were originally designed to work in walled gardens. Many of these protocols have been adapted to Internet transport and support wide‐area communication. ICS now exchange insecure traffic on an inter‐domain level, putting at risk not only common critical infrastructure but also the Internet ecosystem (e.g., by DRDoS attacks). In this paper, we measure and analyze inter‐domain ICS traffic at two central Internet vantage points, an IXP and an ISP. These traffic observations are correlated with data from honeypots and Internet‐wide scans to separate industrial from non‐industrial ICS traffic. We uncover mainly unprotected inter‐domain ICS traffic and provide an in‐depth view on Internet‐wide ICS communication. Our results can be used (i) to create precise filters for potentially harmful non‐industrial ICS traffic and (ii) to detect ICS sending unprotected inter‐domain ICS traffic, being vulnerable to eavesdropping and traffic manipulation attacks. Additionally, we survey recent security extensions of ICS protocols, of which we find very little deployment. We estimate an upper bound of the deployment status for ICS security protocols in the Internet core.

Date: 2022
References: View complete reference list from CitEc
Citations: View citations in EconPapers (1)

Downloads: (external link)
https://doi.org/10.1002/nem.2158

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:wly:intnem:v:32:y:2022:i:1:n:e2158

Access Statistics for this article

More articles in International Journal of Network Management from John Wiley & Sons
Bibliographic data for series maintained by Wiley Content Delivery ().