Analysis of ICS and SCADA Systems Attacks Using Honeypots

Mohamed Mesbah, Mahmoud Said Elsayed (), Anca Delia Jurcut and Marianne Azer
Additional contact information
Mohamed Mesbah: School of Information Technology and Computer Science, Nile University, Cairo 12677, Egypt
Mahmoud Said Elsayed: School of Computer Science, University College Dublin, D04 V1W8 Dublin, Ireland
Anca Delia Jurcut: School of Computer Science, University College Dublin, D04 V1W8 Dublin, Ireland
Marianne Azer: National Telecommunication Institute, Nile University, Cairo 12677, Egypt

Future Internet, 2023, vol. 15, issue 7, 1-17

Abstract: Supervisory control and data acquisition (SCADA) attacks have increased due to the digital transformation of many industrial control systems (ICS). Operational technology (OT) operators should use the defense-in-depth concept to secure their operations from cyber attacks and reduce the surface that can be attacked. Layers of security, such as firewalls, endpoint solutions, honeypots, etc., should be used to secure traditional IT systems. The three main goals of IT cybersecurity are confidentiality, integrity, and availability (CIA), but these three goals have different levels of importance in the operational technology (OT) industry. Availability comes before confidentiality and integrity because of the criticality of business in OT. One of the layers of security in both IT and OT is honeypots. SCADA honeypots are used as a layer of security to mitigate attacks, known attackers’ techniques, and network and system weaknesses that attackers may use, and to mitigate these vulnerabilities. In this paper, we use SCADA honeypots for early detection of potential malicious tampering within a SCADA device network, and to determine threats against ICS/SCADA networks. An analysis of SCADA honeypots gives us the ability to know which protocols are most commonly attacked, and attackers’ behaviors, locations, and goals. We use an ICS/SCADA honeypot called Conpot, which simulates real ICS/SCADA systems with some ICS protocols and ICS/SCADA PLCs.

Keywords: critical infrastructure; cyber security; Conpot; defense in depth (DiD); honeynet; operational technology (OT); industrial control systems (ICS); incident response; PLC; SCADA (search for similar items in EconPapers)
JEL-codes: O3 (search for similar items in EconPapers)
Date: 2023
References: View references in EconPapers View complete reference list from CitEc
Citations:

Downloads: (external link)
https://www.mdpi.com/1999-5903/15/7/241/pdf (application/pdf)
https://www.mdpi.com/1999-5903/15/7/241/ (text/html)

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:gam:jftint:v:15:y:2023:i:7:p:241-:d:1193896

Access Statistics for this article

Future Internet is currently edited by Ms. Grace You

More articles in Future Internet from MDPI
Bibliographic data for series maintained by MDPI Indexing Manager ().