Kill Chain Attack Modelling for Hidden Channel Attack Scenarios in Industrial Control Systems
Tom Neubert, Claus Vielhauer · IFAC-PapersOnLine · 2020
The protection against Advanced Persistent Threats (APTs) is an important topic in nuclear and industrial information technology security since the last decade. Nowadays steganography, i.e. information hiding techniques are increasingly used by attackers in order to operate without being detected. The usage of hidden channel communication in APTs creates a novel form of attack scenarios for which the current defense mechanisms are usually ineffective. In order to defend industrial control systems against those attacks, it is necessary to understand and comprehend the attacks. Thus, this paper presents how attack modelling based on the Lockheed Martin Cyber Kill Chain can be used to analyze hidden channel APT attack scenarios and how it can be used to elaborate defense mechanisms and to reveal attack indicators along all phases of those attack scenarios.