Fundamentals of Cyber and Cyber-

Physical Security

Nicolas Nicolaou

Funded by:
 RoadMap
§ Intro to Cyber Security

§ Intro to Security of Cyber-Physical Systems

§ Vulnerabilities and Attacks

§ Measures of Defense - Encryption

www.kios.ucy.ac.cy
 What does secure mean?

The protection of “Valuables”!

What is “Valuable”!?

www.kios.ucy.ac.cy
 Security in a picture…

Control
Vulnerability

Thread
Sensitive System

A thread is blocked by control of vulnerability

www.kios.ucy.ac.cy
 Definitions
§ Vulnerability: a weakness in the security of the system.

§ Attack: an exploitation of a vulnerability to cause loss or

harm

§ Thread: a set of circumstances that has the potential to

cause loss or harm

www.kios.ucy.ac.cy
 Kinds of Threads

1) Interception: Some unauthorized party gains access to an asset

www.kios.ucy.ac.cy
www.kios.ucy.ac.cy
 Kinds of Threads

2) Interruption: An asset of the system becomes lost, unacailable,

or unusable.

www.kios.ucy.ac.cy
www.kios.ucy.ac.cy
 Kinds of Threads

3) Modification: An unauthorized party accesses and tampers with

an asset.

www.kios.ucy.ac.cy
www.kios.ucy.ac.cy
 Kinds of Threads

4) Fabrication: An unauthorized party might generate counterfeit

objects on a computing system.

www.kios.ucy.ac.cy
www.kios.ucy.ac.cy
 The attacker needs “MOM”!

§ Method: the skills, knowledge, and tools with which to be able

to pull off the attack

§ Opportunity: the time and access to accomplish the attack

§ Motive: a reason to want to perform this attack against a

particular system

www.kios.ucy.ac.cy
 Attackers’ Profiles

White
Black Hat
Hat
Grey
Hat

Hackers: Act of
penetrating into a system

www.kios.ucy.ac.cy
 Attackers’ Profiles
§ White Hats (or “Ethical Hackers” or “Pentesters”):
§ Seek to protect computer systems by discovering the
vulnerabilities before the “bad guys”

§ Black Hats (the “Bad Guys”)

§ Same as White Hats but WITHOUT PERMISSION

§ Grey Hats:
§ Normal People with knowledge of computers or that accidentally
found a vulnerability of a system

www.kios.ucy.ac.cy
 Grey Hats example

www.kios.ucy.ac.cy
 Security’s Holy Triad

1. Confidentiality: ensures that

computer-related assets are
accessed only by authorized parties. Availability

2. Integrity: assets can be modified

only by authorized parties or only in Secure
authorized ways.
Confidentiality Integrity
3. Availability: assets are accessible
to authorized parties at appropriate
times.

www.kios.ucy.ac.cy
 RoadMap
§ Intro to Cyber Security

§ Intro to Security of Cyber-Physical Systems

§ Vulnerabilities and Attacks

§ Measures of Defense - Encryption

www.kios.ucy.ac.cy
 Cyber-Physical Systems (CPS)

Cyber-Physical System:
Large-scale, geographically dispersed
systems that utilize computing devices
and digital communication channels to
monitor and control physical
processes.

Cyber-Physical System (CPS)

Infrastructure
[Picture from “Henrik Sandberg,
Security of Cyber-Physical Systems”]

www.kios.ucy.ac.cy
 Incident 1: StuxNet [2010]

Goal: Harm
centrifuges at
uranium
enrichment facility
in Iran

Attack Execution
[“Henrik Sandberg, Security of
Cyber-Physical Systems”,
“The Real Story of Stuxnet”,
IEEE Spectrum, 2013]

www.kios.ucy.ac.cy
 Incident 2: Power Generators Ukraine [2015]

[Wired (www.wired.com)]

www.kios.ucy.ac.cy
 Other Major Security Breach Incidents
§ Maroochy Shire – Queensland [2008]
§ 800K Liters of swage water released in the rivers and parks
§ StuxNet [2010]
§ Infiltration of the Control Systems
§ San Ysidro – California [2012]
§ 2 million gallons of swage water in Tijuana river
§ Chrysler [2015]
§ Recalls of 1.4 million vehicles
§ Hackers took control of critical parts of the car (e.g. steering wheel)

www.kios.ucy.ac.cy
 Security Triad [Cardenas et al., 2008; Sandberg H., Security of Cyber-Physical Systems]
§ C – Confidentiality
§ “Privacy”

§ I – Integrity
§ “Security”

§ A – Availability

www.kios.ucy.ac.cy
 Integrity vs Confidentiality in Airplanes
§ Flight Tracking
(Confidentiality)

§ Plane instruments
report 1,000 feet
lower than actual
altitude. (Integrity)

www.kios.ucy.ac.cy
 Integrity vs Confidentiality in Cars
§ Braking patterns are
exposed.
(Confidentiality)

§ Braking system stops

working (Integrity)

www.kios.ucy.ac.cy
 Integrity vs Confidentiality in Power Stations
§ Electricity bill is
published online.
(Confidentiality)

§ Critical systems
compromised leading
to shutdown or
catastrophic failure
(Integrity)

www.kios.ucy.ac.cy
 Integrity vs Confidentiality in CPS [KSI]

Integrity Breach Confidentiality Breach

Car Braking system stops working. Braking patterns are exposed.

Airplane Plane instruments report 1,000 feet lower Flight plan is posted on the Internet.
than actual altitude.
Power Station Critical systems compromised leading to Electricity bill is published online.
shutdown or catastrophic failure
Pacemaker Shutdown and death Heartbeat becomes public
knowledge.
Home Security system is remotely disabled Contents of your fridge are leaked.

www.kios.ucy.ac.cy
 Confidentiality is also important!
§ Accurate Tracking of Airplanes Attack Targets

§ Leaking of Power Usage Profile of Absence

§ Leaking of Car Location Room for Thieves

www.kios.ucy.ac.cy
 What is the Cyber-Physical Attack?

Cyber-Physical Attack:
The exploitation of a vulnerability (Software, Hardware, Data)
by an adversary, aiming to alter the behavior of physical
processes

www.kios.ucy.ac.cy
 Attacks in CPS [Cardenas et al, 2008]

Physical
Actuators Sensors
System

Controller

§ CPS cycle: estimation and control

www.kios.ucy.ac.cy
 Attacks in CPS [Cardenas et al, 2008]
A5
A1
A4
Physical
Actuators Sensors
System
A2

Controller

A3
§ CPS cycle: estimation and control
Attacker more likely to go for A1-
§ A1 – A3 : Deception Attacks
A4:
§ A2 – A4: DoS Attacks 1. Not easily identifiable
§ A5: Physical Attacks (no solutions 2. Not physically dangerous
other than detecting them) 3. Not constrained by distance
www.kios.ucy.ac.cy
 Security Goal for CPS

Secure Cyber-Physical System:

A CPS is secure if it is immune (prevents, detects, or survives) to
cyber-physical attacks that attempt to: (i) alter the normal operation of
the system for causing component failure and/or affect its normal usage,
(ii) extract and exploit information for the attackers’ benefit.

Ultimate Security Goal:

Prevent a cyber-physical attack to the CPS by controlling the
vulnerabilities of the CPS.

www.kios.ucy.ac.cy
 Failure/Attack Detection

Failure Detection Goal:

Detect abnormal operation of the CPS and determine the cause of the
problem.

Attack Detection Goal:

Same as Failure detection and detect intruders that do not necessarily
change the state of the operation of the CPS (e.g. record the logs).

www.kios.ucy.ac.cy
 Failures vs Attacks
§ Consider the following scenarios:
§ Component fails produces a pattern P

X P
§ Component is maliciously changed and produces pattern P

P
Impossible to distinguish benign failures from malicious alterations.
www.kios.ucy.ac.cy
 Use Case: Attacks on WDN [Taormina et al., 2017]

Type General WDN Description

Attack Attack
Integrity- A5, A1 ATK1 Sensor attack
Deception ATK2 Actuator attack
A3 ATK8 PLC attack
ATK9 SCADA attack
Availability- A2, A4 ATK3-7 Link attack
DoS

www.kios.ucy.ac.cy
 RoadMap
§ Intro to Cyber Security

§ Intro to Security of Cyber-Physical Systems

§ Vulnerabilities and Attacks

§ Measures of Defense - Encryption

www.kios.ucy.ac.cy
 Vulnerabilities
§ Hardware

§ Software

§ Data

[C. Pfleeger and S.L.Pfleeger, Security in Computing]

www.kios.ucy.ac.cy
 Hardware Vulnerabilities
§ Denial of Service (Interruption)

§ Theft (Interception)

§ Substitution (Fabrication)

§ Firmware Alteration (Modification)

www.kios.ucy.ac.cy
 Hardware Interruption - DDoS

www.kios.ucy.ac.cy
 Software Vulnerabilities
§ Deletion (Interruption)

§ Prevent normal Execution (Interception)

§ Change Behavior (Modification)

§ Installation of Software (Fabrication)

www.kios.ucy.ac.cy
 Software Modification
§ Easy to do that!
§ Changing 1bit in the binary! – “off by one” errror

§ Logic Bombs (or Time Bomb attack)

§ Software behaves well until conditions are met

§ Trojan horses
§ A hidden procedure in a malicious software

www.kios.ucy.ac.cy
 Software Manipulation
§ Virus
§ Specific type of trojan that clones itself and spreads its “infection”
among computers.

§ Trapdoor
§ A program with a secret entry point

§ Spywares
§ Extracts useful information about the user and send this to
unauthorized parties

www.kios.ucy.ac.cy
 Data Vulnerabilities
§ Greater value than software and hardware

Data Data Data

Confidentiality Integrity Availability

Data

Secure Data
www.kios.ucy.ac.cy
 Vulnerabilities and Challenges in CPS
§ CPS Vulnerabilities
§ Use of multiple computers (e.g controllers)
§ Open protocol design
§ Networked
§ Use of commodity IT solutions (Windows, TCP/ip…)
§ CPS Challenges
§ Infrequent Updates
§ Strict Operational Environment
§ Legacy Systems
§ Limited Network Dynamics

www.kios.ucy.ac.cy
 RoadMap
§ Intro to Cyber Security

§ Intro to Security of Cyber-Physical Systems

§ Vulnerabilities and Attacks

§ Measures of Defense - Encryption

www.kios.ucy.ac.cy
 Defenses
Prevent
• block the
attack or
close the
vulnerability

Deter
Recover • Make the
• From the attack harder
attack but not
impossible
Defenses

Detect Deflect
• While it • Make
happens or another
some time target more
after attractive

www.kios.ucy.ac.cy
 Important Defense Mechanics
§ Encryption
§ Confidentiality of data
§ Idea: Scramble data so they become unreadable

§ Authentication
§ Confidentiality on data access
§ Prove the ID of a node

www.kios.ucy.ac.cy
 Important Defense Mechanics
§ Authorization
§ Also confidentiality on data access
§ Usually follows authentication

§ Auditing
§ Usually for integrity
§ Used for attack detection
§ Log Analysis

www.kios.ucy.ac.cy
 Encryption

Plaintext Ciphertext Original Plaintext

Encryption Decryption

www.kios.ucy.ac.cy
 Encryption

www.kios.ucy.ac.cy
 Symmetric vs Asymmetric Encryption
§ Symmetric
Key

Plaintext Ciphertext Original Plaintext

Encryption Decryption

§ Asymmetric
Encryption Key Decryption Key
KE KD

Plaintext Ciphertext Original Plaintext

Encryption Decryption

www.kios.ucy.ac.cy
 Exercise: Caesar Cipher
§ Cipher Key: replace a letter with the one x positions after it
§ Let A -> 0 … Z -> 25
§ i.e. if x = 3 then cipher(A) = A+3 = 0+3 = 3 = d

§ Decrypt the following

Cipher fdhvdu vdodg

Plaintext CEASAR SALAD

www.kios.ucy.ac.cy
 Exercise: Soviet Encryption WW II
§ Cipher Key
§ Common Letters ASINTOER (“a sin to er(r)”)

§ Select a keyword

§ List remaining letters of the alphabet in their order undreneat the

keyword

§ Move verically and assign

§ 0-7 to common letters
§ 80 – 99 to the rest

www.kios.ucy.ac.cy
 Exercise: Soviet Encryption WW II
Keyword: S U N D A Y

www.kios.ucy.ac.cy
 Exercise: Soviet Encryption WW II
§ Keyword: S C A R Y
§ Build the Cipher Key
§ Decrypt the following

81 4 85 90 4 90 80 97 4 0 1 90 2 3 90 2 5 5 5 87

www.kios.ucy.ac.cy
 Solution: Soviet Encryption WW II
S C A R Y
0 84 4 7 95
B D E F G
80 85 5 91 96
H I J K L
81 2 88 92 97
M N O P Q
82 3 6 93 98
T U V W X
1 86 89 94 99
Z . /
83 87 90

81 4 85 90 4 90 80 97 4 0 1 90 2 3 90 2 5 5 5 .

HAD /A/ B LAS T / I N / I E E E .

www.kios.ucy.ac.cy
 Private – Public Key Encryption
§ Alice generates 2 keys
§ Public Key
§ Private Key

§ Message that is encrypted

with public key is decrypted
with private key
§ And vice versa

§ Share Public Key

www.kios.ucy.ac.cy
 How do we know that the message is from Bob?

Bob Alice
Share Kpub-Bob, Kpub-Alice E(Kpub-Alice, E(Kprv-Bob,D))

Kprv-Alice
Send E(Kpub-alice, E(Kprv-Bob,D))
E(Kprv-Bob,D)

Kpub-Bob

www.kios.ucy.ac.cy
 Web Encryption - HTTPs

www.kios.ucy.ac.cy
 Is your password secure?

www.kios.ucy.ac.cy
 Let’s check it out!

www.kios.ucy.ac.cy