Paper

On Preventing and Detecting

Cyber Attacks in Industrial Control
System Networks
Adam Padée, Michał Wójcik, Arkadiusz Ćwiek, Konrad Klimaszewski, Przemysław Kopka,
Sylwester Kozioł, Krzysztof Kuźmicki, Rafał Możdżonek, Wojciech Wiślicki,
and Tomasz Włodarski
National Centre for Nuclear Research, Otwock, Poland

https://doi.org/10.26636/jtit.2019.131219

Abstract—This paper outlines the problem of cybersecurity in ther the Internet (which did not exist at that time in its
OT (operations/operational technology) networks. It provides current form), nor direct access to the facility being tar-
descriptions of the most common components of these sys- geted are necessary to perform a successful attack.
tems, summarizes the threats and compares them with those Another interesting example is a local Polish case that is
present in the IT domain. A considerable section of the paper much more recent than the previous one, as it occurred in
summarizes research conducted over the past decade, focus-
2008 in Łódź. A fourteen-year-old boy modified an old
ing on how common the problem is and in which countries it
TV remote and used it to arbitrarily change the settings of
prevails. The article presents techniques most commonly used
in the protection of these systems, with many examples from the city tram system switch points. Using this device, he
the nuclear industry given. caused several road accidents and tram collisions. As he
testified later, he did it “just for fun”, and he got the knowl-
Keywords—attack preventing, cybersecurity, industrial control edge necessary to build the remote talking to old engineers
systems. at tram depots.
This example shows that no extensive resources are nec-
essary to exploit an ICS, and that there are more ways
to attack an ICS than just via a typical IT system or net-
1. Security of Industrial Control work [2]. This problem has been gaining in importance,
Systems as with advances in automation, more processes vital to
the economy can be targeted by cybercriminals. It is also
It is common belief that cybersecurity threats affect primar- harder to protect them by physical isolation, because many
ily typical IT systems, such as databases, web servers or of these systems require constant external control and up-
corporate LANs, and that the main focus of cybercriminals dates from the outside.
is on confidential information stored in these systems. This Technically, there are two types of advanced, distributed
image somewhat overshadows an equally important ques- ICSs: Supervisory Control And Data Acquisition (SCADA)
tion of the security of Industrial Control Systems (ICS). and Distributed Control Systems (DCS). They share many
The approach to the issue has begun to change recently, common features, and the boundary between them is not
with the discovery of Stuxnet worm and with the subse- sharp, but it is usually assumed that SCADA systems fo-
quent publication of Blackout – a novel by Marc Elsberg. cus on data gathering, while their DCS counterparts – on
Cybersecurity of ICS has been gaining more and more pub-
lic attention since that time. Despite such a recent growth Table 1
in popularity, security issues related to ICS have a much ICS systems components
longer history. It dates back to the year 1982, when CIA
agents, in response to the large-scale efforts of the soviet Low level (field devices) High level (central systems)
National Security Committee (KGB) to bypass the embargo PLC – Programmable Logic HMI – Human-Machine
and steal Western technology, designed special software, in- Controller Interface
stalled it on programmable logic controllers through a chain RTU – Remote Terminal Unit FEP – SCADA servers
of fictitious companies, and sold them to Russians. This has IED – Intelligent Electronic Front End Processors
eventually led to a huge explosion of the Trans-Siberian gas Device
pipeline, severely affecting the Soviet economy [1]. This Historians (for storing
historical example is interesting, because it shows that nei- logs, etc.)

21
Adam Padée et al.

processes. This implies that DCSs are process state driven, mainly monitoring data and logs. Someone may use this
and SCADAs are event driven. This makes DCSs harder to data to gather some knowledge about the system and launch
protect, because disturbing process continuity or integrity a more successful attack in the future, but disclosure of
may lead to severe consequences. There are several com- this information does not pose any immediate risks to the
ponents of these systems that have standard names which process.
are abbreviated in the same way. The most popular of them There is also a difference at the other end of the defini-
are shown in Table 1. tion, concerning “weakness”. In IT systems, especially in
SCADA and DCS systems may ultimately serve the same lower layers of the OSI model, we have just a few stan-
purpose, but while SCADA vendors concentrate on provid- dardized and well described protocols, such as Ethernet,
ing higher-level functions and human operator interaction, IP, TCP/UDP etc. In ICS, in turn, the situation is a bit
and assume that lower-level components can be provided more complicated, because many vendors of the compo-
by different vendors as long as they implement standard nents listed in Table 1 utilize their own, proprietary pro-
protocols, DCS solutions are generally sold as a whole, tocols which are not disclosed to the general public. This
with low-level control elements included. DCS systems makes the security analysis of the system harder and means
may use proprietary protocols for internal communication. that many more unknown factors need to be dealt with. An-
They may be supplemented with some high-level applica- other problem consists in inherent lack of security of some
tion servers and SCADA components from other vendors, of the protocols used in ICSs, even those that are open
but the core of the system remains homogenous. standards with publicly available specifications. The very
popular Modbus protocol may serve as a perfect example
The ISO/IEC 27005 (Information Technology – Security
here. It originates from simple point-to-point serial connec-
Techniques – Information Security Risk Management) stan-
tions, so it lacks any encryption and security mechanisms,
dard defines vulnerability as “a weakness of an asset or
but now is commonly used over Ethernet networks1. In this
group of assets that can be exploited by one or more
case, it is sufficient for the attacker to obtain physical ac-
threats”, where “assets” are defined as anything that has
cess to any of the network components (cables, switches) to
a non-zero value to the organization. This definition, con-
be able to control the entire system. There are also exam-
trary to more specific ones, e.g. those used by the Internet
ples of ICS equipment where, although encryption is im-
Engineering Task Force, is so general that it can be applied
plemented, weak algorithms and/or self-signed certificates
to ICS and IT systems alike. The main difference appears
are used.
to be in the relative value of the assets (listed in Table 1).
In IT systems, the threat hierarchy is described with the
CIA acronym: confidentiality, integrity, availability. The 2. Statistics and Geographical
order of the threats reflects their importance. Usually,
the most severe consequences are associated with infor-
Distribution of Potentially
mation leaks (which are, in most cases, irrecoverable), Insecure ICS
then with breaching the system’s integrity (which can
be restored using backups or through system reinstalla- The reasons outlined in Section 1 create a strong belief
tion), and ultimately with rendering the system inacces- that the best solution to ensure the security of ICS net-
sible, e.g. by means of a Distributed Denial of Service works is to isolate them completely from the Internet and
(DDoS) attack which often requires considerable resources to maximally restrict access to them. This recipe is true
and is effective only as long as the attack takes place. and confirmed by a vast majority of ICS security special-
In ICS the threats are similar, but their hierarchy is re- ists (cf. [4] as an example), but it is equally true that it often
versed (AIC instead of CIA), because availability of the impairs the functionality and accessibility of specific solu-
system has usually the biggest influence on safety, espe- tions. ICSs seldom serve company clients directly via the
cially for DCS. The biggest risks are associated with render- Internet, so remote access to them may be very limited, but
ing the system inoperable, because it means losing control is often hard to eliminate completely due to such reasons
over industrial processes and may lead to catastrophic con- as software upgrades, configuration changes and supervi-
sequences. sion over the system performed by engineering team mem-
Unauthorized alteration of the system’s state is the second bers. For these reasons, the engineering side usually stands
item in the list. It may lead to severe implications as well, in opposition to security people. For the former of these
but if the system is still operational, more or less success- two groups, restricting remote access to the system actually
ful countermeasures may be immediately applied by the lowers the safety level of the industrial process, because it
facility staff, thus minimizing the negative consequences. drastically increases their response time to any problems,
ICSs are also equipped with many independent safety de- especially outside normal working hours, and increases the
vices and procedures, so it is hard for the attacker to amount of work needed to fix them. This is the reason
turn them all off. This minimizes the impact of unau- why too strict a policy enforced by the security team may
thorized alterations as long as the system remains oper- 1 Since 2018, some security extensions to Modbus have been introduced,
ational as a whole. Information loss is by far the least but most of the equipment present on the market does not support them
important factor – information stored in ICSs comprises yet [3].

22
 On Preventing and Detecting Cyber Attacks in Industrial Control System Networks

Table 2
Number of indexed systems for each query, data taken from [8]
Shodan query Connections Category Note
Niagara+Web+Server 2794 HAN/BMS Web server for EMS/BMS
TAC/Xenta 1880 BMS Self certs for HTTPS
i.LON 1342 BMS Primarily for energy
EnergyICT 585 RTU Primarily energy
Powerlink 257 BMS/HAN
/BroadWeb/ 148 HMI Known vulnerabilities
EIG+Embedded+Web+Server 104 Embedded web server
CIMPLICITY 90 HMI Zero config web view
SoftPLC 80 PAC Eastern Europe
HMS+AnyBus-S+WebServer 40 Embedded web server
ioLogik 36 PLC Small vendor
Allen-Bradley 23 PAC
RTS+Scada 15 SCADA Runs on FreeBSD
SIMATIC+NET 13 HMI Affected by Stuxnet
Simatic+S7 13 PLC Affected by Stuxnet
Modbus+Bridge 12 Protocol bridge IP to Modbus
ModbusGW 11 Protocol bridge
Reliance+4+Control+Server 10 SCADA
Simatic+HMI 9 HMI Affected by Stuxnet
Cimetrics+Eplus+Web+Server 6 Embedded web server
A850+Telemetry+Gateway 3 Telemetry
ABB+Webmodule 3 Embedded web server
CitectSCADA 3 PCS
Modicon+M340+CPU 3 Protocol Bridge
webSCADA-Modbus 3 HAN
RTU560 2 RTU Web interface
WAGO 2 Telemetry
eiPortal 1 Historian
NovaTech+HTTPD 1 Embedded web server Substation automation
Total 7489

be in fact counterproductive, because then the engineering Cryptographic tools, mainly encryption of web traffic, are
people may set up their own backdoors to the system, re- nowadays rarely used in ICS (both DCS and SCADA), but
maining outside any control or supervision of the security are seriously considered as a future standard [6]. Manage-
people. ment of cryptographic keys and optimization of resources
These may take the form of unauthorized VPN tunnels, are subjects of extensive discussions. In 2009, John Math-
sometimes disguised in some other protocols to avoid de- erly created Shodan – search engine indexing services ex-
tection and closure by the security team, or even worse, posed to the Internet [7]. Two years later, E. P. Leverett,
GSM modems connected directly to the industrial systems, a student at Cambridge University, wrote a set of queries
completely bypassing all levels of security within the cor- for Shodan that are based on signatures of the most popular
porate network. This is not a purely theoretical threat, as ICS components. Although the list includes some popular
poorly secured VPN tunnels were used as an attack vector BMS vendors as well, it is partly justified, because BMS
in the recent successful attack on the Ukrainian power grid often control factory premises and have access to deeper
that took place on December 23, 2015 [5]. As far as GSM parts of ICS networks. A detailed description of the tests
modems or other communication devices that completely may be found in [8].
expose the industrial system components via the Internet A look at the geographical distribution of these systems is
are concerned, they are, quite incredibly, much more com- interesting as well, because it is common belief that the
mon than one could expect. problem of ICS security exists only in developed countries.

23
Adam Padée et al.

Table 2 shows that the problem exists all over the world, as in other industrially developed countries, just hidden in
on all continents. Indeed, most of the indexed systems are private subnets used by Internet operators or in the IPv6 ad-
located in developed countries with large numbers of indus- dress space. Nevertheless, exposing ICS components even
trial users, such as the United States of America, Sweden, in a private network of a large Internet operator is only
the Netherlands or Canada. However, there are interesting a little less dangerous than doing it openly on the Inter-
exceptions, e.g. a relatively low number of connections in net. It is of particular interest for the authors of this paper
China, despite their big industry, rapid economic growth that a relatively high number of exposed systems exist in
and large number of users. But this may be attributed Poland, despite the fact that most operators have not been
rather to a relatively low number of IP numbers assigned assigning, for a few years now, public IP addresses to their
to China, so the scale of the problem is probably the same users by default. It is a feature that has to be paid for ex-
tra. This increases the probability that these exposures are
Table 3 intentional rather than accidental.
Number of indexed systems per country, data The results published by Leverett stirred up a vivid discus-
taken from [6] sion about cybersecurity in modern industry and inspired
many other researchers to follow with similar tests. Es-
Country Count Country Count pecially interesting is work [9] by Roland C. Bodenheim,
United States 3920 Greece 10 because he repeated exactly the same queries as Leverett
Sweden 442 Israel 10 two years later, in 2013. Although one may expect that the
Netherlands 370 Luxembourg 9 number will drop because of increasing awareness of the
Canada 365 South Africa 9 problem, the actual result is reverse. The total number of
connections raised from 7489 in 2011 to 57409 in 2013. It
Finland 301 Philippines 8
is more than 7500% increase in just two years. Following
Norway 271 Thailand 7
huge media interest in the results of the searches, authors
Denmark 194 Turkey 7
of Shodan limited the access to the search engine, so it is
Poland 191 Mexico 7 harder to find data from the next years, but extrapolating
United Kingdom 122 Malaysia 6 the growth from 2011–2013, there is no reason to believe
Portugal 93 Singapore 5 that the trend is no longer present.
Germany 92 Panama 4
Czech Republic 90 Puerto Rico 4
Spain 86 Hong Kong 3 3. Protection of ICS Against the Attacks
Australia 81 Serbia 3
Absolute safety against cybercrime is a goal that is impos-
Ireland 76 New Zealand 3 sible to attain. Even if we imagine we have perfectly de-
Taiwan 66 Argentina 2 signed system running bug-free code, there is always some
Japan 59 Chile 2 space for human error. There are several ways to lower the
Italy 57 Croatia 2 probability of successful break-in and minimize the impact
France 53 Iceland 2 if such event occurs. They are in principle similar to those
Slovenia 50 Indonesia 2 used in IT systems, but not all techniques used for IT can
Korea, Republic of 41 Dutch Antilles 2 be applied also to ICS. For example, penetration or red
Belgium 39 Albania 1 team tests are generally avoided, as they may impair the
Russian Federation 37 Armenia 1
industrial process and lead to irrecoverable damage. They
may be tried in simulated environments mimicking parts of
Switzerland 34 Bermuda 1
the real system, but this severely limits usefulness of these
No country
31 Faroe Islands 1 methods. Also whitebox tests are often hard to conduct,
information available
because, as stated in Section 1, many components utilize
China 29 Guernsey 1
proprietary hardware architectures with closed-source soft-
Brazil 27 Iran, Islamic Republic of 1 ware. Security of the system begins with proper design.
Cyprus 23 Jersey 1 It is especially important with ICS, where large parts of
Estonia 20 Kazakhstan 1 the system (e.g. aforementioned Modbus network) lack any
Austria 17 Vietnam 1 security mechanisms at all.
Slovakia 16 Macedonia 1 There are many publications covering different aspects of
Hungary 14 Namibia 1 ICS security, but it is hard to find a general and up-to-
India 14 Trinidad and Tobago 1 date guidebook thoroughly covering all the aspects, from
Romania 13 Latvia 1
technical designs, through staff employment to operational
procedures. There is one special branch of the industry
Ukraine 12 Kuwait 1
though, where such guidebooks exist and are constantly
Lithuania 12 Malta 1
updated and improved. It is the nuclear energy industry.
Bulgaria 10 Total 7489 They are necessary because of potentially catastrophic con-

24
 On Preventing and Detecting Cyber Attacks in Industrial Control System Networks

sequences of a security breach there. The standards are new software versions are usually in place at industrial fa-
created and maintained by the International Atomic Energy cilities, including thorough tests performed in simulated
Agency (IAEA). Their quality is proven in practice, be- environments, and possibly even with some quarantine pe-
cause up to now there were only several publicly known, riods. On the other hand, updates are necessary, especially
successful cyber break-ins to nuclear facilities [10]. And when a severe security flaw or a functionality problem is
the only one that really inflicted some damage to the in- detected. Propagation of information about the vulnerabil-
dustrial process was with Stuxnet worm in 2010 on Iranian ities and updates constitutes another problem. Unlike in IT
military factories for uranium enrichment. These factories systems, where information about vulnerabilities found in
were outside IAEA control then and were using illegally most of the popular operating systems and applications is
acquired ICS components (because of embargo). Other at- available at a single location, e.g. NVD (National Vulnera-
tempts, like the one in 2014 in South Korea, did not affect bility Database), it is much harder to identify such a service
anything besides office computers of the company staff, not for ICS. Most big vendors publish their own security bul-
reaching any of the critical systems. The reason for this is letins in different formats and with different access rules.
that there are strict design requirements, described in [11], There are several national CERTs aggregating such infor-
and compliance with them is later checked at the licensing mation and republishing it, but the range of covered vendors
stage. may vary. The most complete and verbose are the ser-
One of the most important general design rules, formulated vices maintained by the American ICS-CERT [14]. There
in [11], is defense-in-depth – there have to be as many in- is a certain problem with them though – preparation of such
dependent levels of protection as possible, and a single data takes time, so alerts and advisories are often published
point of failure which exposes vital parts of the system by ICS CERT with a delay of several days compared to the
disqualifies the design. Such a point of failure does not original publication by the vendor of the affected system.
have to have the form of a physical entity. For example, it System administrators interested in getting the information
may be the same model of firewall used to separate differ- immediately are still forced to check security bulletins of
ent network levels. If a remotely exploitable vulnerability the vendors of all the components used in the system. This
is found in its software, access to all network levels may does not guarantee anything, though. Many PLCs are now
be obtained. The defense-in-depth rule is well known in built using standardized x86 or ARM architectures, so they
the IT security world, but is rarely strictly obeyed. In the often share many operating system components with IT sys-
nuclear sector, it is been applied to the construction of re- tems. When analyzing publications in NVD and security
actors almost since the beginning of their commercial use, bulletins of the ICS component vendors, it may be noticed
so naturally it is also strictly required in the field of cyber- that bug reports (and software patches) in the latter case
security. Security checks of industrial facilities must deal may appear even a year after their initial publication in
with the problem outlined at the beginning of this chapter. NVD. This means that very dangerous periods are expe-
Therefore, a strong emphasis is placed on security assess- rienced when unpatched ICS components can be attacked
by relying on general purpose IT exploits. This constitutes
ments considered to be the most effective way of prevent-
another reason for keeping ICS networks as isolated from
ing break-ins. There are many good general guides on how
the Internet as possible.
to perform a cybersecurity assessment of an ICS, so the
process will not be described in detail here. [12] may be The last aspect requiring consideration is personnel train-
a good starting point. But in this aspect, the nuclear indus- ing. All the people in the organization should know and
try also has its own procedures that are worth mentioning. understand the security policy, including engineering team
In the book [13], there is a detailed guide on how to per- and even office staff which has nothing to do with plant op-
form a security assessment of the entire facility, including erations. Recent successful break-in examples, like the one
such aspects as physical access and human resource poli- in Ukraine [5], show that the first stage of the attack usually
cies. Apart from the questions devoted directly to the pro- consists in spear phishing targeted at several people within
tection of radioactive materials, this publication may serve the organization. Getting inside the internal network, even
as a good basis for performing cybersecurity assessments via office computers, gives the attacker numerous oppor-
in any advanced industrial facility. tunities to spread the infection further. This is where the
defense-in-depth paradigm shows its usefulness, because
the aforementioned attack in Korea in 2014 ended within
4. Software the office network – the attackers were not able to breach
deeper levels of security. The results gathered by Leverett,
Because of very limited access of ICS systems to the In- Bondenheim and others, as cited in Section 2, show indi-
ternet, no automatic software updates may be performed. rectly the danger of too tight security policies. Even if the
Moreover, such an approach is discouraged in the case of policy is known by the engineering team, when it feels it
production systems. Availability and security of industrial hinders their work, they will look for a way to go around
processes come first, so if the software patch fixing some it. This may result in fully exposed systems using unau-
less important security issues contains a bug or a change in thorized modems, etc. That is why it is equally important
the functionality, the entire process is jeopardized. There- to ensure that the technical people responsible for plant
fore, complicated procedures regarding the installation of operations have real influence on security policies. This

25
Adam Padée et al.

cannot work one way, because an enforced policy written ware defined radio. Example of such an application may
without taking into account any feedback will be generally be found [16].
contested.
6. Conclusions
5. Detection of Successful Attacks This article presents the scale of the problem of in-
secure ICS systems. The data summarized in the paper
Advanced persistent threat (APT) attacks are extremely
and available in cited publications shows an alarming
hard to prevent and detect, as they use some sophisticated
trend in the security of ICS/OT networks. Strong evidence
social engineering techniques often paired with 0-day vul-
exists that the number of ICS installations without proper
nerabilities and structural weaknesses of the organization.
isolation of components from the Internet is growing,
Traditional means of detection, like antivirus software, are
despite the increasing level of awareness of the problem
not sufficient to stop this kind of attackers. That is why
among ICS vendors and despite constant presence of this
specialized Security Operations Centers (SOCs) have been
topic in the media. This can be partially attributed to the
becoming ever more popular recently. The idea of SOC is
threat hierarchy outlined in the introduction to this arti-
to proactively analyze network traffic and logs in order to
cle. When availability of the process is treated as the most
detect any suspicious behaviors.
important asset, cybersecurity issues are often overlooked,
A detailed setup falls outside of the scope of this article, because their direct impact on availability is delayed in
but there are many commercial products helping in per- time.
forming task, or even companies that may provide a com- The paper outlines several good practices on how to im-
plete SOC as an outsourced service. It is worth mentioning prove cybersecurity of ICS/OT networks, with references
though that it is possible to set up a functional SOC us-
to more detailed sources of information, e.g. the process of
ing open source tools, such as Elasticsearch + Logstash + establishing a simple SOC using open source tools to facili-
Kibana (ELK), Bro network monitor, topped off by the Mal- tate the detection of attacks. It also mentions the problem of
ware Information Sharing Platform (MISP). Especially the
locating unauthorized RF devices and ways to detect them.
last of these tools is very useful, because it is constantly fed The article shows how standards set for the nuclear indus-
with information by a very large community of users, so try may be used to protect critical assets in other domains
indicators of compromise (IOCs) are quickly recognized. where ICS are used, with references to detailed guidelines
Such a setup is being successfully used at the European included. These simple countermeasures may increase the
Organization for Nuclear Research (CERN) and other in-
security of the systems at a relatively low implementation
stitutes federated in the Worldwide LHC Computing Grid cost. More in-depth methods, such as introduction of cryp-
(WLCG), including the National Centre for Nuclear Re- tographic measures to ICS (e.g. with new versions of the
search in Poland [15].
Modbus protocol [3]) are deliberately skipped in this paper
Detection of backdoors using modems and other means of because they often require serious changes of the architec-
independent, unauthorized communication outside of the ture of the system and its components.
facility is another topic that is not necessarily covered even
by a well setup SOC. The risk of installation of such de-
vices can be minimized with proper policies (e.g. forbidding Acknowledgments
bringing any USB devices or mobile phones into the crit-
Work done as part of the CYBERSECIDENT/369195/I/
ical areas of the facility). It cannot be eliminated entirely
NCBR/2017 project supported by the National Centre of
though, without very expensive and troublesome means of
Research and Development in the frame of CyberSecIdent
security. Monitoring of Shodan results in search for com-
Programme.
pany’s specific equipment by the security team is not an
effective means of protection. Shodan indexes new sys-
tems in approx. 19 days [9], and, as stated earlier, does References
not cover private networks of Internet operators. It is also
[1] T. C. Reed, At the Abyss: An Insider’s History of the Cold War.
not easy to use Shodan for malicious purposes, because Presidio Press, 2004 (ISBN 0891418210).
of strict limits on the number of results in the free, anony- [2] T. Jablonski and M. Jach, “Jak 14-latek spowodowal katastrofę”,
mous version. For this reason, cybercriminals use their own 2008 [Online]. Available: http://lodz.naszemiasto.pl/archiwum/jak-
botnets to do the same work, and their indexing schemes 14-latek-spowodowal-katastrofe,1602388,art,t,id,tm.html [in Polish]
may be different. The use of radio-frequency (RF) shield- [3] “MODBUS/TCP Security Protocol Specification” [Online]. Avail-
able: http://modbus.org/docs/MB-TCP-Security-v21 2018-07-24.pdf
ing or signal jammers may be an effective way of ensuring [4] K. Stouffer, V. Pillitteri, S. Lightman, M. Abrams, and A. Hahn,
protection of critical assets, but effective shielding is very “Guide to industrial control systems (ICS) security”, NIST Special
expensive and jammers are usually forbidden by law. It is Publication 800-82 Revision 2, 2015
possible, though, to monitor RF signals in the area and even (doi: 10.6028/NIST.SP.800-82r2).
[5] R. M. Lee, M. J. Assante, and T. Conway, “Analysis of the cyber
identify active client stations, in a search for unauthorized attack on the Ukrainian power grid”, E-ISAC publication, March 18,
ones. The required hardware is expensive and difficult to 2016 [Online]. Available: https://ics.sans.org/media/
come by, but good results can be achieved even with soft- E-ISAC SANS Ukraine DUC 5.pdf

26
 On Preventing and Detecting Cyber Attacks in Industrial Control System Networks

[6] D. Fauri et al., “Encryption in ICS networks: A blessing or a curse?”, Michał Wójcik received his
in Proc. IEEE Int. Conf. on Smart Grid Commun. SmartGridComm B.Sc. and M.Sc. degrees in
2017, Dresden, Germany, 2017 Computer Science from War-
(doi: 10.1109/SmartGridComm.2017.8340732).
saw School of Information
[7] Shodan search engine home page [Online]. Available:
https://www.shodan.io/ Technology, Poland in 2013
[8] E. P. Leverett, “Quantitatively assessing and visualising industrial and 2018, respectively. His
system attack surfaces”, Master Thesis, University of Cambridge, main areas of interest are com-
2011 [Online]. Available: https://www.cl.cam.ac.uk/∼fms27/papers/ puter networks and, in partic-
2011-Leverett-industrial.pdf ular, network security, as well
[9] R. C. Bodenheim, “Impact of the Shodan computer search engine on
as information security man-
Internet-facing industrial control system devices”, Master Thesis, Air
Force Institute of Technology, Ohio, USA, 2014 [Online]. Available: agement systems according to
https://apps.dtic.mil/dtic/tr/fulltext/u2/a601219.pdf ISO 27001.
[10] P. Hitchin, “Cyber attacks on the nuclear industry”, Nuclear En- E-mail: [email protected]
gineering International, 15 September 2015 [Online]. Available: National Centre for Nuclear Research
https://www.neimagazine.com/features/featurecyber-attacks-on-the-
nuclear-industry-4671329/
Andrzeja Sołtana 7
[11] “Computer Security at Nuclear Facilities”, IAEA Nuclear Security 05-400 Otwock, Poland
Series No. 17 [Online]. Available: https://www-pub.iaea.org/mtcd/
publications/pdf/pub1527 web.pdf
[12] “Cyber security assessments of industrial control systems. A good Arkadiusz Ćwiek graduated
practice guide”, Centre for the Protection Of National Infrastructure, from the University of War-
U.S. Department of Homeland Security, Apr. 2011 [Online]. Avail- saw, M.Sc. in Physics, in 2011,
able: https://www.ccn-cert.cni.es/publico/
InfraestructurasCriticaspublico/CPNI-Guia-SCI.pdf
in Biophysics and Didactics in
[13] Conducting Computer Security Assessments at Nuclear Facilities,
mathematics and physics. From
IAEA, Vienna 2016 (ISBN: 978-92-0-104616-1). 2012 to 2018 leader of IT in
[14] ICS-CERT Alerts home page [Online]. Available: the “Pi of the Sky” robotic
https://ics-cert.us-cert.gov/alerts?page=1 telescopes project in which he
[15] D. Crooks et al., “Operational security, threat intelligence & dis- worked with the best Polish re-
tributed computing: the WLCG Security Operations Center Work-
search institutions, i.e. the Na-
ing Group”, in Proc. of 23rd Int. Conf. on Comput. in High Energy
and Nuclear Phys. CHEP 2018, Sofia, Bulgaria, 2018. tional Centre for Nuclear Re-
[16] R. Feroze, “Passive GSM sniffing with Software Defined Radio”, search, the Faculty of Physics of the University of War-
02/06/2017 [Online]. Available: https://payatu.com/passive-gsm- saw and the Centre for Theoretical Physics of the PAS.
sniffing-software-defined-radio/ Responsible for development and maintenance of the tele-
scope data acquisition and control systems, several facil-
ity instruments, and a suite of tools used for the prepara-
tion, planning and execution of observations. He was also
Adam Padée received his responsible for research, design, specification and imple-
M.Sc. in 2003 and his Ph.D. de- mentation of solutions. He also managed computer sys-
gree in 2013, both from the tems of the project spanning located on 2 continents. He
Faculty of Electronics and In- also supported Creotech Instruments in some projects cor-
formation Technology of the related with outer space observation. Since 2018 he works
Warsaw University of Technol- at Świerk Computing Centre. Currently he developing so-
ogy, Poland. He participated lutions using neural networks applied to computer network
in many European and na- security and computer vision.
tional projects focused on su- E-mail: [email protected]
percomputing and distributed National Centre for Nuclear Research
Andrzeja Sołtana 7
computing. Since 2009 he has
05-400 Otwock, Poland
been working for the National Centre for Nuclear Re-
search (NCNR). He was one of the founders of Świerk
Computing Centre. Currently he is the Head of Division Konrad Klimaszewski re-
of Computing Technologies and Deputy Director of De- ceived his M.Sc. in Physics
partment of Complex Systems at NCNR. His scientific in- from the Warsaw University of
terests are focused mainly on high performance computing Technology, Poland, and the
and infrastructure, evolutionary computation, IT and OT Ph.D. degree in Physics from
security. the Soltan Institute for Nuclear
E-mail: [email protected] Studies, Poland, in 2004 and
National Centre for Nuclear Research 2010, respectively. From 2015
Andrzeja Sołtana 7 he has been the Head of In-
05-400 Otwock, Poland formation Technology Services

27
Adam Padée et al.

Laboratory at the National Centre for Nuclear Research, Rafał Możdżonek received his
Poland. His scientific interests are focused mainly on high B.Sc. in Computational Physics
energy particle physics and nuclear medicine as well as and M.Sc. in Nuclear Physics
high performance computing, could computing security from Warsaw University of
and machine learning. Technology in 2011 and 2013,
respectively. Currently he is
https://orcid.org/0000-0003-0741-5922
a senior programmer at Lab-
E-mail: [email protected]
oratory for Information Tech-
National Centre for Nuclear Research
nologies, Department of Com-
Andrzeja Sołtana 7 plex Systems, National Centre
05-400 Otwock, Poland for Nuclear Research. His main fields of interest include
programming, numerical methods and data analysis.
E-mail: [email protected]
Przemysław Kopka is a last- National Centre for Nuclear Research
year student at the Warsaw Uni- Andrzeja Sołtana 7
versity of Technology at the 05-400 Otwock, Poland
Faculty of Physics. He has been
with the National Centre for Nu- Wojciech Wiślicki graduated
clear Research as Python de- from Department of Physics of
veloper since 2018. He holds the University of Warsaw in
an B.Sc. in Mathematics and 1982, received Ph.D. in Physics
Physics from Warsaw Univer- from A. Soltan Institute for Nu-
sity. His research areas focus on clear Studies in 1986, since
data processing and image re- 2007 and is a Professor Ordi-
construction. narius at National Centre for
E-mail: [email protected] Nuclear Research in Warsaw,
National Centre for Nuclear Research Poland. Currently he is a Direc-
Andrzeja Sołtana 7 tor of Department of Complex Systems and Computing
05-400 Otwock, Poland Centre at this institute, also leads scientific groups par-
ticipating in LHCb experiment at Large Hadron Collider
at European Centre for Nuclear Research and KLOE at
Frascati National Laboratory. His areas of scientific ac-
Sylwester Kozioł received his
tivity cover experimental high-energy physics and high-
M.Sc. degree in Automation performance computing. He is an author of about 600 pa-
and Electrical Metrology, with pers in various areas of physics and scientific computing,
distinction, from the Warsaw member of many committees, editorial boards and scien-
University of Technology, Po- tific bodies.
land, in 1979. Currently, he is https://orcid.org/0000-0001-5765-6308
a Major Technical Infrastructure E-mail: [email protected]
Specialist at National Centre National Centre for Nuclear Research
for Nuclear Research Świerk, Andrzeja Sołtana 7
Poland. 05-400 Otwock, Poland

E-mail: [email protected] Tomasz Włodarski received

National Centre for Nuclear Research his M.Sc. degree in Optoelec-
Andrzeja Sołtana 7 tronics from Gdańsk University
05-400 Otwock, Poland of Technology, Poland, in
2006. His main fields of inter-
est include high performance
Krzysztof Kuźmicki received engineer’s education at
computing clusters, network
Warsaw School of Computer Science with an excellent
security and protocols, cloud
degree in the major Managing Information Resources. computing and virtualization.
Currently, he is a Technical Infrastructure Specialist at Na-
tional Centre for Nuclear Research Świerk, Poland.
E-mail: [email protected] E-mail: [email protected]
National Centre for Nuclear Research National Centre for Nuclear Research
Andrzeja Sołtana 7 Andrzeja Sołtana 7
05-400 Otwock, Poland 05-400 Otwock, Poland

28