A Proposal for Security Training Tools in Building Systems

In today's information society, building systems integrated and managed by IP networks are becoming more common. However, there are many network devices, Internet of Things (IoT) devices, and other terminals in building systems, and the possibility that IoT malware such as “Mirai” could adversely affect the entire building is well foreseeable. Therefore, there is an urgent need to properly operate defenses against this problem in order to establish secure building systems. In addition, since there are precedents where damage has increased due to delays in responding to security incidents, training that assumes IoT malware has infiltrated a building is also necessary to familiarize security personnel. In this paper, we propose a training tool that uses Mirai, one of the IoT malware, and assumes that a terminal infected with Mirai has infiltrated a building. In particular, focusing on the communication and spreading functions of Mirai, we propose a safe training environment by installing actual bots as Mirai-infected terminals in a building system, a command and control (CnC) server that issues commands to the bots, and a loader that downloads malware to new terminals in a virtual environment. A secure training environment and training scenarios are then created. Furthermore, using the prototype training tool, we confirmed that it is possible to reproduce security incidents and conduct response training in an environment that mimics actual building systems. As a result, it is now possible to conduct incident response training based on a series of scenarios in a secure training environment, reproducing security incidents in an environment similar to an actual building system, which has been difficult in the past.