Interplay of Attacker Behaviors and Dependability Attributes in Industrial Control System Impact Analysis

Industrial control systems (ICS) are increasingly vulnerable to cyberattacks that can propagate to impact physical industrial processes. Existing research on ICS impact analysis views ICS dependability attributes as an afterthought and focuses primarily on attacks but not the attackers and their different behaviors. In this work, we include explicit considerations for ICS dependability attributes and attacker behaviors in ICS impact analysis. By adopting the Structured Cyberattack Impact Analysis (SCIA) approach, our model-based impact analysis is demonstrated on a manufacturing ICS modeled in UPPAAL-SMC. More specifically, we visualize and quantify, respectively, using simulations and statistical model checking, the potential impact of data tampering attacks when performed by attackers with different behaviors (random, relentless, and informed). Furthermore, the impact analysis results highlight the interplay of ICS dependability attributes in terms of (1) how attacks on ICS security can impact system reliability and availability, (2) how improving security can improve system availability and reliability, and (3) how accepting some sacrifices on one attribute (availability) can end up improving other attributes (security and reliability).