Reconfiguration of Firewall Filter Rules as a Response to Industrial Control System Intrusion

In recent years, industrial control systems (ICS) have become a target of choice for cybercriminals. In turn, developing new defense mechanisms against intrusions in ICS has become a necessity. In a previous work, we created a reaction framework, able to reconfigure a system under attack by migrating applications away from compromised host devices. Since communication within an ICS should be heavily filtered to prevent anomalous commands, we need to redefine these filters to match our new configurations. In this paper, from a formal description of the IEC 62443 compliant ICS under study, we aim to automate the creation of all necessary filter rules, and the adaptation to application migration and device isolation. This approach is tested on a small scale installation supervising a physical process with industrial hardware.