OT security architectures and threat modeling for industrial control systems

The research of the Josef Ressel Center for Intelligent and Secure Industrial Automation (JRC ISIA) revolves around the vision of a digital assistant for industrial control systems of discrete automation (e.g., production systems) that shall assist humans and intelligently control machines. The introduction of more autonomy and the increased data permeability increases pressure on the security of industrial control systems. This is why the JRC ISIA has three research fields: system architectures, AI and cybersecurity, or to be more precise, OT systems, OT intelligence and OT security.

To this end we built a complete production testbed with three injection molding machines, four robots, a conveyor system, a SCADA system and the entire IT infrastructure. All has been implemented with components of our company partners B&R Industrial Automation, COPA-DATA and SIGMATEK. Below is a picture of the production scenario and the testbed.

Production scenario ISIA testbed

Aside from control, AI and security research the following research lines concerning architectural aspects originated from the above vision:

  1. Aspects of model-based system architectures and digital twins for industrial control systems.

  2. Aspects of OPC UA architectures that enable the integration of AI and Big Data into industrial control systems.

  3. Aspects of OT security architectures and threat modeling for industrial control systems.

Here we present the third of those architecture research lines. For our security architecture research we implemented a network and security architecture within the above testbed that allows us to conduct research concerning threat modeling, systematic asset analysis and the integration of legacy devices.

ISIA testbed security architecture

Beyond architectural research, the security architecture also needs to accommodate the integration of AI and the digital assistant and also OT-aware honeypots and behavioral intrusion detection systems.

STRIDE for industrial control systems

Threat identification and threat modeling is a crucial step in the design of secure industrial control systems. The STRIDE methodology is well known for threat identification in the software domain, yet in its original form it was designed for IT systems. In contrast to IT, OT systems have different requirements as outlined by the NIST 800 82 and leads to different requirements concerning availability, functional safety, the lifecycle of systems and physical threats.

This raises two research questions: (i) how can STRIDE actually be applied to industrial control systems and (ii) how can STRIDE be adapted to the specific requirements of industrial control systems. In [SRSH24] we present a review of STRIDE-based threat modeling methodologies for industrial control systems under this umbrella. We conclude that STRIDE is widely used in OT domains, but only a few publications actually adapt STRIDE to the specific requirements of OT systems.

We identify five challenges that need particular attention when applying STRIDE to OT systems: the modeling of physical components, the level of detail used for the analysis, scalability, modeling of the lifecycle, and the usability of security mitigations in ICS.

AsIf: Asset Interface Analysis

A key step in threat modeling, such as for STRIDE, is the identification of assets and their interfaces. Without a systematic approach to asset interface analysis, threat modeling (that is, the so-called data flow diagram) is often incomplete and later on leads to insufficient mitigation strategies.

At the same time, OT systems from a computer scientist’s point of view are distributed, embedded, real-time, cyber-physical systems. Consequently, the aspect of asset interface analysis for OT systems shall reflect on these aspects, especially the concerns of distributed and cyber-physical systems.

In [RSSH24] we present a novel approach to exactly address this aspect. We demonstrate the proposed method by applying it to a programmable logic controller (PLC) of in our real-world testbed:

AsIf PLC demonstration

The results of the application are presented in the paper, as well as the results of a study involving a group of 12 security experts. The study also offers valuable insights into the experts’ general perspectives and workflows on threat modeling.

Secure data bridging for legacy devices

Legacy architectures and network and fieldbus protocols are still widely used in industrial control systems yet lack modern security features. They lack security by design, raising the question of how to retrofit existing legacy devices with modern security features. This is especially important in the context of Industry 4.0, where secure data exchange between secure and insecure zones is required.

In [SRSSH26] we present a novel approach to secure data bridging for legacy devices in industrial control systems that is based on the OPC UA aggregation concept. The contribution can be summarized as follows:

  1. We provide a structured review of published aggregation solutions and analyze them with regard to their security capabilities.

  2. As none of the published solutions are found to focus on security, we define a common threat model and introduce three general architectural concepts for embedding insecure legacy systems in a modern, secure industrial network aligned with the Purdue model.

  3. We implement the most practical of these concepts as a proof-of-principle, named SigmaServer, and evaluate its performance characteristics, such as latency and system load, demonstrating that retrofitting can be achieved with acceptable technical effort and low system overhead.

SigmaServer architecture

This concept was again demonstrated and evaluated in our real-world ISIA testbed mentioned above. A key aspect in the evaluation was the performance of the SigmaServer in terms of real-time capabilities.