Cybersecurity vulnerabilities in operational technology

Abstract

Manually generate attack trees is an early widespread technique done by cybersecurity experts in order to first find the ways to attack a system and then figure out the methods to prevent those attacks from being successfully executed. However, this type of tedious process is neither error free nor complete and not feasible for a large system with more than a hundred nodes. Consequently, automated attack trees generation is devised. In this thesis, we conduct a literature survey on state-of-the-art attackers about the techniques they used to attack systems. In addition, we also compile a list of automated attack tree generators with a focus on the first Hierarchical Task Network (HTN) planner for cyber security called Joshua. The attack strategies from Joshua are also converted into Planning Domain Definition Language (PDDL) with the option to follow master attack rule framework. We then evaluate the effectiveness of an automated attack tree generator by using Joshua to discover attack plans of an anonymous operational technology organization X as a case study. From our case study, the vulnerabilities arise in the third-party software and could be resolved by either updating the software with patches or using other alternative software. Linux kernel is the most vulnerable components with the Common Vulnerability Scoring System (CVSS) score span across the whole spectrum. Nonetheless, this conclusion considers only the vulnerability resides within a single component. The attacker might not directly attack a certain vulnerability but execute a series of action that gradually fulfill an entire chain of attacks. This leads to more advanced attack plans but we need more elaborate data to progress further.