RESICS:Resilience and Safety to attacks in ICS and CPS

我们都非常依赖和使用数字系统来感知和控制物理过程和环境。电力、天然气、水和其他公用事业需要国家和地方基础设施的持续运营才能提供服务。工业流程，例如化学制造，水泥，钢铁，铝或化肥等材料的生产，以及汽车生产或制药的制造链，同样位于数字和物理的交叉点。这种交叉点也适用于其他CPS，如机器人、自动汽车和无人机。所有这些系统都面临恶意威胁，并已成为不同威胁行为者的网络攻击目标，这些威胁行为者包括心怀不满的员工、黑客、恐怖分子、有组织犯罪和民族国家。我们的网络社会日益脆弱和易受伤害，正在迅速接近无法容忍的极限。随着这些系统变得越来越大和复杂，任何这些基础设施的服务中断都可能造成重大的连锁反应，对安全、经济和社会造成影响。由于我们非常依赖这些系统的运行，因此即使这些系统受到攻击并已部分受损，也必须尽量减少对其运行的中断。由于它们在物理环境中运行，因此必须始终保持这些系统的安全性，以避免物理损坏甚至威胁生命。因此，要确保这类系统在受到恶意威胁时的复原力、生存能力和持续运作，就需要整合安保分析、安全分析、系统设计和运作等方法和程序，而这些方法和程序传统上是单独进行的，每一项都涉及专业技能和大量人力。这不仅成本高，而且容易出错，并延迟对安全事件的响应。这些方法的全面整合和自动化将是今后许多年的挑战。然而，RESICS旨在显著推进最先进的技术水平，并提供新的贡献，以促进：a）在面对对抗性威胁时对此类系统进行风险分析，同时考虑到安全事件对级联相互依赖关系的影响; B）描述可能对系统安全产生影响的攻击，确定可能导致此类攻击的路径; c）确定可用于减轻威胁和遏制攻击影响的对策;以及d）确保可应用此类对策，同时保持系统的安全性和操作限制，并最大限度地提高其可用性。这些贡献将在多个测试平台、数字孪生模型、网络范围和不同行业的多个用例中进行评估。为了实现这些目标，RESICS将联合收割机结合模型驱动和经验方法进行安全分析，采用系统思维方法，强调安全性、安全性和弹性是系统的新兴属性。RESICS利用安全和安保方法与正式方法的应用相结合的初步结果，并结合基于模型的方法和经验方法来分析ICS和CPS中的相互依赖关系。

We all critically depend on and use digital systems that sense and control physical processes and environments. Electricity, gas, water, and other utilities require the continuous operation of both national and local infrastructures to deliver their services. Industrial processes, for example for chemical manufacturing, production of materials such as cement, steel, aluminium or fertilizers, and manufacturing chains for car production or pharmaceuticals similarly lie at this intersection of the digital and the physical. This intersection also applies in other CPS such as robots, autonomous cars, and drones.All such systems are exposed to malicious threats and have been the target of cyber-attacks by different threat actors ranging from disgruntled employees to hacktivists, terrorists, organised crime and nation states. The increasing fragility and vulnerability of our cyber-enabled society is rapidly approaching intolerable limits. As these systems become larger and more complex interruption of service in any of these infrastructures can cause significant cascading effects with safety, economic and societal impacts.Because we critically depend on the operation of such systems, disruption to their operations must be minimised even when they are under attack and have been partially compromised. Because they operate in a physical environment, the safety of such systems must be preserved at all times to avoid physical damage and even threat to life. Therefore, ensuring the resilience of such systems, their survivability and continued operation when exposed to malicious threats requires the integration of methods and processes from security analysis, safety analysis, system design and operation that have traditionally been done separately and that each involve specialist skills and a significant amount of human effort. This is not only costly, but also error prone and delays response to security events. The full integration and automation of such methodologies will be a challenge for many years to come. However, RESICS aims to significantly advance the state-of-the-art and deliver novel contributions that facilitate: a) risk analysis for such systems in the face of adversarial threats taking into account the impact of security events across the cascading inter-dependencies; b) characterising attacks that can have an impact on the safety of the system, identifying the paths that make such attacks possible; c) identifying countermeasures that can be applied to mitigate threats and contain the impact of attacks; and d) ensuring that such countermeasures can be applied whilst preserving the system's safety and operational constraints and maximising its availability. These contributions will be evaluated across several test beds, digital twins, a cyber range and a number of use-cases across different industry sectors. They will deliver increased automation, lower the skill requirements involved in the analysis and in mitigating threats and improve response times to security incidents.To achieve these goals RESICS will combine model-driven and empirical approaches across both security and safety analysis, adopting a systems-thinking approach which emphasises Security, Safety and Resilience as emerging properties of the system. RESICS leverages preliminary results in the integration of safety and security methodologies with the application of formal methods and the combination of model-based and empirical approaches to the analysis of inter-dependencies in ICSs and CPSs.