Moving Target Cyber Defence for Operational Technology

到目前为止，在公共领域中看到的那些针对性的操作技术（OT）攻击（例如Stuxnet，Triton，Crashwords，乌克兰的BlackEnergy）表明，攻击者需要特定的OT环境知识才能成功进行攻击。如果信息不准确或攻击程序错误（例如，使用Triton），攻击就会变得脆弱并且经常失败。因此，一个关键的问题是，我们是否可以增加OT攻击的脆弱性并提高OT系统的弹性？正如ICS网络杀伤链中所模拟的那样，攻击者花费了大量的早期努力和活动来收集必要的信息，以开发OT有效载荷并执行成功的攻击。如果此信息发生变化，则必须重复此信息收集过程并更新恶意软件有效载荷。因此，如果目标系统以“定期”的时间间隔进行更改，那么攻击者收集的任何信息都将具有与之相关的有效性过期时间。如果目标系统更改得足够频繁，这实际上可能是一个“永无休止”的活动循环，或者至少给攻击者施加压力，使其非常迅速地采取行动。 这种方法的最终结果至少可以实现两个结果：使有针对性的攻击变得不那么有效，充分挫败攻击者，以阻止他们针对特定的OT系统。当然，这需要取得平衡，在不影响系统业务需求的情况下，可以对OT系统进行多大程度的更改？是否存在这样一种情况，即这些更改过于频繁，系统的可靠性/弹性受到负面影响？因此，需要对这种缓解方法进行研究，以确定可行性、可扩展性和最佳方法，从而以最小的作战影响实现防御效益。什么是最先进的，什么是以前的研究成果，一般到移动目标防御，然后也更具体地在OT部门？2.确定哪些标准是“可移动的”，即OT系统的哪些方面可以改变，一旦知道哪些方面在干扰OT系统中的攻击方面提供最佳“回报”，同时还最大限度地减少对OT系统的操作影响。3.可以在将此付诸实践的OT系统内实施的机制。4.了解实现这一目标的其他挑战，例如安全、不情愿、培训等。期望值 ** 感谢博士，这是一个移动的目标，但要给出一个期望的想法; 1。概述如何根据当前的“最新技术水平”在技术上实现这一目标。2.一个概念证明，展示了这可能如何在真实的OT系统中实际工作（注意，这可能会被简化，Thales将提供一个“真实的”系统进行测试）。3.关于如何克服这种威胁缓解的潜在障碍的建议。

Those targeted Operation Technology (OT) attacks seen in the public domain to date (e.g. Stuxnet, Triton, CrashOverride, BlackEnergy in Ukraine) demonstrate that attackers require specific OT environment knowledge for their attacks to succeed. Where information is either inaccurate or the attacks mi-programmed (e.g. as with Triton) the attacks become fragile and often fail. Therefore a key question is could we increase the fragility of OT attacks and improve the resiliency of the OT system? As modelled in the ICS Cyber Kill Chain, an attacker spends a lot of their early effort and activities on gathering the necessary information to develop OT payloads and execute a successful attack. If this information changes then this information gathering process must repeat and the malware payloads updated. Therefore if the target system is changed at "regular" time intervals, then any information gathered by an attacker would have an expiration time on usefulness associated with it. If the target system changes frequently enough, this effectively could be a "never ending" loop of activity, or at the very least put pressure on the attacker to act very quickly. The net result of this approach could achieve at least two outcomes; render targeted attacks less effective, frustrate the attackers sufficiently to deter them from targeted that specific OT system. There is of course a balance to be struck, how much can an OT system be changed without impacting the business requirement of that system? Is there a point at which these changes are too frequent and the reliability / resilience of the system is negatively impacted? Therefore, this mitigation approach needs to be investigated to determine the viability, scalability and optimum approach to achieve the defensive benefits with the minimum amount of operational impact.Key Objectives ************** 1. What is the state of the art and what are the results of previous research into moving target defence generally and then also more specifically in the OT sector? 2. Identify what criteria is "moveable" i.e. what are the aspects of an OT system that can be changed, and once known which offer the best "return" in terms of interfering with attacks in an OT system, whilst also minimizing operational impact on the OT system. 3. The mechanisms that could be implemented within OT systems that put this into practice. 4. Understand the other challenges to making this a reality e.g. safety, reluctance, training, etc.. Expected Deliverables ********************* Appreciate with PhDs this is a moving target but to give an idea of expectation; 1. An overview of how this could be achieved technically based on the current "state of art". 2. A proof of concept showing how this could potentially work, practically, in a real OT system (note this is likely to be simplified, Thales will provide a 'real' system to test with). 3. Recommendations on how the potential blockers to such a threat mitigation might be overcome.