![]() ![]() Related to this, a recent large-scale study by Patel el al. These numbers of security advisories correlate well with the observed increase in the number and sophistication of cyber-attacks to industrial control systems.Īccording to an estimation by the United States Department of Homeland Security (DHS), about 90% of the reported security incidents result from exploits against defects in the design or code of software ( Department of Homeland Security 2020b). Before 2014 less than 100 advisories per year have been issued, while from 2017 to 2019 more than 200 advisories per year have been issued. Over the last decade, the number of security advisories issued per year has been steadily growing. ![]() Figure 1) shows the number of ICS alerts and advisories issued per year by the ICS-CERT. Industrial Control Systems (ICS) alerts are information put out by the ICS-CERT with the intention to provide timely notification to critical infrastructure owners and operators concerning threats or activity with the potential to impact critical infrastructure computing networks. The Industrial Control System - Computer Emergency Response Team (ICS-CERT ( Department of Homeland Security 2020a)) has been tasked with issuing ICS-specific alerts and advisories. The industry’s financial impact due to these and other forms of malware has already exceeded 10 billion USD and affected more than 140 countries ( Apextechservices 2017). More recently, in 2017, the Triton malware, which was coined “the world’s most murderous malware”, was uncovered attacking the petrochemical industry in Saudi Arabia. In the same year, BlackEnergy V3 attacked the Ukrainian power grid and energy distribution. In 2010 Stuxnet, which attacks Programmable Logic Controllers, was uncovered in 2014, the Havex malware, a Remote Access Trojan that contains code targeting industrial devices communicating over Open Platform Communications, was discovered. Over the last years, several attacks that target industrial control systems and cyberphysical systems have been identified. ![]() We report on three surveys showing that the Sifu platform’s CSC events are adequate to raise industry software developers awareness on secure coding. ![]() The CyberSecurity Challenges events based on the Sifu platform were evaluated during four online real-life CSC events. Furthermore, due to its characteristics, the Sifu platform allows for remote (online) learning, in times of social distancing. The introduced cybersecurity awareness platform, which the authors call Sifu, performs automatic assessment of challenges in compliance to secure coding guidelines, and uses an artificial intelligence method to provide players with solution-guiding hints. In the present work, we briefly introduce cybersecurity challenges and propose a novel platform that allows these events to take place online. However, until now, these coached events took place on-site. These cybersecurity awareness events have been used with success in industrial environments. CyberSecurity Challenges (CSC) form a method that combines serious game techniques with cybersecurity and secure coding guidelines to raise secure coding awareness of software developers in the industry. Therefore, several industrial standards mandate secure coding guidelines and industrial software developers’ training, as software quality is a significant contributor to secure software. Proper handling of software vulnerabilities is essential in the industrial context, particularly when the software is deployed in critical infrastructures. Software vulnerabilities, when actively exploited by malicious parties, can lead to catastrophic consequences. ![]()
0 Comments
Leave a Reply. |