산업제어시스템에 대한 고도화된 Kill Chain 공격 기법 연구
A Study on the Sophisticated Kill Chain Attack Tactics for Industrial Control System
0
조회
0
다운로드
1
인용
0
참고문헌
키워드
초록
산업제어시스템은 일반적으로 IT 시스템과 분리된 폐쇄망으로 운영되며 제어망 네트워크 통신을 위한 전용 프로토콜을 사용해 왔다. 그러나 정보통신 기술의 발달로 개방형 프로토콜 환경으로 변화하고 있다. 또한, 다양한 ICT 환경과 연계되어 상호 의존적 시스템을 구성하면서 제어망은 내부자위협을 포함하여 침투 경로가 다양해졌다. 특히 에너지 분야와 같은 기반시설에 대한 사이버 위협은사회적으로나 경제적으로나 큰 손실을 발생시킬 수 있다. 따라서 공격이 발생하기 이전에 방어 전략을 수립해야 하며, 공격에 대해 효과적인 대응 체계를 구축해야 한다. 본 연구에서는 OT의 다양한 산업 중 에너지 분야에 대해 1년간 발생했던 침해 사례를 중심으로 보안 취약점을 분석한다. 또한, MITRE ATT&CK 프레임워크를 활용하여 공격자의 침투 전략 및 공격 기술을 분석하여 제어시스템에 잠재적인 영향을 미칠 수 있는 위험을 식별하고 대응 전략을 제시한다.
Abstract
Industrial control systems are generally operated as a closed network separated from the IT system and have used a dedicated protocol for control network communication. However, with the development of information and communication technology, it is changing to an open protocol environment. In addition, as the system is interdependent in connection with various ICT environments, the control network has diversified penetration routes including insider threats. In particular, cyber threats to infrastructure such as the energy sector can cause great losses both socially and economically. Therefore, it is necessary to establish a defense strategy before an attack occurs, and an effective response system to the attack must be established. This study analyzes security vulnerabilities based on cases of infringements that have occurred for one year in the energy field among various industries of OT. In addition, by using the MITER ATT&CK framework, the attacker's intrusion strategy and attack technology are analyzed to identify risks that may have a potential impact on the control system and propose a countermeasure strategy.
참고문헌 (13)
- Blake E. Strom, "MITRE ATT&CK ™: Design and Philosophy" (2020)
- E. M. Hutchins, "Intelligence-driven computer network defense informed by analysis of adversary campaigns and intrusion kill chains", Leading Issues in Information Warfare & Security Research, 1(1), pp.80~ (2011)
- Eric Byres, "Using ANSI", ISA-99 Standards to Improve Control System Security, 2012
- S, Rizvi, "Identifying the attack surface for IoT network", Internet of Things, 9 (2020)
- "The Risks of an IT Versus OT Paradigm" (2019)[URL]
- Jinho Ryu, "A Study on the Improvement of Cybersecurity Exercise Policy for the Nuclear Faccilities" (2020)
- Joseph Slowik, "Evolution of ICS Attacks and the Prospects for Future Disruptive Events" (2019)
- Cyber Attack on Kudankulam Nuclear Power Plant, "Maj Gen P K Mallick", VIF, ~ (2019)
- Mark Clayton, "Exclusive: Cyberattack leaves natural gas pipelines vulnerable to sabotage", ~ (2013)
- The MITRE Corporation, "ATT&CK for Enterprise Introduction", ~ (2019)
- "The MITRE Corporation"[URL]
- Theodore J. Williamas, "The Purdue Enterprise Reference Architecture", ~ (1994)
- Yadav, Tarun, "Technical aspects of cyber kill chain", International Symposium on Security in Computing and Communication, pp.438~452 (2015), Springer