IoT in Control

This project will explore the vulnerabilities that exist in industrial (PLC and SCADA) and building control (BMS) systems. These are believed to arise from technical and behavioural causes. The work will collect thumbnail case studies of actual and ‘near miss’ cyberattacks on industrial and building control systems and examine how the deployment of Internet of Things (IoT) system elements (sensors and actuators) affects the type and severity of risk. Using the learning gained from analysis, possible socio-technical interventions will be mooted and explored, in theory and with real equipment. The second strand of work will involve determining what novel cyber security architectures deliver the necessary consilience of security and safety policies (taking the philosophy: “if it is not secure it is not safe”) to ensure resilience. Considering threats arising from both the wireless communication capabilities (flooding, jamming, false message injection) and also from the dynamically aggregated services (Sybil attacks, replay attacks, sensor spoofing, and man-in-the-middle attacks), we will undertake a rigorous analysis of both security and safety implications of the various threats.

Target outcomes:

• Threat modelling and understanding cyber-risks in PLC/SCADA and BMS environments. Case studies demonstrating type and degree of vulnerability of control systems
• Best practice guidelines and blueprints for resilient architectures for IoT enhanced industrial environments.
• Recommendations and templates for policies and standards, for areas such as cyber security architectures
• Design of awareness-raising and training material.
• Techniques for raising awareness, external detection and protection measures and design interventions to mitigate risk.