This is a sel -a chi ed e sion o an o iginal a icle. This e sion
may di e om he o iginal in pagina ion and ypog aphic de ails.
Au ho (s):
Ti le:
Yea :
Ve sion:
Copy igh :
Righ s:
Righ s u l:
Please ci e he o iginal e sion:
CC BY-NC-ND 4.0
h ps://c ea i ecommons.o g/licenses/by-nc-nd/4.0/
Valida ion o Senso Da a In eg i y in OT En i onmen s Th ough Mul isou ce Da a
Senso s
© 2024 Eu opean Con e ence on Cybe Wa a e and Secu i y
Published e sion
Simola, Jussi; Takala, A u; Lehkonen, Riku; F an i, Tapio; Sa ola, Reijo
Simola, J., Takala, A., Lehkonen, R., F an i, T., & Sa ola, R. (2024). Valida ion o Senso Da a
In eg i y in OT En i onmen s Th ough Mul isou ce Da a Senso s. In M. Leh o, & M. Ka jalainen
(Eds.), P oceedings o he 23 d Eu opean Con e ence on Cybe Wa a e and Secu i y (23, pp.
487-495). Academic Con e ences In e na ional L d. P oceedings o he Eu opean Con e ence on
Cybe Wa a e and Secu i y. h ps://doi.o g/10.34190/eccws.23.1.2335
2024
Valida ion o Senso Da a In eg i y in OT En i onmen s Th ough
Mul isou ce Da a Senso s
Jussi Simola, A u Takala, Riku Lehkonen, Tapio F an i and Reijo Sa ola
Uni e si y o Jy äskylä, Finland
Jussi.hm.simola@jyu. i
a u.h. akala@jyu. i
iku.p.lehko[email p o ec ed]i
apio.k. an i@jyu. i
eijo.m.sa ola@jyu. i
Abs ac : This esea ch pape ocuses on de ec ing cybe h ea s om he OT en i onmen by combining da a om mul iple
sou ces. Moni o ing cybe secu i y o hyb id h ea s in an indus ial OT en i onmen is di icul due o di e en equipmen ,
p o ocols, en i onmen s, pe sonnel managemen and aining, e c. Howe e , he OT en i onmen can also be obse ed wi h
a mul isou ce senso sys em, which can be used o collec da a. By combining IT and OT da a, addi ional cybe h ea s can
be ound. Especially conce ning he in eg i y o OT command-and-con ol da a. We deal wi h he key concep s and
di e ences o he indus ial ope a ing en i onmen , which c ea e challenges compa ed o he adi ional IT en i onmen .
This is impo an because he policies de ined a he Eu opean le el o he NIS2 egula ion a e coming o ouch all membe
coun ies, ega dless o wha he na ional implemen a ion schedule is. The inc eased s anda ds o OT en i onmen cybe
secu i y implemen a ion and de elopmen will also ha e an impac on he pe sonnel managemen and aining o suppo
he onboa ding o he s anda ds in p ac ice. C i ical in as uc u e p o ec ion is impo an because, wi hou he p o ec ion
o c i ical in as uc u e, i al unc ions cease o unc ion. Hos ile ac o s cause secu i y challenges among Wes e n ac o s. In
his s udy, we del e in o whe he i is possible o ind h ea s conce ning OT command-and-con ol p ocess. The inc eased
da a su ace collec ed om he IT/OT en i onmen imp o es he capabili ies o he sys em o de ec malicious a acks
owa ds he OT sys em. Wi h he help o es equipmen , he goal is o demons a e ha i is possible o ind h ea s by
combining da a om mul iple sou ces. Wi h he help o es equipmen , we ind ou IT and OT capabili ies, which we load
wi h a ious a acks and anomalies. We p oduce added alue compa ed o adi ional moni o ing me hod es cases by
compa ing da a ob ained om di e en sou ces. The esea ch pape shows he impo ance o de ec ing OT h ea s. By
moni o ing IT and OT en i onmen s and combining hei da a, we can ind hidden h ea s. Only one es equipmen
con igu a ion has been used in he s udy, bu he esul s can be gene alized and classi ied. The s udy also p o ides guidelines
o how he de ec ion o cybe h ea capabili ies should be de eloped.
Keywo ds: Tes bed En i onmen , Senso In eg a ion, Senso Da a In eg i y, Ope a ional Technology, Cybe secu i y
1. In oduc ion
The pu pose o he CSG (Cybe secu i y Go e nance o Ope a ional Technology in he Sma Ene gy) p ojec is o
de elop a go e nance model o ope a ional echnology ecosys ems o minimize Ope a ional Technology isks
and c ea e a new s anda dized ope a ing en i onmen o he indus ial en i onmen . The main aim o he CSG
p ojec is o de elop a Go e nance model o he Ope a ional echnology- ela ed en i onmen s. The s udy's
esul s will be used o design p ocesses o he go e nance model in he OT-SOC en i onmen whe e he
Indus ial Con ol Sys em (ICS) is a c ucial ope a i e ac o in an indus ial en i onmen .
EU's cybe secu i y s a egy se he amewo k o he o ma ion o na ional-le el cybe secu i y (Eu opean
Commission, 2020, 2022; ENISA, 2023). The NIS2 di ec i e by he Eu opean Commission (2022) s a es ha e e y
Eu opean Union membe s a e mus adop a Na ional Cybe secu i y S a egy (NCSS) and es ablish a cybe
secu i y go e nance model. The Eu opean S a egic Ene gy Technology plan aims o boos he ansi ion owa ds
a clima e-neu al ene gy sys em (Eu opean Pa liamen 2023).
A a gene al le el, as a pa o co po a e go e nance, se e al elemen s a e ela ed o he o ma ion o
cybe secu i y go e nance. The amewo ks a e essen ially connec ed o each o he . C ucial ulne abili y
elemen s o secu i y and cybe secu i y consis o people, p ocesses, and echnical aspec s (Eu opean
Commission 2022, 2023).
The ope a ional echnology en i onmen , especially he ene gy sec o , is c i ical o e e y i al unc ion. I
cybe a acks dis up ene gy supply chain sys ems, all connec ed ope a ional echnology sys ems will shu down
soon o la e . The e o e, i is impo an also o apply cybe secu i y supply chain isk managemen guides (GSA,
2014). The esea ch concen a es on moni o ing p ocess con ol a he ope a ional and echnical le els. I is
impo an o enhance de ec ion capabili ies because o he digi aliza ion o he OT en i onmen . NIS2 (2023)
equi es enhanced in o ma ion sha ing ega ding cybe h ea s and inciden s because i has been seen ha
487
P oceedings o he 23 d Eu opean Con e ence on Cybe Wa a e and Secu i y, ECCWS 2024
A u Takala e al
c i ical in as uc u e p o ec ion is no possible o main ain wi hou new egula ions. The isibili y o he cybe
h ea con ol mechanism and he capabili y o de ec and sha e h ea in o ma ion a e impo an pa s o
con inui y managemen , which depends on he con inui y o business ope a ions.
The pape concen a es on compa ing da a om di e en places in he es bed en i onmen . The da a will be
used o e i y he in eg i y o he ope a ional echnology p ocess. We will use se e al da a moni o ing poin s.
The ocus is on how o see e en s in di e en places. We compa e he ou pu da a o he h ea in o ma ion.
2. Impo ance o C i ical In as uc u e P o ec ion
2.1 Ope a ional Technologies in a ious indus ies and connec ions.
Ne wo king and In o ma ion Sys ems di ec i e NIS2 se s equi emen s o he companies and hei s a egic,
ope a ional, and echnical unc ions (Eu opean Pa liamen , 2022). In addi ion, he Cybe Resilience Ac
(Eu opean Commission, 2022) suppo s he goals o he NIS2, and i endo ses he aims o he CER Cybe
Resilience di ec i e. CRA consis s o equi emen s o he manu ac u ing p ocess o digi alized p oduc s,
indus ial companies, and cybe secu i y aining me hods o he pe sonnel and managemen o secu i y
ope a ions (Eu opean Commission, 2022).
The Cybe secu i y and In as uc u e Secu i y Agency CISA (2020) lis s c i ical in as uc u e in 16 sec o s which
a e Chemical Sec o , Comme cial Facili ies Sec o , Communica ions Sec o , C i ical Manu ac u ing Sec o , Dams
Sec o , De ense Indus ial Base Sec o , Eme gency Se ices Sec o , Ene gy Sec o , Financial Se ices Sec o , Food
and Ag icul u e Sec o , Go e nmen Facili ies Sec o , Heal hca e and Public Heal h Sec o , In o ma ion
Technology Sec o , Nuclea Reac o s, Ma e ials, and Was e Sec o , T anspo a ion Sys ems Sec o , Wa e and
Was ewa e Sys ems Sec o .
Ope a ional echnology is i al o c i ical in as uc u es because o he in e connec ed and mu ually dependen
physical sys ems and a hos o in o ma ion and communica ions echnologies (Pee enboom, 2001). C i ical
in as uc u es a e called a “sys em o sys ems” because o he in e dependencies ha exis be ween a ious
indus ial sec o s and he in e connec ions be ween business pa ne s (Pee enboom, 2001; Rinaldi, 2001). An
inciden in one sec o o he c ucial in as uc u e can, di ec ly and indi ec ly, a ec o he in as uc u es
h ough cascading and escala ing ailu es. The e o e, isibili y in o ne wo k a ic and de ice beha io s in OT
ne wo ks is impo an . I is less han adequa e ac oss he sec o ega dless o he capabili y o a pa icula
o ganiza ion (U.S. Depa men o Ene gy (2021). By be e unde s anding he o ganiza ion's OT en i onmen ,
hey may be able o co ela e a mo e mino anomaly o a po en ial a ack, mo ing he asse owne ’s h ea
de ec ion capabili y ea lie in o an a ack campaign and p e en ing mo e signi ican impac s on ope a ions (U.S.
Depa men o Ene gy, 2021).
2.2 Vulne abili ies in G id Powe Sys ems
Acco ding o he NIST (2023), he elec ical powe ansmission and dis ibu ion g id indus ies use
geog aphically dis ibu ed SCADA con ol echnology ha ope a es highly in e connec ed and dynamic sys ems
ha consis o coun less public and p i a e u ili ies and u al coope a i es o supplying elec ici y o end use s
NIST (2023). Rega ding E o e al. (2016), he elec ic powe sys em is a complex ne wo k o elec ic componen s
designed o gene a e, anspo , and deli e elec ici y ac oss wo dis inc ye in eg a ed sys ems, bu is no
clea ly de ined he in e up ions due o ac o s a ec ing he bulk powe sys em and ac o s a ec ing he
dis ibu ion sys em. The same ype o undamen al p oblems is mos ly ela ed o he ulne abili ies agains
cybe -a acks and lack o s anda diza ion. Acco ding o he IDAHO (2016), dis ibu ion and local deli e y o
elec ici y a e gene ally no conside ed pa o he U.S. bulk Elec ic Sys em and a e o e seen by s a e public
u ili y commissions. Implemen ing cybe secu i y s anda ds a ies in he b ead h o p o ec ions and backup
measu es o dis ibu ion u ili ies. Cybe -a acks on dis ibu ion elemen s can ha e consequences ha each he
Bulk Elec ic Sys em. The i s known hack o a ec a powe g id occu ed in Uk aine in 2015 when a dis ibu ion
sys em se ed as he a ack plane. Ad e sa ies used malwa e o access IT in as uc u e and hen hijacked he
SCADA dis ibu ion managemen sys em o cause changed s a es o he dis ibu ion elec ici y in as uc u e
and a emp o delay es o a ion by wiping SCADA se e s a e hey caused he ou age, while simul aneously
p e en ing calls epo ing powe ou ages om eaching cus ome se ice cen e s, esul ing in a couple o hou s
ou age. The a acke s conduc ed mon hs o econnaissance be o e he a ack, planning o execu e he a acks
ha ook mul iple subs a ions o line and disabled backup powe om wo dis ibu ion cen e s simul aneously
(IDAHO, 2016; Ze e , 2016). Ope a ional echnology- ela ed Ene gy dis ibu ion sys ems a e ulne able because
488
P oceedings o he 23 d Eu opean Con e ence on Cybe Wa a e and Secu i y, ECCWS 2024
A u Takala e al
he ad e sa ies unde s and how impo an he ene gy supply chain is o all ope a ional en i onmen s. Enemy
na ions ha e an in e es in manipula ing wo kable sys ems.
In he connec ion o Ope a ional Technology, se e al indus ial con ol sys em de ices include emo e access
capabili ies, and indus ial con ol sys ems a e inc easingly connec ed o co po a e business ne wo ks (GAO,
2018). Acco ding o he GAO (2018), a acke s' emo e access is an inc easingly po en ial cybe h ea a ge o
manipula ing ICS de ices. Because unc ionali ies depend on he ene gy supply, he e is a need o de elop OT
en i onmen s ha a e mo e p o ec ed agains cybe -a acks. Cybe h ea de ec ion capabili ies a e a c ucial
pa o o e all cybe secu i y. The pape concen a es on he equi emen s o he cybe h ea / e en de ec ion
capabili ies.
2.3 Enhancing Cybe Secu i y Si ua ional Awa eness a he Ope a ional Le el
The ENISA (2022), Go e nance model has been di ided in o ou le els. Poli ical, s a egic, ope a ional, and
echnical le els. The echnical le el o adminis a ion aims o link he implemen a ion s a egy so ha echnical
and echnological de elopmen akes place simul aneously, which is essen ial in cybe space, a apidly
de eloping ield whe e new h ea s and challenges a ise simul aneously as new echnological oppo uni ies and
solu ions. The ope a ional/ echnical le el is c ucial o he o ma ion o si ua ional awa eness. Technical,
ne wo k and so wa e-based da a-sha ing capabili ies a e c ucial, and human in e ac ion a ec s he g ound-
le el ans o med in o ma ion.
De ense in Dep h is based on he mili a y concep ha p o ides ba ie s o impede he p og ess o in ude s
om a aining hei goals while moni o ing hei p og ess and de eloping and implemen ing esponses o he
inciden o epel hem (Homeland Secu i y, 2016). As Homeland Secu i y (2016) s a es, an o ganiza ion mus
ecognize he ela ionship be ween in ude s and ulne abili ies o he con ols (s anda ds and
coun e measu es) pu in place o p o ec ope a ions, pe sonnel, and echnologies. Acco ding o he De ense-
in-Dep h P o ec ion o Indus ial Con ol Sys ems, he connec ion be ween In o ma ion Technology and Con ol
Sys ems in an o ganiza ion's secu i y unc ions is c ucial. The de ense-in-dep h s a egy consis s o he ollowing
elemen s, as Table 1 illus a es (Homeland Secu i y, 2016).
Table 1: The elemen s o he de ense-in-dep h s a egy (Homeland Secu i y, 2016)
De ense-In-Dep h S a egy Elemen s
Risk Managemen P og am
• Iden i y Th ea s
• Cha ac e ize Risk
• Main ain Asse In en o y
Cybe secu i y A chi ec u e
• S anda ds/ Recommenda ions
• Policy
• P ocedu es
Physical Secu i y
• Field Elec onics Locked Down
• Con ol Cen e Access Con ols
• Remo e Si e Video, Access Con ols, Ba ie s
ICS Ne wo k A chi ec u e
• Common A chi ec u al Zones
• Demili a ized Zones (DMZ)
• Vi ual LANs
ICS Ne wo k Pe ime e Secu i y
• Fi ewalls/ One-Way Diodes
• Remo e Access & Au hen ica ion
• Jump Se e s/ Hos s
Hos Secu i y
• Pa ch and Vulne abili y Managemen
• Field De ices
• Vi ual Machines
Secu i y Moni o ing
• In usion De ec ion Sys ems
• Secu i y Audi Logging
489
P oceedings o he 23 d Eu opean Con e ence on Cybe Wa a e and Secu i y, ECCWS 2024
A u Takala e al
De ense-In-Dep h S a egy Elemen s
• Secu i y Inciden and E en Moni o ing
Vendo Managemen
• Supply Chain Managemen
• Managed Se ices/ Ou sou cing
• Le e aging Cloud Se ices
The Human Elemen
• Policies
• P ocedu es
• T aining and Awa eness
Acco ding o (Homeland Secu i y, 2016), o ganiza ions can use i e p inciples o coun e measu es o d i e
ac i i ies in ICS en i onmen s. The ollowing s eps will pa e he way owa d a mo e obus secu i y en i onmen
and signi ican ly educe he isk o ope a ional sys ems.
• Iden i y, minimize, and secu e all ne wo k connec ions o he ICS.
• Ha den he ICS and suppo ing sys ems by disabling unnecessa y se ices, po s, and p o ocols, enable
a ailable secu i y ea u es and implemen obus con igu a ion managemen p ac ices.
• Con inually moni o and assess he secu i y o he ICS, ne wo ks, and in e connec ions.
• Implemen a isk-based de ense-in-dep h app oach o secu ing ICS sys ems and ne wo ks.
• Manage he human—clea ly iden i y equi emen s o ICS; es ablish expec a ions o pe o mance;
hold indi iduals accoun able o hei pe o mance; es ablish policies; and p o ide ICS secu i y aining
o all ope a o s and adminis a o s.
3. Da a In eg i y Valida ion and P ocess In eg i y
3.1 Managing In o ma ion Secu i y in IT and OT En i onmen s
3.1.1 CIA and AIC T iad
Con iden iali y, In eg i y, and A ailabili y (CIA) iad is a o m o ep esen a ion o he undamen al elemen s o
secu i y objec i es in in o ma ion sys ems (NIST, 2020a,2020b). Con iden iali y is ocused on he es ic ions on
he use and s o age o da a, which may be los in cases such as du ing insecu e da a ansmission o access
con ol (Ka &e .a., 2021) On he o he hand, in eg i y o e s gua an ees ha da a has no been ampe ed wi h.
One way o a emp o secu e da a du ing ansmission is o use checksums o alida e he in eg i y o he
ans e ed da a be ween he sende and he ecei e (Ka and Zolkipli, 2021). A ailabili y in in o ma ion sys ems
ensu es ha he au ho ized use s ha e imely and unin e up ed access o necessa y in o ma ion, esou ces,
and componen s. In OT en i onmen , a ailabili y includes being able o use he de ices ha a e pa o he
sys em, which could be c ucial o he en i onmen hey’ e in (Ka and Zolkipli, 2021). The impac o a ailabili y
is exace ba ed in c i ical in as uc u e, whe e he loss o a ailabili y would ha e cascading impac on socie y.
Al hough CIA iad implemen s hea y ocus on echnical secu i y con ols, when socio- echnical elemen s a e
impo an in sys em secu i y, i is a aluable and s aigh o wa d way o unde s and and sol e issues ha a e
ele an in in o ma ion secu i y (Samonas and Coss, 2014). Fo example, i is especially ele an in Common
Vulne abili y Sco ing Sys em (CVSS) sco ing when sys em impac o a ulne abili y is es ima ed, which a e used
in es ima ing se e i y o Common Vulne abili ies and Exposu es (CVE) e en s. CIA iad has i s oo s in mili a y
secu i y mindse , whe e he p o ec ion is pe ime e ocused agains ex e nal h ea s (Samonas and Coss, 2014).
Addi ionally, loss o CIA o in o ma ion o in o ma ion sys ems is used as basis in de elopmen o ele an
secu i y con ols (NIST, 2020)b.
3.1.2 On he Aspec s o CIA/AIC T iad in IT/OT
CIA iad o igina es om IT domain, whe e he secu i y ea u es aim o p o ide sa e y by p o ec ing i sel agains
cybe a acks. T adi ional OT domain’s sa e y aims o ensu e unc ional esilience and sa e y o p o ec he
en i onmen and humans agains unwan ed ope a ions ha could lead o physical damage o inju ies (Holle e
& e .al, 2022). Addi ionally, p io i ies conside ing he CIA iad a e in e se be ween adi ional IT and OT
en i onmen s, whe e IT en i onmen s p io i ise con iden iali y i s (CIA) and OT en i onmen s a ailabili y i s
(AIC)5. Wi h he OT 4.0 shi o in eg a ing IT capabili ies and in e acing OT de ices in o IT in as uc u e, he
di e ence be ween IT and OT is diminished, since i opens OT en i onmen s as a ge s agains cybe a acks. Fo
490
P oceedings o he 23 d Eu opean Con e ence on Cybe Wa a e and Secu i y, ECCWS 2024

A u Takala e al
example, cybe a acks may a ge OT en i onmen s o p e en he a ailabili y o sa e y unc ion o an OT de ice,
which may lead o unde mined sa e y o he en i onmen . Howe e , while loss o a ailabili y migh be he majo
h ea in OT en i onmen s, loss o con iden iali y and in eg i y may be used o cause loss o a ailabili y wi h
cybe a acks. In an au oma ed sys em, he loss o in eg i y can lead o a highe loss o a ailabili y. This is due o
he po en ial o sys em shu down igge ed by cascading adjus men s. These adjus men s a e based on he
alsi ied da a and a e in ended o s ee he sys em owa ds co ec unc ion. Fo example, i da a ou es ha e
hei in eg i y los (manipula ed de ice s a us epo ), he au oma ed sa e y sys em shu down may be used as
he a ack ec o o damage he equipmen , leading o loss o a ailabili y, which in u n impac s he secu i y
(Den lze &e .al,.2021). Simila ly, loss o con iden iali y on highe p i ileges and de ice da a may lead o hem
being used o aid in a acks agains he OT en i onmen 's a ailabili y. The e o e, while a ailabili y is he mos
impo an a ge o de end, con iden iali y and in eg i y a e inhe en ly connec ed o o e all a ailabili y in OT
4.0 en i onmen s. This leads o he need o balance all aspec s o he CIA iad o ensu e sa e y when designing
sys em con ols a he han p io i izing con iden iali y i s .
4. Backg ound Theo y
We ha e applied a design science esea ch me hodology, which is used adi ionally in sys em de elopmen
(He ne & e .al., 2004). As pa o he design science p ocess, he mul iple case s udy esea ch-based s a egy
by Yin (2004) and he knowledge base o he case s udies c ea e a co e amewo k o he go e nance model
and gene a e an added knowledge base. This i e a i e design science p ocess ou pu mus be di e en om he
p esen sys em. The MITRE A &ck (2023) amewo k has o med he common base o analyzing cybe -a acks,
ac ics, and scena ios. I has i s own weaknesses ela ed o indus y-based h ea classi ica ion, bu i is e y
sui able o apply o almos all kinds o companies. Ope a ional Technology-based ulne abili ies a e nowadays
he main a ge when he aim is o de elop a cohe en cybe secu i y en i onmen . The MITRE A ack amewo k
(2023) is an impo an elemen o he es ing p ocess. We ha e used da a om i in se e al cases.
The pape concen a es on da a in eg i y alida ion and i s p ocess. The p ocess will be alida ed using da a
om a ious poin s du ing execu ion. Ano he esea ch ocus concen a es on enhancing he isibili y o sec o -
based h ea in o ma ion. Two main aspec s mus be conside ed:
• Da a in eg i y alida ion may be done wi h da a senso s a a ious poin s, whe e he alues o he da a
may be compa ed o ensu e hei co ec ness. The a ious da a senso s may also be used o ack
p ocess s eps h oughou he sys em. This way he p ocess in eg i y may be a a ge o alida ion
ins ead, o ensu e i has no been ampe ed wi h. Fo example, wi h a ious da a senso s, he sys em
wa den may see ha he command sequence is manipula ed hal way h ough he p ocess, leading o
a di e en ou come han ini ially eques ed. This may be included wi h addi ional sys em-speci ic
in o ma ion, such as so wa e e sions, ha dwa e equipmen , and ne wo k p o ocols.
• When a sys em ulne abili y o malicious a ack is de ec ed, he addi ional sys em in o ma ion aids in
h ea in el and secu i y b each epo ing o he ele an s akeholde s. These companies may wo k in
simila o adjacen sec o s, whe e iden ical ha dwa e o so wa e is used. In summa y, he p ocess
alida ion may be used o p o ide con ex o h ea in el. Addi ionally, he NIS2 (2022) di ec i e
manda es sec o -based h ea in el epo ing, whe e companies a e obliga ed o epo o he ele an
go e nmen body abou possible secu i y b eaches. Using a ious da a senso s o p ocess alida ion
imp o es he isibili y o he secu i y p ocesses, which in u n aids in p o iding in o ma ion o
go e nmen al bodies. This, in u n, p o es ha he company is upholding i s obliga ions.
4.1 Poin o P ocess Moni o ing
Moni o ing a p ocess and i s da a a ic in OT en i onmen s aids in c ea ing a holis ic si ua ional awa eness, in
addi ion o p ocess awa eness, which includes elemen s such as s eps aken, ans e ed da a, used de ices, and
so wa e e sions. I a cybe a ack uses speci ic p ocess as an a ack ec o , p ocess-based moni o ing aids in
o ensics due o documen ed and moni o ed con en . Addi ionally, moni o ing a singula p ocess h ough
a ious da a senso s aids in audi ing p ocess unc ion e en s. Fo example, i a cybe a ack manipula es da a a
a pa icula s ep o a p ocess, such as du ing a log eques o SCADA command, i may be analysed in o ensics
owa ds a speci ic sec ion in in e ne in as uc u e whe e he s ep would occu . This p o ides addi ional
in o ma ion, which may be used in u he o ensics, such as he de ices (e.g., swi ch and IED) used in his speci ic
s ep, hei so wa e e sions, and p o ocols used in communica ion. This addi ional in o ma ion needs o be
manually managed in cases whe e he moni o ing ocuses on speci ic da a alues wi hou including p ocess as a
491
P oceedings o he 23 d Eu opean Con e ence on Cybe Wa a e and Secu i y, ECCWS 2024
A u Takala e al
amewo k o con ex . Addi ionally, p ocess moni o ing enables analysis o causal ela ionship be ween s eps
and o he p ocesses. I a da a alue doesn’ change as expec ed a e a ce ain p ocess s ep is pe o med, i
could signal a po en ial comp omise.
4.2 Tes bed En i onmen
The es bed en i onmen de eloped by he Uni e si y o Jy äskylä is a unique pla o m o es ing di e en kinds
o ulne abili ies and h ea scena ios. Tes ing sepa a e so wa e, de ices, and ne wo k combina ions in many
ways is possible. Collabo a ion wi h business companies is essen ial and gene a es new da a o p o ec ing
c i ical in as uc u e.
We ha e es ed how o de ec and see h ea da a a di e en poin s. The used labo a o y en i onmen consis s
o a p ocess plan wi h i s OT de ices and he con ol and moni o ing ne wo k, as Figu e 1 illus a es. The plan
can be con olled wi h local and emo e SCADA sys em. Remo e con ol is implemen ed wi h an LTE connec ion.
A sepa a e moni o ing ne wo k is connec ed o he p ocess plan . Moni o ing is implemen ed by mi o ing he
ne wo k a ic om he cen al swi ch and OT de ice log in o ma ion om he cen al logging poin s o he
p ocess plan and he con ol cen e (O ice).
Figu e 1: Tes bed en i onmen
The Man-In-The-Middle (MITM, man = pe son, de ice) scena io is indica ed in ed, which is used o alida e he
p ocess-based da a in eg i y e i ica ion me hod. PITM da a comp omise is ca ied ou wi h an addi ional de ice
which is added o he connec ion be ween he p ocess plan and he o ice. Comp omised OT logs a e also
highligh ed in ed. The de ices u ilized in he scena io a e highligh ed in blue.
4.3 Use Case
4.3.1 En i onmen and Scena io
As Figu e 2 illus a es, he use case is depic ed wi h a eal-wo ld coun e pa . Sepa a e o ice space con ains
he plan 's con ol sys em, which is connec ed o he plan 's in e nal swi ch. The da a ans e be ween he
p oduc ion plan and he o ice space is emo ely moni o ed wi h a sepa a e SOC. Fu he mo e, one dis inc
isola ed ne wo k is employed o he su eillance o OT de ice logs, while a di e en ne wo k is used o di ec ly
eques OT de ice logs om he de ice i sel .
In his scena io, he a acke has access (physical o ne wo k) o he p ocess plan con ol ne wo k. The a acke
modi ies he da a ans e ed be ween he OT de ice and he cen al swi ch. By modi ying his da a, he a acke
can comp omise he si ua ional awa eness o he con ol sys em and SOC, e ade ins alled de ense mechanisms,
and disguise oo p in s le in he sys em. MITRE ATT&CK (2023) classi ies he a ack as a Man-In-The-Middle
(MITM, Pe son-In-The-Middle) echnique and a de ense e asion ac ic.
492
P oceedings o he 23 d Eu opean Con e ence on Cybe Wa a e and Secu i y, ECCWS 2024
A u Takala e al
Figu e 2: Desc ip ion o he use case
4.3.2 Pe o med Use Case
Du ing he execu ed log eques p ocess, moni o ing occu s ia da a links a he cen al logging de ice, swi ch,
and IED. The IED epo s wi hin he in e nal ne wo k h ough he swi ch o he logging de ice, while ex e nal
epo ing is done ia an isola ed cable. Speci ically, he p ocess in ol es a log eques om he cen al logging
de ice o he IED h ough he swi ch, suppo ed by an addi ional ex e nal eques om he SOC.
The MITM a ack unde mines he in eg i y o he esponse o he cen al logging by manipula ing he sen da a.
This leads o cen al logging and swi ch da a links o epo inco ec s a us. F om he SOCs pe spec i e, he e is
a disc epancy in he s a us logs e u ned in esponse o he e en log eques : he swi ch and cen al logging
indica e a ‘local con ol’ s a us, while he IED epo s a ‘ emo e con ol’ s a us. This de ia ion is an anomaly,
p omp ing u he in es iga ion o iden i y po en ial mal unc ions o Indica o s o Comp omise (IoCs). By
analyzing he causal ela ionships o p ocess s eps and examining his o ical logs, we can de e mine whe he his
IED should be in a ‘ emo e con ol’ o ‘local con ol’ s a e based on p e ious s a e-change commands. This
e i ica ion p ocess helps pinpoin he loca ion o po en ial IoCs wi hin he in e ne in as uc u e.
5. Findings
The upcoming NIS 2 di ec i e equi es c i ical in as uc u e ope a o s o moni o hei sys ems o cybe -
h ea s. Ope a o s mus be able o epo any po en ial h ea s and in e p e he epo s o o he ope a o s. To
make he mos e ec i e use o po en ial h ea epo s, hey mus also include in o ma ion on he cause-and-
e ec ela ionship o which he h ea is ela ed.
The capabili y o moni o , log, and epo one's own beha io is i al o he OT de ice. Addi ionally, cen alized
moni o ing is c ucial o ensu e he co ec unc ionali y o he en i e sys em. Howe e , in OT en i onmen s,
he e a e ha dwa e limi a ions o moni o ing he in eg i y o he command-and-con ol p ocess. Fo his eason,
i is possible o add a sepa a e moni o ing ne wo k o he old sys ems. The moni o ing ne wo k moni o s
possible IT h ea s o he OT ne wo k, as well as h ea s ela ed o he in eg i y o he OT p ocess. The h ea
in o ma ion abou OT sys ems mus especially be able o be sha ed wi h ope a o s in he same sec o .
A he hea o he moni o ing ne wo k is a SOC, whe e IT and OT da a om he ne wo k a e collec ed. The SOC
mus be able o handle adi ional IT- ela ed cybe h ea s and OT- ela ed h ea s. These also include h ea s
ela ed o he in eg i y o he OT p ocess. The e o e, when collec ing and sha ing h ea in o ma ion om OT
sys ems, i is essen ial o include in o ma ion abou he en i onmen in which he h ea was de ec ed, including
de ices and p o ocols. The in o ma ion mus be s uc u ed so ha an ope a o in he same sec o can use he
h ea in o ma ion in hei own sys em. Also, Po en ial con iden ial business sec e s mus be conside ed when
493
P oceedings o he 23 d Eu opean Con e ence on Cybe Wa a e and Secu i y, ECCWS 2024
A u Takala e al
h ea in o ma ion is sha ed. The speci ic in o ma ion o be sha ed mus be ag eed upon sepa a ely, as he
de ailed analysis o i could po en ially expose hese sec e s.
The cu en si ua ion in OT en i onmen s ocuses on moni o ing ope a ing en i onmen s' pe o mance and
s a us o ensu e sa e y and eliabili y. Howe e , con e gence o IT and OT has led o a si ua ion whe e
ans e ed da a and ope a ion unc ions may be maliciously manipula ed h ough he IT in e acing elemen s.
In OT one me hod o e i y such manipula ion is based upon checksums, bu i o igina es om inding co up ed
packe s, no in en ional manipula ion. The majo i y o OT moni o ing is he e o e ocused upon whe he he
machine o unc ion is mechanically b oken o ha someone has unin en ionally con igu ed he de ice w ong.
Acco ding o p ocess con ol, an isola ed ne wo k and ha dwa e a e good o moni o ing he p ocess in a way
ha many senso s a e used. I is impo an o di ide wha is moni o ed and in wha con ex ; in he case o he
man-in- he-middle a ack, he en i e log epo ing p ocess is needed. Many checkpoin s show whe e he p ocess
wen w ong. I is impo an o analyze wha his can mean o he en i e sys em's ope a ion. A cause-and-e ec
ela ionship can be ound in he p ocess da a. We moni o p ocesses; in p ac ice, we moni o he ope a ion o
he elec ici y dis ibu ion ne wo k wi h ce ain de ices. Sec o -speci ic in o ma ion is dis ibu ed upwa ds. The
pu pose is o sha e and ecei e da a abou po en ial h ea s iden i ied in one's own sec o .
6. Conclusion
The e is a need o enhance he ma u i y le el o moni o ing e en s in he ope a ional echnology en i onmen .
Resea ched e en s om he IT and OT en i onmen s a e c ucial when he pu pose is o p oduce cohe en
si ua ional awa eness o he indus y en i onmen s. Wi hou he abili y o see he equi ed hings om he
IT/OT en i onmen , unde s anding he business si ua ion may disappea .
The isibili y o cybe secu i y p ocesses is c i ical o ul illing he equi emen s o Eu opean Union egula ions.
Se e al OT- ela ed s anda ds and special publica ions a e impo an in s ee ing he supply chain. Valida ion is a
se o ac ions ega ding he sys em equi emen , and i is impo an o ensu e hey a e ul illed.
NIS2 (Eu opean Pa liamen , 2022) equi es collabo a ion be ween he indus y sec o s and wi hin i . The
in o ma ion mus low, so he connec ion be ween he s a egic, ope a ional, and echnical le els is a c ucial
ac o ha enhances he o e all si ua ional awa eness wi hin sec o -based indus ies and a he en e p ise le el.
As ENISA (2023) s a es and NIS2 sugges , he e mus be unde s andable mechanisms whe e ope a ional
echnology- ela ed e en s a e ansmi ed and ans o med in o a o m ha gene a es added alue o he
decision-make s. I is no enough o achie e a epo ha indica es e en s. The e should be in o ma ion abou
he ype o ulne abili ies and a desc ip ion o he whole p ocess, including he sou ce o he h ea and po en ial
consequences. Because many a emp s o he ad e sa ies’ a acks a e being ied again, ja, unin en ional e en s
o inciden s a e o en epea ed. Decision-make s should be able o make decisions ega ding business con inui y
and in o ma ion-sha ing capabili ies depending on he secu i y ope a ion cen e 's ma u i y o de ec ope a ional
echnology- ela ed h ea s deep enough. Tha is impossible wi hou ga he ing and combining di e en kinds o
da a om he physical and ne wo ked senso s. So, he amewo k o he p ocess con ol mechanism ha ga he s
da a and sha es da a om he Ope a ional Technology en i onmen o he SOC is c ucial o enhance ope a ional
echnology cybe secu i y a he g ound le el. The de eloped axonomy has i s own ole in o ming si ua ional
awa eness (NIS Coope a ion G oup, 2018), bu i mus be kep up o da e mo e e icien ly because o he
de elopmen o po en ial inciden s.
The CSG p ojec concen a es on de eloping he go e nance model o he OT en i onmen s. All esea ch da a
om he es bed en i onmen suppo he de elopmen p ocess o he go e nance model.
Acknowledgmen s
The esea ch was suppo ed by Business Finland (g an numbe 10/31/2022) and he Uni e si y o Jy äskylä.
Re e ences
CISA (2020) C i ical In as uc u e Sec o s. h ps://www.cisa.go / opics/c i ical-in as uc u e-secu i y-and-
esilience/c i ical-in as uc u e-sec o s
Denzle P., Holle e S., F ühwi h T., and Kas ne W. (2021) Iden i ica ion o secu i y h ea s, sa e y haza ds, and
in e dependencies in indus ial edge compu ing. In The Six h
ACM/IEEE Symposium on Edge Compu ing (SEC' 21), Decembe 14–17, 2021, San Jose, CA, USA. ACM, New Yo k, NY, USA.
494
P oceedings o he 23 d Eu opean Con e ence on Cybe Wa a e and Secu i y, ECCWS 2024