Strategic network security for critical infrastructures

The safety and integrity of critical infrastructures are of utmost importance to a nation's economy and security. In order to guarantee operational availability and service metrics, these infrastructures rely on automation provided by an underlying network of computers. In recent years, these automation systems have been used by attackers to gain access to and disrupt the physical processes being controlled. This dissertation aims to provide quantifiable methods to assess the risk added to the system by this extended attack surface and to design automated mechanisms for mitigating the system risk by selecting and deploying the right countermeasures. Any countermeasure strategy must account for the operational constraints that the system has in place for service guarantees and must make trade-offs between system availability and cybersecurity. The risk mitigation work presented in this dissertation generates countermeasure strategies that account for the strict communication deadlines between networked controllers, the regulatory requirements demanded by national regulators, and the security budgets of the infrastructure operators. Regarding risk assessment, we propose quantifiable metrics that can be used with operator expertise. We describe metrics that can be computed with or without knowledge about the attacker. We also provide a tool for measuring the monetary impact of a successful attack campaign. Regarding risk mitigation, we describe algorithms to select and deploy countermeasures. Since firewalls are used as a primary network security mechanism, we provide a detailed analysis of mitigating the risk allowed by the network access policy. We also show how we can rank countermeasure strategies that prioritize security against certain adversary groups under assumptions about attacker capabilities. Finally, we also design a new countermeasure that tackles one of the most commonly used attacker tactics.

Name thesis:degree_name

Ph.D.

Level thesis:degree_level

Dissertation

Discipline thesis:degree_discipline

Electrical & Computer Engr

Grantor

University of Illinois at Urbana-Champaign

Year dc:date

2023

Author dc:creator

• Palani, Kartik

Contributors dc:contributor

• Nicol, David M
• Smith, Sean W
• Borisov, Nikita
• Srikant, Rayadurgam

• Optimization
• Cybersecurity, Cyber-physical Systems
• Algorithms
• Computer Networks

Statement dc:rights

• Copyright 2023 Kartik Palani

Language dc:language

en, eng

Handle dc:identifier

https://hdl.handle.net/2142/121396

OAI record oai:identifier

https://www.ideals.illinois.edu/oai-pmh?verb=GetRecord&metadataPrefix=etdms&identifier=oai%3Awww.ideals.illinois.edu%3A2142%2F121396