We have two papers on security metrics at S4. The first is from Ralph Langner, who wrote the great paper on OPC server resource exhaustion attacks at S4 2007, and Bryan Singer who you all know. They both came in independently with similar abstracts, so it only made sense for them to pair up on this interesting paper.

The classic risk = threat * vulnerability * consequence (impact or damage) equation has not worked in the control system world because we have no hard, statistics on threat. This is unlikely to change in the near future, but we are also interested in projects trying to quantify this threat.

Describing risk in a meaningful way to decision makers is essential, and Ralph and Bryan are taking a different approach - - Scenario-Based Risk Modeling. The paper goes through the methodology of the approach and then models five important and different scenarios. I don’t want to steal their thunder so I’ll leave out the scenario details.

I am fascinated by the Scenario-Based Threat Modeling portion of the paper. This portion of their Risk Model builds on the Scenario-Based Threat Modeling in Snyder and Swiderski’s Threat Modeling book which focuses on the attackers goals.

There is a similar thread of discussion on attacker goals going through the IT security world. Emphasis is shifting to recognize that the criminals and talented attackers are not randomly attacking vulnerable systems. Instead, they are compromising data that can be sold or used. Such as financial system credentials and personal privacy information. Protecting this information of financial value, and identifying and fixing vulnerabilities, found in databases, cached credential stores, and other areas is a priority because this is the attackers goal. Thought leaders are using the attacker goals to prioritize their security resources more wisely.

Langner and Singer discuss the different attacker goals in a control system. It is not typically protecting information, with some exceptions such as recipes. Control system attacker goals are more likely to involve altering the underlying process for a variety of reasons detailed in the paper. What would an attacker do after a compromise?

Each goal is then built into one or more scenarios which includes vulnerabilities, controls and damages.

This brief entry does not do the topic justice. This paper will probably add some clarity to ideas that have been in the back of your head for a while now.