| Industrial control systems are integrated communication networks implemented to fulfill the needs of an automation system. Many industrial and automation control end devices, such as programmable logic controllers, were developed without cyber security software or hardware assurance. Consequently, when the industrial control systems merged with corporate enterprise networks industrial control systems were subject to an increase in cyber risks resulting in the exposure of critical infrastructures and industrial automation systems to security breaches. Industrial and automation hosts and field devices were originally designed for the reliable and safe operation of industrial processes; therefore, security was not built into their design. The fragility of hosts and field devices does not lend itself to system maintenance like software upgrades, firmware updates, or antivirus deployment. With limited end device security protection, control engineers layer network perimeter defenses according to Industrial Control Systems (ICS) industry best practices, standards, and recommendations. The purpose of this study was to evaluate the security effectiveness of layering perimeter defenses by analyzing the attack behavior of a mock adversarial group as perimeter defenses were applied to an ICS test network. Using a single-subject A-B-BC-BCD design, this study compared a mock adversarial group's programmable logic controller attack time in an ICS test bed with no perimeter defenses (no treatment) to the same mock adversarial group's programmable logic controller attack time under three varied perimeter defenses. The single subject data analysis based upon visual inspection examining for three parameters, level, trend, and variability. Visual analysis was supported with paired sample t test and standard deviation band statistical analysis. The results of the data analysis was inconclusive due to limited data set, therefore further research with larger sample size is necessary to establish effect of perimeter defenses on adversarial behavior. However, this study revealed by reducing attack vectors and adversaries' network access time lateral movement within a network is negatively impacted as demonstrated by the adversaries' inability to circumvent Treatment B and withdraw. |
