# Evaluating Cascading Impact of Attacks on Resilience of Industrial Control Systems: A Design-Centric Modeling Approach

## TL;DR

This paper introduces a design-centric modeling approach to evaluate how data-oriented attacks can cascade through industrial control systems, using a water treatment testbed to identify vulnerabilities and suggest resilience improvements.

## Contribution

The paper presents a novel modeling method that incorporates control dependencies and operational design specifications to assess attack impact in ICS.

## Key findings

- Identified key vulnerabilities in the water treatment testbed.
- Proposed metrics effectively measure attack impact and system resilience.
- Recommended design improvements enhance system robustness against attacks.

## Abstract

A design-centric modeling approach was proposed to model the behaviour of the physical processes controlled by Industrial Control Systems (ICS) and study the cascading impact of data-oriented attacks. A threat model was used as input to guide the construction of the CPS model where control components which are within the adversary's intent and capabilities are extracted. The relevant control components are subsequently modeled together with their control dependencies and operational design specifications. The approach was demonstrated and validated on a water treatment testbed. Attacks were simulated on the testbed model where its resilience to attacks was evaluated using proposed metrics such as Impact Ratio and Time-to-Critical-State. From the analysis of the attacks, design strengths and weaknesses were identified and design improvements were recommended to increase the testbed's resilience to attacks.