Security Implications for Wireless Components in ICS
Publish date: 2019-05-08
Report number: FOI-R--4757--SE
Pages: 49
Written in: Swedish
Keywords:
- Directly network connected systems
- Resource-limited units
- Lightweight cryptography
Abstract
The amount of microcontrollers in industrial control systems that are directly connected to public networks has risen dramatically in the last three years. This increase is expected to continue, nearly doubling the amount of units from year 2018 to 2020 to 7.5 billion. Two characteristic properties for such units are their focus on safety rather than security and also their low resources regarding computing power, RAM and battery life. Cryptographic algorithms are an important part of secure communications because they are used for both encryption and authentication, but they can seldom be applied on units with limited processing power. Networking capability in such units therefore can cause security related consequences, because there is not enough inherent resources for the unit to handle such complicated tasks. There are also more general aspects of IT security risks related to directly network connected units of limited resources that should be discussed. There is a trend towards integrating different communication protocols into a single component, which for instance allow wireless communication capability. These components therefore become potential attack vectors, especially if the system owner is not aware of the extra functionality and thus cannot act to mitigate it. This report describes security aspects that should be taken into account when discussing directly wireless network connected systems containing units with limited resources. The report presents a number of recommendations based on security aspects, threats and risks related to these types of systems. The study utilized a literature review as the primary method for data collection pertaining to established standards, relevant communication technologies, and means of attack as well as threats, risks and the defence against these. The collected information constitutes the foundation for recommendations and conclusions made in the study. The report also contains a glossary of IT security concepts relevant to directly wireless network connected systems and resource-limited components.