Cybersecurity Index to Evaluate the Implementation of the Bi-Level Architecture for Efficient Manufacturing (BLAEM)

Industrial companies have had to adapt to changing situations due to fierce competition driven by increasing customer demands. To efficiently control the development of products, processes, and production systems, companies have had to integrate technologies and data from other areas with the process of manufacturing [1]. This change is known by various names, including Smart Manufacturing [2] and Computer-Integrated Manufacturing [3, 4].

The key drivers of this trend are the automation of industrial processes and the facilitation of data exchange, which can be achieved by integrating every system within the manufacturing process into the same architecture. The aim is to create a fully connected plant where all the retrieved information is reusable to optimize the various business processes and thereby create a smart factory.

To attain this, the connection between different levels of the factory must be ensured, ranging from the shop floor where production machines are located to the most advanced level of the plant where the company's strategies are defined. However, the aggregation and contextualization of data from heterogeneous systems throughout the production life cycle pose a significant challenge. This affiliation is challenged by the normal trouble of agglomerating and contextualizing data from heterogeneous frameworks over the generation life cycle [5].

In this way, we came up with a reference design competent of interfacing the generation and data frameworks of the company. This architecture is based on six major aspects: Data integration, Systems integration, Security, Monitoring & Data analysis, Mobility and finally Cloud computing.

In this paper, we will handle the security aspect for its major role of ensuring a stable and successful implementation of BLAEM. To help companies evaluate their implementation using quantitative indicator, we will elaborate a security index based on cybersecurity directives collected from some of the relevant standards.

The digital transformation has made a real impact on the industrial companies, by improving their efficiency by 15 to 20 percent [17], not to mention the benefits that result from analyzing all the collected data from the CIM context. This transformation can never be successful without relying on stable environments and secured systems, which makes the Security aspect one of the most relevant challenges to be dealt with.

The Cisco 2018 Annual Cybersecurity Reports [18] showed that 31% of organizations have experienced cyber-attacks on Operational Technology (OT). A survey conducted by the Small Business Administration (SBA) showed that 88% of small business owners felt their business was vulnerable to a cyber-attack. while 64% of leaders of organizations declared that cybersecurity and technology related risks are currently managed in an "inadequate" or "to be improved" way.

Despite these statistics, only 16% of organizations are ready to face cybersecurity challenges, as per other surveys. This is due to the lack of accurate reference standards and the lack of managerial and technical skills to understand and implement them [19].

In this section we demonstrate the importance of the Security aspect, and why it has to be taken seriously. For that, we will go over the most important vulnerabilities that can be related to our architecture assets, the common threats in the industrial domain, and the business impacts they can leave on the company. And to countermeasure that, we will present some security standards that can provide us with the best guidelines to be applied for maximum security.

3.1 Vulnerabilities

Vulnerabilities are defined as weaknesses within the IT system that might be exploited by intruders to compromise the cyber-physical system [20]. In a more common point of view, NIST glossary of key information security terms [21] allude to vulnerability as weakness in an information system, system security procedures, internal controls, or implementation that could be exploited by a threat source. According to the Kaspersky report in 2015, the number of vulnerabilities rose from 2 to 189 between the years 1997 and 2015. [22] Based on 4 reports established by the Kaspersky Lab [23], the U.S Department of Homeland security [24], Norton LifeLock formerly    known as Symantec [25, 26], and Positive technologies [27], we came up with a list of the most common vulnerabilities in the industrial environment:

• Misconfigurations: These vulnerabilities occurs when devices and systems that will be used in the

company are configured inappropriately, by preserving default settings for example or not controlling what to be installed on the devices.

• Flaws in network: It can be caused by physical- Based assets such as Hardware Issues and physical

security or Software-Based assets such as Outdated or Unmanaged Software.

• Buffer overflow: It is a programming error, where software overwrites adjacent memory locations while writing data to a buffer. Writing outside the bounds of a block of allocated memory can corrupt data, crash the program, or cause the execution of malicious code.
• Hardcoded or weak credentials: Such as passwords typically create a significant hole that allows hackers to easily bypass the authentication that has been configured by the administrator.
• Cross-Site Scripting (XSS): Enables attackers to inject client-side scripts into web pages, which can be used to steal user authentication data or spread malware through the systems.
• The Cross-Site Request Forgery (CSRF): Occurs when a server is designed to receive a request from a client without any mechanism for verifying that it was sent intentionally.
• Cleartext transmission and storage of data: These vulnerabilities allow an unauthorized actor to get sensitive data in a communication channel or from a storage point in Plain-Text format, this data can include even passwords stored in a Recoverable Format.
• Zero-day: One of the most common vulnerabilities in cybersecurity (also known as 0- day) which is technically a hole in a software that is unknown to the vendor or that is known but there is still no patch to correct it. This security hole is then exploited by hackers before the vendor becomes aware and hurries to fix it.

We will utilize the Common Vulnerability Scoring System (CVSS) as a standardized method to assess the severity of the vulnerabilities mentioned earlier. This system provides a quantitative indicator to allocate severity scores for cybersecurity threats, enabling users to prioritize responses and allocate resources accordingly. The latest version, CVSS v3.1, which was released in 2019 [28], will be used. The scoring is based on a formula that considers various metrics to estimate the ease and impact of an exploit. The scores range from 0 to 10, with 10 being the most severe. Those are the metrics that are used:

• Attack Vector (AV): This metric measures the possible context for exploiting a vulnerability. If the attacker can exploit the vulnerability from a remote location, then the metric value will be higher. The values that are provided by the calculator are ranked as follows: Network, Adjacent Network, Local, and Physical.
• Attack Complexity (AC): This metric evaluates the conditions that an attacker must meet beyond their control to exploit the vulnerability. In other words, it estimates the difficulty of carrying out an attack on the vulnerability. A high value of this metric indicates that it is difficult for an attacker to exploit the vulnerability, while a low value means that it is easy to exploit.
• Privileges Required (PR): This metric evaluates the level of authorization that an attacker must have to exploit the vulnerability. The higher the privileges required, the more difficult it is for an attacker to exploit the vulnerability. Conversely, a low value of this metric indicates that an attacker can exploit the vulnerability with minimal privileges or without any privileges at all.
• User Interaction (UI): This metric evaluates the level of user interaction needed for the vulnerability to be exploited.
• Scope (S): This metric evaluates the ability of a vulnerability to spread from one component to affect other components within the system.
• Confidentiality Impact (C): This metric assesses the impact of a vulnerability exploitation on the confidentiality of the system's information.
• Integrity Impact (I): This metric measures the impact of a successfully exploited vulnerability on the integrity of the system.
• Availability Impact (A): This metric measures the impact of a successfully exploited vulnerability on the availability of the affected component.

We applied the scoring system for the already listed vulnerabilities, and we recorded the results in Table 1.

3.2 Cyber-security threats

The NIST glossary characterizes threat as “any circumstance or occasion with the potential to antagonistically affect organizational operations (counting mission, capacities, picture, or notoriety), organizational resources, people, other organizations, or the Country through a data framework by means of unauthorized get to, annihilation, divulgence, adjustment of data, and/or dissent of service”.

A systematic literature review that has been conducted on this topic by Lezzi et al. [20]. This research analyzed 40 scientific papers in order to identify the major security threats that has been treated in the literature. The top 8 threats can be listed as follows:

• Denial of Service (DoS) attack: A DOS attack is an attempt by an attacker to prevent users from accessing the information system resources, it can be done through flooding the network in order to reduce the user’s bandwidth and prevent access to a service [29].
• Phishing attack: It is a method of tricking users into unknowingly providing personal and financial information or sending funds to attackers [30].
• Malware and worms’ infections: Malware is brief for Malicious software. It could be a program code that's threatening and regularly utilized to degenerate or abuse a framework. Presenting malware into a computer arrange environment has distinctive impacts depending on the plan aim of the malware and the arrange format [31]. Worms are self-replicating computer Malwares, their ability to rapidly spread across the network makes them a real threat, since before the user knows what has happened, much damage is already done [32].
• Virus infection: Stands for “Vital Information Resource under Siege”. A computer virus is a computer program/software that is loaded into the system without your authorization and run-in opposite to your permissions [33].
• Escalation of privilege: It can be defined as an attack that incorporates picking up illegal get to of hoisted rights, or benefits, past what is anticipated or entitled for a client. This assault can incorporate a performing artist or an insider. Benefit heightening customarily incorporates the misuse of a benefit heightening defenselessness, such as a framework bug, misconfiguration, or insufficient get to control [34].

Table 1. Vulnerabilities with their associated CVSS score

Table 2. Threats with their associated CVSS score

• Eavesdropping: It is when a hacker intercepts, deletes, or modifies data that is transmitted between two devices. Eavesdropping, also known as sniffing or snooping, relies on network in which traffic is not secured or encrypted.
• Advanced Persistent Threat (APT): It comprises of a complex sort of assaults that takes information by remaining within the contaminated framework for a long time. When Able assaults take place in a complex foundation such as the cloud, their discovery is truly troublesome [35].

• Data tampering or Spoofing: Which means technically electronic identity theft, where the attacker secretly relays and possibly alters the communications between two parties who believe that they are directly communicating with each other.

Indenting to evaluate the threats above, we will be using the CVSS calculator to assign severity scores to the threats, we used the same metrics as in section 3.1, and we recorded the results in Table 2.

3.3 Business impacts

In cybersecurity, Impact refers to the potential for loss, harm or pulverization of resources or information in a company. It can be caused by a vulnerability being exploited or an attack that occurs. There are many types of impacts, such as:

• Disrupt to the complete basic framework or focused on components: For example, misfortune of discernibleness, controllability or eventually the misfortune of control within the physical framework. Theft of industrial trade secrets and intellectual property.
• Denial of service of networks and computers.
• Life-threatening situations for the workers.

Those impacts are related directly to one of those three aspects: Confidentiality, Integrity, and Availability. These are the three center components of the CIA set of three, a data security demonstrate implied to direct an organization’s security methods and arrangements.

3.4 Security standards

Cyber security standards are methods laid out in published documents that endeavor to ensure the cyber environment of a client or an organization. This environment includes users, systems, networks, tools, applications, and data that can be connected directly or indirectly to networks [36]. The main purpose is to diminish the risks that can be endured from cyberattacks. These documents comprise of tools, policies, concepts, guidelines, training, best practices and technologies.

Some of the most relevant standards are described below. These are security standards that can be adopted in the industrial context and can be applicable to various assets:

• ISA/IEC 62443: The International Society of Automation (ISA) developed a series of standards in 2007, which were approved by the International Electrotechnical Commission (IEC) in 2021 [37]. This series, known as ISA/IEC 62443, aims to address cybersecurity concerns for operational technology in automation and control systems. The primary goal of this standard is to enhance the safety, availability, and confidentiality of Industrial Automation and Control Systems (IACS) components and provide criteria for the procurement and implementation of secure IACS [38]. ISA/IEC 62443 is divided into various sections and covers technical as well as process-related aspects of cybersecurity for automation and control systems.
• API 1164: It is a standard proposed by the American Petroleum institute (API) in 2007 and revised in 2021. It offers guidelines and best practices to operators from Oil and Gas industries to improve the cybersecurity of the Supervisory Control and Data Acquisition (SCADA) systems. It also offers a detailed analysis of vulnerabilities for a SCADA system, that can be exploited by external users and cause threats to the whole company.
• NIST 800-82: The National Institute of Standards and Technology (NIST) developed a set of documents in 2015 known as the NIST Special Publication 800-82. These documents describe the computer security policies, procedures, and guidelines for the United States federal government [39]. One of the documents provides guidance on how to secure Industrial Control Systems (ICS), which includes Supervisory Control and Data Acquisition (SCADA) systems, Distributed Control Systems (DCS), and other control systems such as Programmable Logic Controllers (PLC).
• UL 2900: It is a series of standards published by Underwriters     Laboratories (UL) in 2016, a safety consulting and certification company and also one of several companies approved to perform safety testing by the U.S. federal agency, Occupational Safety and Health Administration (OSHA). UL 2900 presents foundational security requirements software cyber- security requirements   for network-connectable products and industrial control systems [40].
• ISO/IEC 27000-series: Also known as the ISO27K. It is a series of cybersecurity standards published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). This series gives best practices suggestions on information security management and the administration of data risks within the context of an overall Information security management system (ISMS). The ISO/IEC 27000- Series is purposely wide in scope, covering more than privacy, confidentiality and IT technical cybersecurity issues. It is pertinent to organizations of all shapes and sizes [41].

5.1 Elaborating the index

To appraise the safety of BLAEM, we emphasized on the security aspect. Thus, based on a list of standards, we shaped up a set of guidelines that we will follow in our design and implementation.

To evaluate the implementation of BLAEM from a safety point of view, we propose an index that will enable the company to assess its implementation using a quantitative indicator. The index will allow us to evaluates the implementation of BLAEM using quantitative indicator, it will be calculated based on the implemented directives listed above, the more the guidelines are being respected and applied, the more the index will be high which means that the implementation is well secured. This index will be based on the 14 directives listed above and will be defined in three steps.

1) A score will be associated to each guideline, based on the threats it can protect from and the vulnerabilities it helps fix and it shall be calculated using the following formula:

$S g=0.1 * \sum_{i=1}^n S t_i+0.1 * \sum_{j=1}^m S v_j$

$\{1 \leq i \leq n$ and $1 \leq j \leq m$ and $i, j \in \aleph\}$

where,

• Sg: The score associated to the specific guideline.
• St: The score associated to the threats.
• Sv: The score associated to the vulnerabilities.
• n: The number of threats covered by the guideline.
• m: The number of vulnerabilities that can be fixed by the guideline.

2) The calculation is done using data from Table 1 for the vulnerabilities scores and Table 2 for the threats scores. The result can be found in table

The architecture security index is calculated based on the scores associated to the guidelines that has been applied.

$\begin{gathered}I_S=\sum_{i=0}^P S g_i \\ \{1 \leq i \leq p \leq 14 \text { and } i \in \aleph\}\end{gathered}$

where, p is the number of applied guidelines. Its value is 0 if no security guidelines are applied in the architecture and 14 if all the guidelines are applied.

The index value range is 0 to 60, with 60 being the sum of the scores for all the 14 guidelines.

3) A gauge shall be defined with a scale from 0 to 60. To evaluate the security index, we will define 3zones in the gauge based on 2 thresholds:

• From 0 to 36: We can evaluate the implementation as inadequate and unsecured.
• From 36 to 51: The implementation has been done properly and the security Index is acceptable.
• From 51 to 60: The implementation has been done as recommended and the security level is high.

As shown in Figure 2, we dedicated 60% of the gauge to unsecured Zone, in order to push companies to apply the maximum number of guidelines all scores combined. This choice is also motivated by the fact that reaching an acceptable level of security is not a light task.

The same thing goes for the second zone that covers 25% of the gauge, which would push companies into implementing more guidelines in order to achieve a high security level.

2.png

Figure 2. Security index gauge

5.2 Case study

To give a concrete example of the usage of the Index, we are going to simulate a case study from the automotive industry. This one consists of a firm that possesses two factories, the first one located in Nantes, and the second one in Houara.

For the first factory, we can count four production work centers, with a PLC for each, three printers and five workstations. For the second factory, we define five work centers, besides the PLC that all the machines got, the work centers are equipped with sensors for efficient data collect, those machines are controlled by an MES installed on ten work station in the local level is insured by using separated systems and networks for the two plants, besides controlling the traffic in the network. The Servers and the work centers are highly secured using identity management, a strong account management policy and an up-to-date policy. A technical audit is planned regularly to ensure that everything is in order.

The data is Secured using encryption algorithms, and a decentralization policy, Backup servers are in place to ensure the availability of the data in the assets.

In this implementation, we applied the following security guidelines: Control access points, Network segregation, Account management, Backup and restoration, Up-to-date management, Encryption, Technical Audit, Data decentralization, Traffic control and analysis,

From Table 3, we can retrieve the Guideline Score (Sg) associated to each guideline.

• Control access points: 2.5
• Network segregation: 3.3
• Account management: 2.9
• Backup and restoration: 3.2
• Up-to-date management: 6.8
• Encryption: 3.9
• Technical Audit: 9.7
• Data decentralization: 3.1
• Traffic control and analysis: 4.2

The security index for this implementation shall be counted as follow: Is = 2.5 + 3.3 + 2.9 + 3.2 + 6.8 + 3.9 + 9.7 + 3.1 + 4.2 = 39.6, the index is located in the range between 36 to 51. Se we can conclude that the implementation has been done properly and the security Index is acceptable.

Table 3. Guidelines score calculation