Challenges in Secure Engineering of Critical Infrastructure Systems

Modern critical infrastructure (CI), such as water supply, smart power grids, and transportation networks, face major security challenges that arise due to complex interactions between software and physical components as well as human operators. Such systems are an attractive target for attackers who intend to disrupt the safe, normal operation of CI by exploiting vulnerabilities in software components such as the supervisory control and data acquisition (SCADA) workstations and programmable logic controllers (PLCs). In this reference paper, we elaborate on problems and challenges learned from our own experience in automating security analysis, assessment, and defense mechanisms for CI. These challenges are presented in the context of two real-world CI systems-namely, a water treatment plant and a water distribution system.