One million liters of sewage rushes into an Australian river and coastal waters. Eighty-thousand people lose power in the Ukraine. An oil pipeline explodes in Turkey and sixty hours of pipeline surveillance footage is erased.
In each of these real-world incidents, investigations turned up evidence of what went wrong—and what went wrong was cyber security.
Wastewater treatment plants, power plants and gas and oil pipelines can be easy targets for cyber attackers who seek to wreak havoc with just a few key strokes.
Now, the University of New Orleans is training computer science students how to easily diagnose weaknesses in security systems that are designed to protect such automated processes.
Using a $96,000 grant from the U.S. Army Research Office, computer science professor Irfan Ahmed has installed a model test bed of control systems—often called Supervisory Control and Data Acquisition Systems—designed to supervise industrial processes at work.
Tiny electrical towers, replica water treatment containers and small gas pipelines sit atop wheeled tables. Each utility system is connected to dedicated computer controls that students can use to study, experiment and acquire data.
“The goal here is to use these for research and testing,” said Ahmed, whose research interests include malware, digital forensics and industrial control system security. “These systems are vulnerable to cyber attacks. The idea is to look into why these systems are vulnerable and to make them more secure.”
The test beds rely on instruments from Allen-Bradley, Siemens, and Schneider Electric—manufacturers that supply real-world control systems for utilities world-wide.
Ahmed said graduate students in his classes examine case studies of real-world cyber-security breaches. The test bed enhances that study, giving them avenues needed to conduct forensic investigations based on those case studies. Students then can work on designing ironclad solutions that could ward off worst-case scenarios.
Doctoral student Sneha Sudhakaram has begun using the test bed in her study this summer. She is trying to develop tools and techniques to facilitate digital forensic investigations in industrial control systems. Such forensics can be tough because these systems may use proprietary and legacy hardware and operating systems, Ahmed said.
“Once something happens, how can we acquire the data?” he said. With the addition of the test bed to the Department of Computer Science, students like Sudhakaram are closer to finding out.