A set of analysis capabilities to retrieve insights from persisted data. Two kinds of actors interact with these capabilities: Operators and Security Analysts. Operators receive continuous information from the processes performing rule assessment, evaluating the critically of events and preparing a set of responsive actions to minimize their impact. Security Analysts are responsible for extracting insights from the interpretation of stored events, performing ad hoc queries to understand related thread event paths and preparing improvement measures.
Published in Chapter:
Evolving the Security Paradigm for Industrial IoT Environments
Luis Rosa (Department of Informatics Engineering, University of Coimbra, Portugal), Miguel Borges de Freitas (Department of Informatics Engineering, University of Coimbra, Portugal), João Henriques (Department of Informatics Engineering, University of Coimbra, Portugal), Pedro Quitério (Department of Informatics Engineering, University of Coimbra, Portugal), Filipe Caldeira (University of Coimbra and Polytechnic Institute of Viseu, Portugal), Tiago Cruz (Department of Informatics Engineering, University of Coimbra, Portugal), and Paulo Simões (Department of Informatics Engineering, University of Coimbra, Portugal)
Copyright: © 2020
|Pages: 22
DOI: 10.4018/978-1-7998-2910-2.ch004
Abstract
In recent years, IACS (Industrial Automation and Control Systems) have become more complex, due to the increasing number of interconnected devices. This IoT (internet of things)-centric IACS paradigm, which is at the core of the Industry 4.0 concept, expands the infrastructure boundaries beyond the aggregated-plant, mono-operator vision, being dispersed over a large geographic area. From a cybersecurity-centric perspective, the distributed nature of modern IACS makes it difficult not only to understand the nature of incidents but also to assess their progression and threat profile. Defending against those threats is becoming increasingly difficult, requiring orchestrated and collaborative distributed detection, evaluation, and reaction capabilities beyond the scope of a single entity. This chapter presents the Intrusion and Anomaly Detection System platform architecture that was designed and developed within the scope of the ATENA H2020 project, to address the specific needs of distributed IACS while providing (near) real-time cybersecurity awareness.