HoneyShield Industrial

Project description

The main question of our project is: What are the benefits of using a seriousness score regarding the implementation of a honeypot within an industrial environment?

Context

Our digital society, including its digital industry, is becoming increasingly dependent on information and communication technologies and this is amplified by the introduction and uncontrolled proliferation of Internet-of-Things technologies that do not only make our lives easier, but also introduce massive new cyber security threats.

Prior research done by Fontys students was focused on security in the energy sector. Some first experiments have been done and they have selected a candidate ICS/OT honeypot.

Through further research and development, we want to contribute to the INTERSCT research towards an internet of secure things.
The stakeholder wants to have a clear understanding and overview of what attacks are incoming. Most importantly, the stakeholder needs to know what attacks and attackers are a serious threat.

The goal of the project is to implement, and evaluate the benefits of, a seriousness score in a honeypot of an industrial environment.

The project aims to investigate and analyse the effectiveness of using a seriousness score in identifying potential security threats in an industrial environment. As a key part of this investigation, the project will define what a seriousness score is in this context, as the term does not currently exist.

The ultimate objective of the project is to provide insights and recommendations for organizations seeking to improve their security posture in industrial settings through the use of honeypots and seriousness scores.

Results

We have successfully achieved the main objective of our project, which is the establishment of a seriousness score for evaluating attacks on ICS/SCADA. This score provides valuable insights into the severity of an attacker's actions, derived from the data collected by the honeypot.

Currently, we have developed a functional prototype of the system. However, further testing in a relevant environment is necessary to validate the project's effectiveness. At this stage, the Technology Readiness Level (TRL) stands at 3, indicating that the concept has been demonstrated in a laboratory setting but requires additional real-world testing and refinement.

About the project group

We are a project group with different expertise, either Software, Media or Infrastructure and from the Semesters 6 and 7. This semester we are all in the Advanced Cyber Security semester.

During this semester we have worked on the project for two days a week. To work on the project at a professional level we have used Scrum as project management framework