Home > Research > Publications & Outputs > Snakes and Ladder Logic

Research

Links

Text available via DOI:

View graph of relations

Snakes and Ladder Logic: PLC-VBS, a PLC Control Logic Vulnerability Discovery Tool

Research output: Contribution to Journal/Magazine › Journal article › peer-review

Published

Standard

Snakes and Ladder Logic: PLC-VBS, a PLC Control Logic Vulnerability Discovery Tool. / Maesschalck, Sam; Staves, Alexander; Derbyshire, Richard et al.
In: arXiv, 30.01.2023.

Research output: Contribution to Journal/Magazine › Journal article › peer-review

Harvard

Maesschalck, S, Staves, A, Derbyshire, R, Green, B & Hutchison, D 2023, 'Snakes and Ladder Logic: PLC-VBS, a PLC Control Logic Vulnerability Discovery Tool', arXiv. https://doi.org/10.48550/arXiv.2206.06669

APA

Maesschalck, S., Staves, A., Derbyshire, R., Green, B., & Hutchison, D. (2023). Snakes and Ladder Logic: PLC-VBS, a PLC Control Logic Vulnerability Discovery Tool. arXiv. https://doi.org/10.48550/arXiv.2206.06669

Vancouver

Maesschalck S, Staves A, Derbyshire R, Green B, Hutchison D. Snakes and Ladder Logic: PLC-VBS, a PLC Control Logic Vulnerability Discovery Tool. arXiv. 2023 Jan 30. doi: 10.48550/arXiv.2206.06669

Author

Maesschalck, Sam ; Staves, Alexander ; Derbyshire, Richard et al. / Snakes and Ladder Logic : PLC-VBS, a PLC Control Logic Vulnerability Discovery Tool. In: arXiv. 2023.

Bibtex

@article{f524a909370047e595d6fc0e4960d8de,
title = "Snakes and Ladder Logic: PLC-VBS, a PLC Control Logic Vulnerability Discovery Tool",
abstract = "Cyber security risk assessments provide a pivotal starting point towards the understanding of existing risk exposure, through which suitable mitigation strategies can be formed. Where risk is viewed as a product of threat, vulnerability, and impact, understanding each element is of equal importance. This can be a challenge in Industrial Control System (ICS) environments, where adopted technologies are typically not only bespoke, but interact directly with the physical world. To date, existing vulnerability identification has focused on traditional vulnerability categories. While this provides risk assessors with a baseline understanding, and the ability to hypothesize on potential resulting impacts, it is high level, operating at a level of abstraction that would be viewed as incomplete within a traditional information system context. The work presented in this paper takes the understanding of ICS device vulnerabilities one step further. It offers a tool, PLC-VBS, that helps identify Programmable Logic Controller (PLC) vulnerabilities, specifically within logic used to monitor, control, and automate operational processes. PLC-VBS gives risk assessors a more coherent picture about the potential impact should the identified vulnerabilities be exploited; this applies specifically to operational process elements.",
author = "Sam Maesschalck and Alexander Staves and Richard Derbyshire and Benjamin Green and David Hutchison",
year = "2023",
month = jan,
day = "30",
doi = "10.48550/arXiv.2206.06669",
language = "English",
journal = "arXiv",
issn = "2331-8422",

}

RIS

TY - JOUR

T1 - Snakes and Ladder Logic

T2 - PLC-VBS, a PLC Control Logic Vulnerability Discovery Tool

AU - Maesschalck, Sam

AU - Staves, Alexander

AU - Derbyshire, Richard

AU - Green, Benjamin

AU - Hutchison, David

PY - 2023/1/30

Y1 - 2023/1/30

N2 - Cyber security risk assessments provide a pivotal starting point towards the understanding of existing risk exposure, through which suitable mitigation strategies can be formed. Where risk is viewed as a product of threat, vulnerability, and impact, understanding each element is of equal importance. This can be a challenge in Industrial Control System (ICS) environments, where adopted technologies are typically not only bespoke, but interact directly with the physical world. To date, existing vulnerability identification has focused on traditional vulnerability categories. While this provides risk assessors with a baseline understanding, and the ability to hypothesize on potential resulting impacts, it is high level, operating at a level of abstraction that would be viewed as incomplete within a traditional information system context. The work presented in this paper takes the understanding of ICS device vulnerabilities one step further. It offers a tool, PLC-VBS, that helps identify Programmable Logic Controller (PLC) vulnerabilities, specifically within logic used to monitor, control, and automate operational processes. PLC-VBS gives risk assessors a more coherent picture about the potential impact should the identified vulnerabilities be exploited; this applies specifically to operational process elements.

AB - Cyber security risk assessments provide a pivotal starting point towards the understanding of existing risk exposure, through which suitable mitigation strategies can be formed. Where risk is viewed as a product of threat, vulnerability, and impact, understanding each element is of equal importance. This can be a challenge in Industrial Control System (ICS) environments, where adopted technologies are typically not only bespoke, but interact directly with the physical world. To date, existing vulnerability identification has focused on traditional vulnerability categories. While this provides risk assessors with a baseline understanding, and the ability to hypothesize on potential resulting impacts, it is high level, operating at a level of abstraction that would be viewed as incomplete within a traditional information system context. The work presented in this paper takes the understanding of ICS device vulnerabilities one step further. It offers a tool, PLC-VBS, that helps identify Programmable Logic Controller (PLC) vulnerabilities, specifically within logic used to monitor, control, and automate operational processes. PLC-VBS gives risk assessors a more coherent picture about the potential impact should the identified vulnerabilities be exploited; this applies specifically to operational process elements.

U2 - 10.48550/arXiv.2206.06669

DO - 10.48550/arXiv.2206.06669

M3 - Journal article

JO - arXiv

JF - arXiv

SN - 2331-8422

ER -