A Zero Trust approach for the cybersecurity of Industrial Control Systems

May combine two claims.

It is possible to implement a Zero Trust identity-centric approach in an industrial context to increase the security and flexibility of the system while providing complete visibility over the entire network.

“The results obtained through a working prototype show that it is possible to implement a Zero Trust identity-centric approach in an industrial context to increase the security and flexibility of the system while providing complete visibility over the entire network.”

May combine two claims.

We implement a proof of concept and test successfully both solutions.

“We implement a proof of concept and test successfully both solutions.”

May combine two claims.

The convergence of IT and ICS architecture exposes the weaknesses of industrial systems and makes them among the primary victims of cyber-attacks.

“Today, with the convergence of IT and ICS architecture [17] [13], this security model is no longer valid, thus exposing the weaknesses of these systems and making them among the primary victims of cyber-attacks.”

• cites [17] Murray, 2017, The convergence of IT and OT in critical infrastructure sourceNot checked — no full text of the source
• cites [13] KaturuzaNot matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• AssumptionRests on an assumption: Industrial plants were not designed to be open to Internet, so IT/OT convergence opens cyber vulnerabilities.

Classified as probably not a substantial claim.

I-DMZ solutions are becoming obsolete because they do not guarantee protection and flexibility of modern industrial plants.

“With multiple interconnections, edge-and cloudbased architectures, remote maintenance operations I-DMZ solutions are becoming obsolete because they do not guarantee protection and flexibility of modern industrial plants.”

• AssumptionRests on an assumption: The frequency of successful cyber attacks shows that typical security solutions are inadequate to the novel complexity of industrial contexts.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

The Access Proxy plays a crucial role in the entire infrastructure and can be considered a single point of failure.

“It also plays a crucial role in the entire infrastructure and can be considered a single point of failure.”

May combine two claims.

The proposed architecture avoids any concept of trusted internal perimeter thanks to a strong authentication and authorization mechanism, allowing a sysadmin to monitor and control any communication inside the network.

“It avoids any concept of trusted internal perimeter thanks to a strong authentication and authorization mechanism, allowing a sysadmin to monitor and control any communication inside the network.”

Probably not a substantial claim: may not pass S4 (based).

The proposed architecture guarantees complete visibility over the entire network.

“and guarantees complete visibility over the entire network.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

The authentication is at least a 2FA to ensure the proper level of security.

“The authentication is at least a 2FA to ensure the proper level of security.”

Probably not a substantial claim: may not pass S4 (based).

The proposed solution is suitable to both on-premise and cloud-based architectures, where Big Data and AI applications of industrial data are externalized to third-party cloud providers.

“The proposed solution has the advantage of being suitable to both on-premise and cloud-based architectures, where Big Data and AI applications of industrial data are externalized to third-party cloud providers.”

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

The Access Proxy and NGFW enable fine-grained Authentication and Authorization processes and segmentation of the network to guarantee that communications, both from outside and inside, can be monitored and controlled.

“They enable the implementation of fine-grained Authentication and Authorization processes and segmentation of the network to guarantee that the communications, both from outside and inside, can be monitored and controlled.”

Classified as probably not a substantial claim.

The architecture is based on two fundamental components: the Access Proxy and the Next Generation Firewall.

“It is based on two fundamental components: the Access Proxy (AP) and the Next Generation Firewall (NGFW).”

May combine two claims.

The proposed architecture overcomes many limitations of the traditional I-DMZ solution, allowing the implementation of new services and functions that the industrial sector needs without compromising its security operations and safety.

“It overcomes many limitations of the traditional I-DMZ solution, allowing at the same time the implementation of new services and functions that the industrial sector needs without compromising its security operations and safety.”

Probably not a substantial claim: may not pass S2 (checkable). May combine two claims.

The Zero Trust model cannot be treated as a black box that can be turned on at will; all choices must be correctly planned and examined, and a deep knowledge of the underlying infrastructure and interactions between components is required for successful implementation.

“The Zero Trust model cannot be treated as a black box that can be turned on at will, all the choices must be correctly planned and examined, in addition a deep knowledge of the underlying infrastructure and all the interactions between the different components is required for a successful implementation.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based). May combine two claims.

Different from other approaches, the Zero Trust security model does not impose rigid constraints on the architecture; it is a moving target for the security posture of an entire organization.

“Different from other approaches, the Zero Trust security model does not impose rigid constraints on the architecture; it is a moving target for the security posture of an entire organization.”

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

The threat intelligence service can help identify if a device is affected by a known vulnerability or is not patched, by dynamically changing the trust level of a specific device.

“This service can help to identify, for example, if a device is affected by a known vulnerability or if is not patched, by dynamically changing the trust level of a specific device.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based).

Our research evidenced that by embracing the Zero Trust approach, industries are forced to adopt all the best practices for a well-defined cybersecurity strategy.

“Our research evidenced that by embracing the Zero Trust approach industries are forced to adopt all the best practices for a welldefined cybersecurity strategy.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

The NGFW can allow or deny traffic based on the zone's VLAN tag to enforce security or dynamically restrict access to a network segment if it is needed.

“It can allow or deny traffic based on the zone's VLAN tag to enforce security or dynamically restrict access to a network segment if it is needed.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

The Access Proxy can be horizontally replicated to improve its availability.

“However, in a real scenario the AP can be horizontally replicated to improve its availability.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

The proposed solution's Trust Algorithm falls into the category of a criteria-based solution with contextual information, according to NIST definitions.

“Referring to the NIST definitions of Trust Algorithms, our solution falls into the category of a criteria-based solution with contextual information.”

May combine two claims.

A major problem with traditional VPNs is that they are a static approach: they allow access to the organization's network but cannot manage per-service requests.

“Indeed, a major problem with traditional VPNs is that it they are static approach.This means that they allow to grant access to the organization's network, but cannot manage per-service requests.”

Probably not a substantial claim: may not pass S4 (based).

Thanks to the Zero Trust approach and fine-grained segmentation, the proposed solution is designed to minimize the possibility of lateral movement and external intrusion.

“Thanks to the Zero Trust approach and the fine-grained segmentation, our solution is designed to minimizes the possibility of lateral movement and external intrusion.”

May combine two claims.

Organizations can exploit the proposed approach based on a modular architecture to securely support their digital transformations without restrictions on new services, which can be implemented without any compromise in terms of security.

“Organizations can exploit our approach based on a modular architecture to securely support their digital transformations without restrictions on new services, which can be implemented without any compromise in terms of security.”

Probably not a substantial claim: may not pass S4 (based).

Similar flexibility would require substantial modifications of a multilayer network architecture, such as an I-DMZ, to the extent of making it impractical.

“On the other hand, similar flexibility would require substantial modifications of a multilayer network architecture, such as an I-DMZ, to the extent of making it impractical.”

Probably not a substantial claim: may not pass S2 (checkable).

The experiments highlight the necessity for the industrial sector to move from a rigid layered architecture based on the Purdue model to a more flexible approach to cybersecurity.

“Our experiments highlight the necessity even for the indus-trial sector to move from a rigid layered architecture based on the Purdue model to a more flexible approach to cybersecurity.”

• AssumptionRests on an assumption: With the adoption of cloud, edge computing and increasingly connected services, vast amounts of data can also be collected at Level 1, processed, and sent directly to the cloud bypassing the hierarchical data flows of the Purdue model.
• AssumptionRests on an assumption: The rapid adoption of emerging technologies to facilitate remote connectivity even in industrial contexts (IIoT) forces organizations to review and update existing security strategies and countermeasures to protect the most critical systems.
• AssumptionRests on an assumption: IIoT solutions and the rise of remote work are blurring the separation between the trusted internal network and the public internet, which is a core assumption for the I-DMZ based security model.

Classified as probably not a substantial claim. May combine two claims.

The two papers [2], [16] are pioneering to consider Zero Trust security models in an industrial context, but they offer just a high level reference architecture together with a theoretical discussion about possible benefits without providing experimental results.

“These two papers [2], [16] are pioneering to consider Zero Trust security models in an industrial context, but they offer just a high level reference architecture together with a theoretical discussion about possible benefits without providing experimental results.”

• cites [2] sourceNot checked — no full text of the source
• cites [16] sourceNot checked — no full text of the source

• AssumptionRests on an assumption: In industrial contexts, the Zero Trust security model is still at an early adoption phase, hence few contributions exist in literature.

May combine two claims.

All those data, together with threat intelligence systems, allow defining the context of communications better, determining the health of the device, and blocking ambiguous connection attempts.

“All those data, together with the threat intelligence systems, allow us to define the context of the communications better, determine the health of the device, and block ambiguous connection attempts.”

Probably not a substantial claim: may not pass S2 (checkable), S4 (based).

Otherwise, organizations will be forced to choose between the security of their infrastructure and the ability to innovate by integrating bleeding-edge technologies.

“Otherwise, organizations will be forced to choose between the security of their infrastructure and the ability to innovate by integrating bleeding-edge technologies.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The Trust Algorithm approach's flexibility allows increasing or decreasing the granularity of controls according to the context of the specific environment.

“The Trust Algorithm approach's flexibility allows us to increase or decrease the granularity of our controls according to the context of the specific environment.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based).

The achieved result can be considered a starting point from which any company can redesign its security infrastructure.

“The achieved result can be considered a starting point from which any company can redesign its security infrastructure.”

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

The proposed solution and the Zero Trust approach in general allow dynamically adjusting security controls on a per-resource basis to match its risk level.

“Our solution and the ZT approach in general allow for dynamically adjusting the security controls on a per-resource basis to match its risk level.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

The NGFW can dynamically adapt to the system's state and react fast if something goes wrong, reducing the overall incident response time.

“It can dynamically adapt to the system's state and react fast if something goes wrong thus reducing the overall incident response time.”

Classified as probably not a substantial claim. May combine two claims.

With a single sign-on solution we improve both the security and the user experience of the system.

“With a single sign-on solution we improve both the security and the user experience of the system.”

• AssumptionRests on an assumption: Using several different authentication mechanisms requiring multiple credentials does not increase overall security and could become a security vulnerability leading to weaker credentials.

Classified as probably not a substantial claim.

The NGFW plays the role of Policy Enforcement Point and Policy Administrator to monitor and control any communication in the network.

“The different areas are connected by the NGFW, which plays the role of Policy Enforcement Point (PEP) and Policy Administrator (PA) to monitor and control any communication in the network.”

Classified as probably not a substantial claim.

The Access Proxy provides authorization and authentication for users and devices based on fine-grained dynamic policies that take into account the user, the devices information and also the context of the request such as moment of the day or the general risk level of the action to perform.

“It provides authorization and authentication for users and devices based on fine-grained dynamic policies that take into account the user, the devices information and also the context of the request such as moment of the day or the general risk level of the action to perform.”