Cyber Weapon Testing

As the use of cyber tools to attack infrastructure is apparently starting to be used as a means of effecting nation state political goals it is necessary to examine how those tools can be honed, improved and tested without risking conventional warfare. While in the early days of cyber weapon development (ala Stuxnet) subterfuge or obfuscation was adequate to prevent retaliation, strides in the technologies for isolation, identification and attribution of cyber weapons are making real world testing of these weapons more difficult.

Artificial testbeds and weapons ranges will certainly have their place in cyber weapon development and evaluation, but a cautious adversary would be wary of relying on new strategic weapons in a full scale attack without having tested both their capability and their target’s potential responses to such an assault.

Proxy Targets

A time honored tradition in conventional weapon development has been the use of new weapon systems against proxy targets. Lesser third party nations that had limited retaliatory capability were attacked with new weapons to see how well the weapons actually fared in combat conditions. If the proxy target had some of the defensive armament used by the primary opponent, the test would provide important data to the developers of weapons and tactics as to how best employ the new weapons in future conflicts.

There have been people that have suggested that the recent cyber-attacks on the electric grid in the Ukraine was just this type of attack. While the Russians certainly have local interests vis a vis the Ukraine that might cause them to execute this type of attack, the use of a new cyber-attack methodology in actual field conditions could certainly be used to refine and improve such methods.

Mini Attacks

Limited attacks with conventional kinetic weapons against one’s primary adversary are very hard to hide. That may not be the case with cyber weapons. If one were to employ portions of the attack tools against an adversary during events when the target was already being stressed, the target might not notice the small cyber effects.

For example, if during a winter storm when a certain amount of electric distribution and transmission failures are to be expected, an adversary were to us new cyber weapons in very limited application the failures related to those attacks might not be investigated in sufficient detail to identify them as a cyber-attack.

An adversary that had already gained access to an electrical distribution network, for instance, could cause an automated breaker to open and carefully watch how that opening affected the remainder of the network. If the breaker controller had been doctored to not show that particular directed opening it is unlikely that the utility would take particular note of that breaker opening in the grand scheme of responding to the weather related problems.

Camouflaged Attacks

In a posting on the SANS ICS Blog last summer I described how isolated changes could be made to the controls of chemical reactions in a chemical manufacturing plant and make them seem like operator errors. Such attacks could be used to map control system responses at such a facility. Lacking detailed process knowledge, an attacker could use such response mapping over time as a method for developing an effective attack that could shut down or even damage the facility.

Preparedness

The last two weapon testing methodologies should be of increasing concern to control system owners as it becomes more obvious that there are nation states (and possibly non-state organizations) that are actively developing technology to attack industrial control systems as a tool of cyber warfare.

While few organizations are going to have the internal resources to complete prevent the possibility of such an attack, the ability to identify unauthorized intrusions into control system networks is a key to limiting the effectiveness of such attacks if they do occur. Such identification should allow for the emergency isolation/shutdown of the affected systems in a way that minimizes the potential damage.