Automated Attack Planning using a Partially Observable Model for Penetration Testing of Industrial Control Systems

Context Industrial control systems govern important industrial processes as well as many other areas of daily life including building automation and the energy infrastructure. In the past, such systems were rarely networked if at all. Recently, however, a need for a higher degree of communication between different systems as well as other company resources has arisen. While leading to increased productivity and the development of new processes altogether, this also introduced a whole new class of possibles attack vectors. As such systems are usually optimized for their specific purpose and otherwise offer limited computational resources, they often lack security mechanisms found elsewhere. This makes industrial control systems a very interesting and promising target for malicious intruders trying to cause damage on often critical and costly infrastructure. Consequently, there is a desparate need to continuously ensure that ICS are free of devastating vulnerabilities.