PNNL

Abstract

Cyber-physical systems, especially in critical infrastructures, have become primary hacking targets in international conflicts and diplomacy. However, cyber-physical systems present unique challenges to defenders, starting with an inability to communicate. This paper outlines the results of our interviews with information technology (IT) defenders and operational technology (OT) operators and seeks to address lessons learned from them in the structure of our notional solutions. We pre-sent two problems in this paper: (1) the difficulty of coordinat-ing detection and response between defenders who work on the cyber/IT and physical/OT sides of cyber-physical infrastruc-tures, and (2) the difficulty of estimating the safety state of a cyber-physical system while an intrusion is underway but be-fore damage can be effected by the attacker. To meet these chal-lenges, we propose two solutions: (1) a visualization that will enable communication between IT defenders and OT operators, and (2) a machine-learning approach that will estimate the distance from normal the physical system is operating and send information to the visualization.