Exploring ICS/SCADA Network Vulnerabilities

This paper investigates vulnerabilities in the University of South Carolina Aiken (USCA) Centre’s IP infrastructure, focusing on ICS/SCADA network security. The study follows a systematic approach, incorporating the CIS (Center for Internet Security) security controls methodology throughout the project phases, including asset identification, vulnerability assessment, risk assessment, and flexibility study. The asset identification phase utilized tools such as Nmap, Maltego and Lansweeper to comprehensively identify and catalog assets within the network. Subsequently, the vulnerability assessment phase employed tools like OpenVAS, Nexpose, Nessus and manual penetration testing to uncover potential weaknesses. The research team then conducted a risk assessment using the FAIR (Factor Analysis of Information Risk) Methodology to quantitatively analyze and prioritize identified risks. In parallel, a flexibility study was undertaken to assess the system’s adaptability to potential threats. Collaborating with the technology service department(TSD), the research team addressed the identified vulnerabilities. This research paper provides a thorough exploration of ICS/SCADA network vulnerabilities, offering insights into the effectiveness of the CIS security controls methodology in enhancing cybersecurity measures.