# Design of Platforms for Experimentation in Industrial Cybersecurity
## 2 Literature Review
Finally, the SCADA-SST [23] is generic enough to support different scenarios, lightweight and supports hybrid configurations such as simulated or physical components. A hybrid approach usually involves the use of emulated processes, along with commercially available hardware and software. Sometimes, it can be framed as a hardware-in-the-loop emulation strategy. An example of this approach can be found in SCADAVT [24], which provides a SCADA testbed built on top of the CORE emulator that uses simulators of Modbus/TCP enabled equipment and I/O. A similar structure is proposed by [25]. Another simulated environment is described in [26], to provide extensible and adaptable assessment of the security of SCADA systems in associated infrastructures, using an OPC client and server, a SCADA protocol tester, SCADA Remote Terminal Units, sensors and actuators. An example in the domain of power systems is the cybersecurity testbed proposed by [27], which uses a power system simulator along with intelligent electronic devices, circuit breakers and interfaces with different specific communication protocols. The strategy of hardware-in-the-loop (HIL) provides benefits in terms of accuracy and feasibility [11], where sophisticated simulations can be comparable with real environments while providing advantages such as safety, modularity or repeatability. However, cyber-physical systems present challenging considerations in order to model correctly their behaviour, e.g., the interaction between different components such as legacy and modern devices, or the IT configurations between them. The PowerCyber testbed of Iowa State University, introduced in [28], integrates cyber-physical components, virtualization, real time simulators, and emulation. A more ambitious alternative is that of physical replication, i.e., the construction of a testbed for experimentation fully based on real equipment. This is difficult due to its high costs and complex implementation but provides higher similarity with respect to real setups found in industry. It might be more complicated to perform destructive tests without causing any damage to the real system. One large-scale facility was created in the U.S. National Idaho Laboratory (INL), whose research is related to security in critical infrastructures. In the context of the national security program, this laboratory includes electric power grid, wireless communications, and physical and cyber security protection and is aimed to improve resilience. In collaboration with other industrial, academic and governmental partners, such as Sandia National Laboratories, they have also created the National SCADA testbed (NSTB) [29] program, which offers research facilities to evaluate vulnerabilities, develop standards, promote best practices, test new industrial products and perform other secure-related activities. Focused on the energy management infrastructure, the SCADA Security Laboratory and Power and Energy Research laboratory of the Mississippi State University have created another testbed aiming to cover several industrial control systems (such as those used in HVACs, petrochemical industry, gas pipelines, etc.). It uses commercially available software and hardware, a variety of routable and serial-based communication protocols and functional physical processes [30]. Their intended use is both pedagogical (for workforce development) and research-oriented, focused on the implications of vulnerabilities and the validation of their potential mitigations [31]. Some strategies for deploying a European SCADA security testbed are discussed in [32]. Moreover, the European CRUTIAL project has developed two complementary testbeds [33; 34] to analyze their behaviour against attacks in several scenarios such as power station controllers on a real-time control network and power electronic controllers connected over an open communication network. In this case, elements from the industrial and information technologies are integrated to support research on architectures, dependencies and emergency management.