# Design of Platforms for Experimentation in Industrial Cybersecurity
## 2 Literature Review  
Given the technical difficulty to perform a security assessment on a running system placed in a critical infrastructure, scientists have created testbeds where experimental research can be made safely [10; 11]. A great number of alternatives have been proposed so far [7] with differences in the sector under study, the scale and coverage of their architecture, the usage objectives, the structural and functional characteristics or their evaluation process [12]. An especially active field for the application of testbeds is that of power system infrastructures and smart grids. A taxonomy of smart grid testbeds can be found in [13] for different research purposes, including cybersecurity. The scale and coverage of the testbed will depend greatly on the simulation approach. Nevertheless, even the approaches with real physical systems often cover only a small set of communication protocols, up to three in most scenarios [7]. Among the thirty different ICS testbeds that have been analyzed in [14], the most common usage objectives identified are vulnerability analysis, education and test of defence mechanisms. With regard to their core characteristics, the testbeds in the literature usually aim at achieving fidelity, flexibility or cost-effectiveness. However, characteristics such as diversity, ability to monitor, reproducibility or isolation should not be disregarded. A comprehensive list of characteristics valuable to achieve credibility can be found in the study by [PERSON] et al. [12]. Despite the variety of testbeds proposed, most of them are built on either simulated environments, where it is difficult to avoid a certain lack of fidelity with respect to real situations, or have a limited coverage of architectures and technologies. Previous works in the literature classify the approach to testbed construction into three different categories [15; 16]. A first approach is the use of software-based simulations of the behaviours of industrial control networks. An opposite approach is the replication of real physical processes using the same components that can be found in an industrial facility. Finally, hybrid approaches can make use of a combination of physical components and emulation, which might include hardware-in-the-loop approaches. Completely simulated testbeds are a low-cost solution to study cybersecurity in control systems, but they usually cannot model all interactions between control devices. These limitations can include delays and introduce inaccurate simulation results that could create an erroneous sense of security. Furthermore, research on vulnerabilities of specific technologies is generally beyond the reach of these testbeds. Several works have implemented simulation frameworks in different environments to test the security of industrial control systems. For instance, a SCADA testbed architecture is provided in [17], where a simulation framework is implemented by means of Simulink subsystems, using discrete event and network simulation technology such as OMNET++ or Emulab in order to test three specific attacks scenarios. SCADASim [18] provides a modular and flexible framework to model SCADA simulations, also based on OMNET++ and built on a previous simulator [19], allowing for studying attacks on devices and simulated networks. In [20], a testbed is created using a PowerWorld server to simulate a power grid. In this case, the client visualizes and controls power system elements whereas a network emulator, using the RINSE tool, simulates the communication to show the vulnerability of the network client to a DDoS attack. On the other hand, C2 WindTunnel is used in [21] to create an assessment environment and simulate a chemical plant and a controller connected through an Ethernet network, to estimate the effects of several attacks. To avoid some of the limitations caused by the use of traditional network simulation software, an approach based on the implementation of virtual devices is presented in [22].