# Design of Platforms for Experimentation in Industrial Cybersecurity
## 5 Fulfillment of the Usage Goals  
This section explains the main activities that have been achieved in the CICLab during its first stages. Regarding the proposed usage objectives, they have been classified into four groups: cybersecurity training, vulnerability and threats identification, assessment of mitigation and countermeasures and development of testbeds or demonstration systems. A relevant use of the laboratory at the university was focused on innovation for **cybersecurity training** using real control systems and networks [9]. In this sense, as a result of the lessons learnt from the design guidelines of the CICLab laboratory, while sacrificing coverage in exchange of cost-effectiveness and usability, a control cabinet was designed for educational purposes in industrial cybersecurity. This cabinet (See Figure 7a) implements a simple but complete automation system with field equipment, industrial and electric control and supervision, communication devices and the auxiliary supply equipment. By combining the elements in each part, diverse configurations can be used for training in industrial cybersecurity. This system, which has given rise to a patent (number  
Figure 6: Schema for the electric management system. ES 1197111 Y), has been used in several short courses developed for professionals and university students and focused on the following topics:  
* Risk assessment in industrial environments--Security levels in an automated industrial environment;
* Secure configuration of ICS-SCADA--Integration, diagnosis, analysis and anomaly detection for ICS;
* Design and implementation of secure industrial networks--Segmentation and protection of industrial networks: switches, routers and industrial firewalls;
* Network vulnerability assessment and incident detection--Identification of vulnerabilities in industrial networks devices;
* Use of Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS);
* External access: virtual private network (VPN) configurations. Feedback from the students by means of questionnaire has shown substantial acceptance and motivation on the topic. Regarding a **vulnerability identification** in industrial equipment, a comparative analysis of the security in industrial control networks has been made through the study of  
Figure 7: Activities resulting from experimentation in the laboratory. (**a**) control cabinet ES 1197111 Y; (**b**) Industriwall; (**c**) NIDS user interface  
configuration protocols. Penetration testing scripts were developed to perform offensive actions against Schneider Electric and Siemens PLCs:  
* Loading control strategies;
* Changing operation mode (stop/start);
* Extraction of device information through FTP, memory dumps and restoration back-ups;
* Sending of malicious packets for denial of services;
* Modification of system variables in the device and storage of small files in memory registers. The results of these experiments revealed successful attacks on the devices which showed weaknesses of existing configurations [36]. Furthermore, a vulnerability in the M340 programmable logic controller was found that caused uncontrolled resource consumption, as documented in ICS-CERT Advisory ICSA-17-054-03. With regard to the **assessment of countermeasures**, the laboratory was used for experimentation with a prototype for an industrial firewall, also developed by the research group. This firewall, shown in Figure 7b, is created as an adjustable low-cost device to filter and block undesirable traffic of industrial protocols at the network and application levels. The prototype is designed as an all-in-one built-in system with low-cost hardware and a robust protection box, embeddable in DIN Rail for industrial environments. It is oriented to be plug and play and to have an intuitive web-based interface for its intended use in small and medium-sized enterprises (SMEs) in the industrial sector, which usually have limited means and training for the basic network segmentation and protection of their processes.