# A Harmonized Information Security Taxonomy for Cyber Physical Systems
## Appendix A Nation State Adversary Case Study: Stuxnet  
The first time an early variant of Stuxnet was identified was in early 2007, but at that time, no one realized the importance of the code. Stuxnet was designed and deployed as a cyber weapon with one specific aim in mind: to damage the enrichment centrifuges at the Natanz nuclear facility in Iran. It has become one of the most well-known industrial cyber incidents, and portions of the code have been found in other pieces of malware like Duqu and Flame [28]. The initial incident was followed by another apparent attack in 2021 [29]. For mapping of the Natanz Stuxnet incident, papers by [PERSON] [30] and [PERSON] [4] were used. Due to the secretive nature of the Natanz facility, actual information about the incident is limited. What is presented here is based on information from the selected papers that used a variety of sources and malware analysis. The methodology in Figure 14 and the harmonized taxonomy shown in Figure 12 were referenced for this analysis. The incident occurred during the plant's maintenance and operational lifecycle phase (10). The primary cause or threat agent (14) was a nation-state adversary that used zero-day vulnerabilities (13) in the control hardware and support systems. Evaluating the assessment core element (12) highlighted several failures that resulted in gaps in the security of the plant and CPSs. Internal process failures occurred on all sub-elements. The process design and execution had notification and alert failures. Process control failed at status monitoring, specifically the monitoring of traffic between the controller and the operator station. The supporting processes failed due to staffing problems, as the personnel were not technically proficient enough to detect abnormalities. Procurement also posed a challenge, since the equipment used had hard-coded system passwords that allowed access. This issue is still a widespread concern in many systems [31]. External events played a role in as far as the geopolitical situation resulted in nation-states launching a weaponized cyber-attack on the facility. Technology and system failures admittedly occurred, but the sophisticated nature of the attack would have caused most defenses to have a limited effect. Moreover, the people failures in terms of skills, which allowed the detection of the activity, were more serious and eventually aggravated the impact of the incident. Classification of the threat (14) showed this to have been adversarial, using physical access by means of a USB port to cause physical damage to the enrichment centrifuges. A variety of vulnerabilities (13) were exploited. These included several zero-day vulnerabilities in Windows and poor system account management by utilizing the hard-coded passwords on the CPS. Poor logging in the implementation allowed abnormal communication between the field CPS and the operator station to go undetected. It is not clear what supporting technology and digital forensics processes (15) were in place, but it is safe to say that they were insufficient, as the malware operated for some time before it was detected. After detection, analyses of the malware and its effects continued for several years. To be clear, had the correct systems and processes been in place, it is still unlikely that the incident would have been prevented, but the detection and recovery period would very likely have been shortened. The harmonized taxonomy identified the following gaps:* Like the Maroochy incident, there were definite management and procedural failures, and the plant personnel could not match the sophistication of the adversary. * This case highlights the relative lack of defense that plant owners have against a well-resourced and very sophisticated enemy. * Vulnerability management would have had little effect because of the use of multiple zero-day exploits.