# Analysis of ICS and SCADA Systems Attacks Using Honeypots
## 7 Results Analysis
\begin{table}
\begin{tabular}{c c} \hline \hline
**Vulnerability** & **Impact** \\ \hline \hline \begin{tabular}{c} Insecure Protocols (e.g., Modbus) \\ \end{tabular} & \begin{tabular}{c} Lack of encryption, integrity, and authentication measures, \\ making them vulnerable to attacks \\ \end{tabular} \\ \hline \begin{tabular}{c} Insecure Interfaces \\ \end{tabular} & \begin{tabular}{c} Legacy control interfaces that connect to the internet, \\ connected industrial IoT devices, and various BYOD \\ devices can serve as entry points to the system and \\ introduce vulnerabilities \\ \end{tabular} \\ \hline \begin{tabular}{c} Insecure Software \\ \end{tabular} & \begin{tabular}{c} Lack of access control in real-time operating systems, and \\ vulnerabilities in Windows and Linux \\ \end{tabular} \\ \hline \begin{tabular}{c} Weak Encryption \\ \end{tabular} & \begin{tabular}{c} Use of weaker Wi-Fi encryption protocols \\ \end{tabular} \\ \hline \begin{tabular}{c} Insufficient Physical Security \\ \end{tabular} & \begin{tabular}{c} Lack of physical security measures for devices and systems \\ \end{tabular} \\ \hline \begin{tabular}{c} Lack of Network Segmentation \\ \end{tabular} & \begin{tabular}{c} Systems are not segmented, allowing an attacker to move \\ laterally and gain access to critical systems \\ \end{tabular} \\ \hline \
\begin{tabular}{c} Lack of Monitoring \\ \end{tabular} &
\begin{tabular}{c} Insufficient monitoring of network traffic and \\ system activity \\ \end{tabular} \\ \hline \hline \end{tabular}  
Mitigation solutions/services may vary depending on the specific system and context. However, overall it is important to regularly update and patch systems, implement network segmentation and access controls, and monitor network traffic and system activity to mitigate the risk of cyber-attacks on ICS (as shown in Table 11).  
\begin{tabular}{c c c} \hline \hline
**Protocol** & **Purpose** & **Vulnerabilities** & **Impact** \\ \hline \begin{tabular}{c} Modbus \\ \end{tabular} & \begin{tabular}{c} Communication protocol for \\ industrial control systems \\ \end{tabular} & \begin{tabular}{c} Lack of encryption, \\ authentication, and \\ integrity measures \\ \end{tabular} & \begin{tabular}{c} Attackers can tamper with or disrupt data \\ communication, modify system settings, and \\ execute unauthorized commands \\ \end{tabular} \\ \hline \begin{tabular}{c} S7 comm \\ \end{tabular} & \begin{tabular}{c} Communication protocol for \\ Siemens programmable \\ logic controllers \\ \end{tabular} & \begin{tabular}{c} Vulnerable to \\ man-in-the-middle attacks, \\ weak encryption, lack of \\ authentication \\ \end{tabular} & \begin{tabular}{c} Attackers can intercept and modify data, execute \\ unauthorized commands, and cause \\ system outages \\ \end{tabular} \\ \hline BACnet & \begin{tabular}{c} Communication protocol for \\ building automation and \\ control systems \\ \end{tabular} & \
\begin{tabular}{c} Vulnerable to buffer overflow \\ attacks, insecure \\ authentication mechanisms \\ \end{tabular} &
\begin{tabular}{c} Attackers can exploit vulnerabilities to gain \\ unauthorized access to the system, modify \\ system settings, and cause system outages \\ \end{tabular} \\ \hline \hline \end{tabular}
\end{table} 
Table 11: List of Modbus, S7 comm, and BACnet protocols and their potential impact if accessed by attackers. * IEC 62443 series: Developed by the International Electrotechnical Commission (IEC), this series of standards provides comprehensive guidelines for securing industrial control systems (ICS) and OT systems. * NIST SP 800-82: Developed by the National Institute of Standards and Technology (NIST), this standard provides guidelines for securing ICS and OT systems, including network security, access control, and incident response. * ISO/IEC 27001: This international standard provides a framework for information security management systems (ISMS), including guidelines for protecting OT systems.