# Security Audit of a Blockchain-Based Industrial Application Platform
## 4 Attacks and Countermeasures
### Countermeasures  
This section provides an overview of countermeasures that can be applied to mitigate or completely prevent a successful attack on the BISS:4.0 platform. The countermeasures described are deliberately brief because they apply to many attacks. * _C-Backups_ ensure regular backups and provide security measures to prevent anonymous persons from entering the workshop area. * _C-Audit:_ while the most mentioned countermeasures are designed to preemptively protect against attacks, the countermeasure of an audit is used to evaluate the security of a given infrastructure, system, or software at a given snapshot in time. It indentifies exposed existing security vulnerabilities to prevent future attacks. There are a wide variety of security audit standards that exist; the most common utilized are ISO/IEC 27001 [58], NIST Cybersecurity Framework [59], Cyber Essentials [60], and BSI IT-Grundschutz [61]. * _C-Smart-Contract:_ smart contracts are a very impactful source of attacks. Research has developed a wide variety of countermeasures for a wide variety of blockchain platforms. The most common approach is related to static code analysis that checks for patterns that are known causes [62; 63]. These tools are mostly in early developmental states and are not available for the general public. * _C-Optimization:_ fuzzy logic and ant colony optimization for jamming attack detection are proposed. * _C-Tracking:_ a tracking mechanism, such as a sequence number, is used to identify packets that have already been processed but retransmitted with potentially malicious commands and data. * _C-Identity-Verification:_ identities must be verified. This can be done by encrypting with public keys or by granting access with the identity registered in the Blockchain. * _C-Restrict-Access:_ access can be restricted at two levels: restricted access to the building in which the infrastructure is located and restricted access at the account level of computer systems and the software. The goal is to prevent unauthorized individuals from accessing a resource. There are standards that specify approved methods for establishing restricted access to a building. In Germany, the approved methods are part of the BSI IT-Grundschutz [61]. Methods to protect against unauthorized access to computer systems and software can include password, two-factor authentication, smart cards, or biometrics. In Germany, the approved methods are part of BSI IT-Grundschutz [61]. * _C-Check-Connection:_ once a connection has been established, whether the connection is still functional is checked, which can be performed with a heartbeat mechanism. * _C-Monitor-Traffic_ monitors inbound and outbound traffic for anomalies, which can be performed by either only looking at the metadata (e.g., IP header) or by looking at the content (deep packet inspection). * _C-Encryption:_ it can be prevented by encrypting and authenticating the superficial link layer using a standard global key. * _C-Isolation:_ as discussed in Section 3.1, smartphones can be infected and made accessible to attackers via installable applications. Isolation point mechanisms must be implemented for software running in development environments. Mobile applications, for example, must notify and request permission before accessing storage or network resources. The logic of automation and active software components should be the same because they are not reliable and should never be considered reliable elements. * _C-Concalment:_ obfuscation disguises the intended meaning of the communication by making the message difficult to understand. * _C-Vulnerability-Scan:_ a preventive action is the scan for vulnerabilities. One method is fuzzing software; this includes generating random input for the target system, revealing failures due to stress. The network connected systems can be scanned for open ports. This data is a foundation for securing the systems. * _C-Security-Analysis:_ vulnerabilities at the system boundaries are searched for.