Challenges in Secure Engineering of Critical Infrastructure Systems Modern critical infrastructure (CI), such as water supply, smart power grids, and transportation networks, face major security challenges that arise due to complex interactions between software and physical components as well as human operators. Such systems are an attractive target for attackers who intend to disrupt the safe, normal operation of CI by exploiting vulnerabilities in software components such as the supervisory control and data acquisition (SCADA) workstations and programmable logic controllers (PLCs). In this reference paper, we elaborate on problems and challenges learned from our own experience in automating security analysis, assessment, and defense mechanisms for CI. These challenges are presented in the context of two realworld CI systemsnamely, a water treatment plant and a water distribution system.

Identification of CriticalAttacks Set in an AttackGraph SCADAICS (Supervisory Control and Data AcquisitionIndustrial Control Systems) networks are becoming targets of advanced multifaceted attacks, and use of attackgraphs has been proposed to model complex attacks scenarios that exploit interdependence among existing atomic vulnerabilities to stitch together the attackpaths that might compromise a systemlevel security property. While such analysis of attack scenarios enables security administrators to establish appropriate security measurements to secure the system, practical considerations on time and cost limit their ability to address all system vulnerabilities at once. In this paper, we propose an approach that identifies labelcuts to automatically identify a set of criticalattacks that, when blocked, guarantee system security. We utilize the StronglyConnectedComponents (SCCs) of the given attack graph to generate an abstracted version of the attackgraph, a tree over the SCCs, and next use an iterative backward search over this tree to identify set of backward reachable SCCs, along with their outgoing edges and their labels, to identify a cut with a minimum number of labels that forms a criticalattacks set. We also report the implementation and validation of the proposed algorithm to a realworld case study, a SCADA network for a water treatment cyberphysical system.