IMPLEMENTATION OF THE INFORMATION SECURITY OF A SCADA SYSTEM ON THE CLOUD
DOI:
https://doi.org/10.24867/20BE10IlicKeywords:
Information security, SCADA, Cloud computing, authentication, authorizationAbstract
This paper describes the user authentication and authorization subsystem in detail in the traditional as well as in the Cloud environment. For these demonstration purposes, two applications that simulate the processes of a SCADA system have been developed and steps that need to be taken have been described in great detail in order to migrate from the traditional to the Cloud environment. The need for moving to the Cloud environment from the traditional one arises from the fact that the Cloud environment offers numerous advantages in terms of performance [1], but also because of the ease of implementation of the security aspects into existing solutions which is demonstrated in this paper.
References
[1] N. Popović, „Napredni distributivni menadžment sistem zasnovan na Cloud infrastrukturi,“ Fakultet tehničkih nauka, Novi Sad, 2018.
[2] O. Ashman and I. Damsky, "ThreatSTOP Report: BlackEnergy," THREATSTOPBME, 2016.
[3] F. Y. Rashid, "Telvent Hit by Sophisticated Cyber-Attack, SCADA Admin Tool Compromised," SecurityWeek, 26 September 2012. [Online]. Available: https://www.securityweek.com/telvent-hit-sophisticated-cyber-attack-scada-admin-tool-compromised. [Accessed 11 May 2022].
[4] K. Straub, "Information Security: Managing Risk with Defense in Depth," SANS Institute, 2003.
[5] M. E. Whitman and H. J. Mattord, Principles of Information Security, 4th ed., Boston: Course Technology, 2012.
[6] E. Bauer and R. Adams, Reliability and Availability of Cloud Computing, Hoboken, New Jersey: IEEE Press and John Wiley & Sons, Inc., 2012.
[7] J. Thornton, "matomo," 17 July 2020. [Online]. Available: https://matomo.org/blog/2020/07/storing-data-on-us-cloud-servers-dont-comply-with-gdpr/. [Accessed 15 May 2022].
[8] European Commission, "EU-US data transfers: How personal data transferred between the EU and US is protected.," European Commision, [Online]. Available: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/eu-us-data-transfers_en. [Accessed 15 May 2022].
[9] European Commission, "European Commission and United States Joint Statement on Trans-Atlantic Data Privacy Framework," 25 March 2022. [Online]. Available: https://ec.europa.eu/commission/presscorner/detail/en/ip_22_2087. [Accessed 15 May 2022].
[10] A. Singh and K. Chatterjee, "Cloud security issues and challenges: A survey," Journal of Network and Computer Applications, vol. 79, pp. 88-115, 2017.
[11] Y. A. Younis, M. Merabti i K. Kifayat, „Secure Cloud Computing for Critical Infrastructure: A Survey,“ The 14th Annual PostGraduate Symposium on The Convergence of Telecommunications, Networking and Broadcasting (PGNet 2013), Liverpool, UK, pp. 1-6, 2012.
[12] J. G. Steiner, C. Neuman and J. I. Schiller, "Kerberos: An Authentication Service for Open Network Systems".
[13] Microsoft, "What is Azure Active Directory?," [Online]. Available: https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-whatis. [Accessed September 2019].
[14] "Azure Active Directory and WCF authentication," 14 November 2014. [Online]. Available: https://stackoverflow.com/questions/26930018/azure-active-directory-and-wcf-authentication. [Accessed April 2019].
[2] O. Ashman and I. Damsky, "ThreatSTOP Report: BlackEnergy," THREATSTOPBME, 2016.
[3] F. Y. Rashid, "Telvent Hit by Sophisticated Cyber-Attack, SCADA Admin Tool Compromised," SecurityWeek, 26 September 2012. [Online]. Available: https://www.securityweek.com/telvent-hit-sophisticated-cyber-attack-scada-admin-tool-compromised. [Accessed 11 May 2022].
[4] K. Straub, "Information Security: Managing Risk with Defense in Depth," SANS Institute, 2003.
[5] M. E. Whitman and H. J. Mattord, Principles of Information Security, 4th ed., Boston: Course Technology, 2012.
[6] E. Bauer and R. Adams, Reliability and Availability of Cloud Computing, Hoboken, New Jersey: IEEE Press and John Wiley & Sons, Inc., 2012.
[7] J. Thornton, "matomo," 17 July 2020. [Online]. Available: https://matomo.org/blog/2020/07/storing-data-on-us-cloud-servers-dont-comply-with-gdpr/. [Accessed 15 May 2022].
[8] European Commission, "EU-US data transfers: How personal data transferred between the EU and US is protected.," European Commision, [Online]. Available: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/eu-us-data-transfers_en. [Accessed 15 May 2022].
[9] European Commission, "European Commission and United States Joint Statement on Trans-Atlantic Data Privacy Framework," 25 March 2022. [Online]. Available: https://ec.europa.eu/commission/presscorner/detail/en/ip_22_2087. [Accessed 15 May 2022].
[10] A. Singh and K. Chatterjee, "Cloud security issues and challenges: A survey," Journal of Network and Computer Applications, vol. 79, pp. 88-115, 2017.
[11] Y. A. Younis, M. Merabti i K. Kifayat, „Secure Cloud Computing for Critical Infrastructure: A Survey,“ The 14th Annual PostGraduate Symposium on The Convergence of Telecommunications, Networking and Broadcasting (PGNet 2013), Liverpool, UK, pp. 1-6, 2012.
[12] J. G. Steiner, C. Neuman and J. I. Schiller, "Kerberos: An Authentication Service for Open Network Systems".
[13] Microsoft, "What is Azure Active Directory?," [Online]. Available: https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-whatis. [Accessed September 2019].
[14] "Azure Active Directory and WCF authentication," 14 November 2014. [Online]. Available: https://stackoverflow.com/questions/26930018/azure-active-directory-and-wcf-authentication. [Accessed April 2019].
Downloads
Published
2022-11-05
Issue
Section
Electrotechnical and Computer Engineering
