An Approach to Generate Attack Graphs with a Case Study on Siemens PCS7 Blueprint for Water Treatment Plants

1. Problem Statement

Industrial Control Systems (ICS), which manage critical infrastructure like water treatment plants, face increasing cyber threats due to their connectivity with IT networks. However, assessing the security posture of these environments is difficult due to:

• Complexity and Scale: ICS architectures involve diverse devices (PLCs, switches, firewalls) and segmented zones, making manual identification of attack vectors time-consuming and error-prone.
• Lack of Automation: While attack graphs (visualizing multi-step attack paths) are a known concept, applying them to complex, segmented ICS environments with automation remains a significant challenge.
• Prioritization Gap: Security teams struggle to prioritize mitigation efforts without a clear understanding of how a single vulnerability or misconfiguration can compromise an entire security zone.

2. Methodology

The authors propose a semi-automated, modular framework consisting of three main components to generate and analyze attack graphs. The workflow processes network topology and vulnerability data to simulate attack scenarios.

A. Topology Parser

• Input: A structured JSON file (blueprint.json) defining network components (firewalls, switches, PLCs, servers), interconnections, and security zones.
• Process: Parses the input to construct a directed connectivity graph. Nodes represent devices/buses, and edges represent connections.
• Output: An unenriched topology graph serving as the foundation for analysis.

B. Vulnerability Manager

• Asset Matching: Maps topology devices to known vulnerabilities (CVEs) using a curated list of aliases (e.g., product families) and vendor advisories (e.g., Siemens SSAs).
  • Note: The framework currently does not filter by specific firmware versions or patches, adopting a conservative approach common in industrial settings where patching is often delayed.
• Condition Translation: Converts CVE data (from NVD/CVSS) into logical preconditions (what an attacker needs) and consequences (what the attacker gains).
  • Rule-Based Logic: Uses keywords and CVSS vector strings to determine conditions (e.g., OS(ADMIN), APP(USER), NONE).
  • Conservative Fallback: If a CVE matches no rule, it is assigned a precondition of OS(ADMIN) and consequence of NONE, effectively excluding it from the attack path to avoid false positives.
• Data Insight: Analysis of the database revealed 2,052 vulnerabilities with no preconditions (directly accessible) and 803 that grant full OS administrative privileges upon exploitation.

C. Attack Graph Generator

• Algorithm: Performs a stateful graph traversal starting from a user-defined entry point.
• Simulation Steps:
  1. Local Privilege Escalation: Checks if the attacker can exploit local vulnerabilities to gain higher privileges.
  2. Lateral Movement: Identifies reachable target nodes connected to the current node.
  3. Exploitation Check: Compares the attacker's current privilege state against the preconditions of vulnerabilities on the target node.
  4. State Update: If preconditions are met, the vulnerability is exploited, the attacker's state is updated based on the consequence, and the process repeats.
• Barrier Logic: Nodes with unmet preconditions (e.g., a properly configured firewall) act as barriers, stopping traversal. Vulnerable nodes act as bridges to new zones.

D. Quantitative Likelihood Estimation (Extension)

To move beyond qualitative analysis, the authors integrate Reliability Block Diagrams (RBDs) and the Exploit Prediction Scoring System (EPSS):

• Series Configuration: A single attack path is modeled as a series system; the probability of the path succeeding is the product of individual exploit probabilities ($P_{path} = \prod P_{EPSS}$).
• Parallel Configuration: The total probability of compromising a target is modeled as a parallel system (any path succeeds).
• Formula: $P_{target} = 1 - \prod (1 - P_{path_j})$.

3. Key Contributions

1. Semi-Automated Framework: A novel pipeline combining a topology parser, vulnerability manager, and stateful graph engine specifically tailored for ICS environments.
2. ICS-Specific Semantics: The model explicitly handles industrial components (PLCs, SCALANCE switches) and zone-based segmentation, distinguishing it from generic IT attack graph tools.
3. "What-If" Analysis Capability: The framework allows analysts to simulate misconfigurations (e.g., firewall rule changes) and "artificial vulnerabilities" to test defense-in-depth strategies, not just known CVEs.
4. Quantitative Risk Assessment: The integration of EPSS scores with RBD models provides a data-driven probability of asset compromise, linking topology to quantitative metrics.

4. Case Study Results: Siemens PCS7 Blueprint

The framework was applied to the Siemens PCS7 Cybersecurity Blueprint for Water Treatment Plants, which features a defense-in-depth architecture with four zones (Enterprise, DMZ, Building Control, Central Plant).

• Baseline Segmentation: In the correctly configured scenario, exploiting a vulnerability on the Front Firewall compromised the DMZ but failed to reach the Building or Central Plant zones, validating the effectiveness of segmentation.
• Misconfiguration Impact:
  • Introducing a misconfiguration in the Back Firewall allowed the attacker to pivot from the DMZ through a gateway (SCALANCE M826-2) into the Building zone and reach S7-1512 PLCs.
  • A subsequent weakness in a switch (SCALANCE XF204-2BA) allowed access to the Central Plant zone.
  • Finding: A single inter-zone misconfiguration can collapse intended isolation boundaries.
• Remediation Effectiveness: Removing the vulnerability from the Front Firewall broke the entire attack chain, demonstrating that patching perimeter devices provides high defensive value for downstream assets.
• Quantitative Findings (Table 2):
  • SCALANCE devices (acting as network pivots) showed near-certain exploitation probabilities ($P \approx 0.99999$) due to multiple high-probability paths.
  • PLCs (S7-1512, S7-1510) showed substantial probabilities ($\approx 0.81$).
  • Management hosts had negligible probabilities due to fewer paths and harder-to-exploit vulnerabilities.
  • Path Length vs. Probability: The study noted that the number of paths does not solely dictate risk; path length and the specific EPSS scores of the final target's vulnerability are critical. For example, the Energy Manager Pro had a higher risk than the TIM 1531 IRC despite fewer paths, because its paths were shorter and ended with a higher-EPSS vulnerability.

5. Significance and Conclusion

This paper demonstrates that automated attack graph generation is feasible and highly effective for ICS security assessment.

• Actionable Insights: It moves beyond theoretical modeling to provide concrete remediation strategies, showing exactly which patches or configuration changes break critical attack chains.
• Risk Prioritization: By combining topology with EPSS probabilities, security teams can prioritize defenses based on the actual likelihood of asset compromise rather than just the severity of individual CVEs.
• Future Work: The authors plan to refine the simulator with realistic privilege escalation logic, improve product matching for specific patch levels, and leverage Digital Twins to replicate and test attack paths in a live environment.

The study confirms that while ICS environments are complex, a structured, semi-automated approach can reveal critical single points of failure and validate the efficacy of network segmentation and patch management strategies.