U.S. flag

An official website of the United States government

Government Website

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Safely connect using HTTPS

Secure .gov websites use HTTPS
A lock () or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Archived Content

In an effort to keep DHS.gov current, the archive contains outdated information that may not reflect current policy or programs.

Cyber Physical Systems Security

Cyber Physcial Systems Security: Building in Security The Cyber Physical Systems Security (CPSSEC) project addresses security concerns for cyber physical systems (CPS) and internet of things (IoT) devices. CPS and IoT play an increasingly important role in critical infrastructure, government and everyday life. Automobiles, medical devices, building controls and the smart grid are examples of CPS. Each includes smart networked systems with embedded sensors, processors and actuators that sense and interact with the physical world and support real-time, guaranteed performance in safety-critical applications. The closely related area of IoT continues to emerge and expand as costs drop and the confluence of sensors, platforms and networks increases. Whether referencing the forward-collision prevention capability of a car, a medical device’s ability to adapt to circumstances in real-time or the latest IoT innovation, these systems are a source of competitive advantage in today’s innovation economy and provide vast opportunities for DHS and Homeland Security Enterprise missions. At the same time, CPS and IoT also increase cybersecurity risks and attack surfaces. The consequences of unintentional faults or malicious attacks could have severe impact on human lives and the environment. Proactive and coordinated efforts are needed to strengthen security and reliance for CPS and IoT.

Motivation

This is a critical time in the design and deployment of CPS and IoT. Advances in networking, computing, sensing and control systems have enabled a broad range of new devices. These systems are being designed and deployed now, however, security often is left for later. Industry is driven by functional requirements and fast-moving markets. Designs are evolving rapidly and standards are only now emerging. Many devices now being deployed have lifespans measured in decades, so current design choices will impact the next several decades in the transportation, health care, building controls, emergency response, energy and other sectors.

To understand the scope of the challenge, consider the recent advances in the cars we drive, the medical devices we depend on, the systems that operate our buildings, the power grid and a vast number of new IoT devices. Modern cars can automatically brake to avoid a collision, medical devices can monitor conditions in real-time and adapt to changes, and buildings and the energy grid are being enhanced with a number of new smart services. In fact, it is anticipated billions of new IoT devices will be connected to the internet. If security is overlooked, we run the risk of unintentional faults or malicious attacks changing how cars brake, how medical devices adapt and how buildings and the smart grid respond to events. Cybersecurity only becomes more challenging if billions of devices with security vulnerabilities are added. Addressing security issues by bolting solutions onto widely deployed systems is not viable. Security issues must be analyzed, understood and addressed in the early stages of design and deployment.

Approach

The CPS and IoT space is vast and covers many distinct sectors. The Cyber Physical Systems Vision Statement from the Networking Information Technology Research and Development (NITRD) Program identifies nine areas of critical importance to government: agriculture, building controls, defense, energy, emergency response, health care, manufacturing and industry, society and transportation. Further, these areas share crosscutting issues of cybersecurity, economics, interoperability, privacy, safety and reliability and social aspects. No single agency can tackle these areas alone.

The CPSSEC project is taking a layered approach to these challenges as illustrated in the CPS Security Pyramid. At the pyramid’s base, DHS is working with other agencies such as the National Science Foundation (NSF) to address fundamental and crosscutting challenges. The goal is to ensure the basic building blocks for CPS and IoT security are available and realistically feasible for use in specific systems.

At the core of the pyramid, DHS-funded applied R&D addresses sectors where S&T investments can have maximum impact. These areas are chosen based on a combination of impacts delivered to DHS’s homeland security mission, technical readiness and investments by other federal agencies that provide funding. The CPSSEC project currently is focused on security for automotive, medical devices and building controls, with an increasing interest in IoT security.

At the pyramid’s top, CPSSEC engages through a combination of coordination with the appropriate sector-specific oversight agency, government research agencies, industry engagement and support for sector-focused innovation, small business efforts and technology transition. This work encompasses the development of sector-specific industry consortiums.

Performers

Adventium Labs: Intrinsically Secure, Open, and Safe Control of Essential LayErs (ISOSCELES)
The integration of medical devices with the internet has resulted in an expanding attack surface and vulnerabilities for hospitals and medical facilities. ISOSCELES provides a safe and secure platform where medical device companies can build their own medical device applications.

Arizona State University: A Verifiable Framework for Cyber Physical Attacks and Countermeasures in a Resilient Electric Power Grid
DHS recorded 161 cyberattacks on electric power systems in 2013 compared to 31 in 2011. Attackers only need to identify the weakest defense in an expanding attack surface. This effort provides modeling of sophisticated attacks in order better understand, mitigate, and recover by utilizing lessons learned from previous attacks.

Brigham Young University: Mission Impact Situational Awareness Toll for Distributed Operations Management of Cyber Physical Human Critical Infrastructures 
This effort contributes to infrastructure security by developing a tool for mission-focused situational awareness and resiliency planning by building a core back-end software that automates vulnerability assessment of an infrastructure system, embeds the software in an application specific wrapper, and deploys this application specific prototype and validates its utility by collecting feedback from experts.

Circadence: SCADA Cyber Weakness in and Artificial Intelligence – Enabled Cyber Training Platform
This effort will use Project Ares, a game-based interface for immersive cybersecurity training, to develop a compelling supervisory control and data acquisition device training environment known as “Mission 8.” Mission 8 is a critical infrastructure cyber mission providing training opportunities for CI protection teams a different levels (easy, medium, and hard) and scoring for the following skillsets:

  • TCP/IP Ports and Protocols;
  • Network Monitoring and Packet Analysis;
  • Firewall Rulesets;
  • Infrastructure Design;
  • Adversary Attribution;
  • CERTs
  • Host Analysis and Forensics.

Constellation Software Engineering (CSE): Security for the Internet of Things (IoTSEC)
This effort is conducting a survey consisting of identification of IoT devices, infrastructure support, and data flows in order to establish a security baseline and conduct a proof-of-concept demonstration that consolidates multiple sensor readings and outlines the protocols and security architectures involved. This initial footprint will provide answers to key questions surrounding potential cybersecurity issues while setting the stage for establishing new cyber protocols to help mitigate risk and assure operational integrity.

Department of Transportation Volpe Transportation Center: Joint Agency Work on Automotive Cyber Security
This effort promotes automotive cybersecurity best practices and guidelines in the private sector while working with industry on key challenges and pre-competitive research via the Automotive Cybersecurity Industry Consortium .

HRL Laboratories: Side-Channel Causal Analysis for Design of Cyber Physical Security 
This effort’s novel approach of side-channel defense, is to secure vulnerabilities and causal inconsistencies in vehicle cyber physical systems. Advanced side-channel monitors will analyze signals, and causal couplings between cyber and physical realms that are beyond the control of an attacker.

Kansas State University: Modeling Security/Safety Interactions for Buildings for Compositional Safety
This effort fundamentally changes the breach and patch cycle by anchoring security into embedded controller architectures and using real-world scenario analysis and modeling on various types of building automation systems.

Medical Device Innovation Safety and Security (MDISS): Medical Device Risk Assessment Platform
Cyber vulnerabilities in medical devices and their risk controls are an asymmetric threat to patient safety, privacy and the usability of medical devices. MDISS provides health delivery organizations and medical device manufacturers a system to assess these cybersecurity risks. The platform allows the effective assessment of cyber risks and the implementation of appropriate policies and controls to mitigate risks.

New York University: Securely Updating Automobiles
This effort is developing technology that will enhance the security of automobile update systems by adding and validating metadata to improve resilience to attacks. Deploying this technology will be a cost-effective method to mitigate the risk of cyberattacks on automobile software update infrastructure.

Pacific Northwest National Laboratories: Maritime Cybersecurity Review
A cyberattack within the maritime sector can result in the disruption of a variety of processes including, but not limited to, navigation, propulsion, entry requirements documentation and compliance, freight/container/cargo, management, traffic controls, and port security. This effort is intended to build upon the understanding of existing processes and key elements of maritime cargo and terminal operations as they relate to CPS security.

University of Michigan Ann Arbor and University of Illinois at Urbana-Champaign: Support for Security and Safety of Programmable IoT Systems
This effort introduces novel techniques and system designs to prevent, limit, and contain risks that arise in programmable IoT ecosystems.

University of Michigan Transportation Research Institute (UMTRI): Secure Software Update Over-the-Air for Ground Vehicles Specification and Prototype   
The objective of this effort is to create an automotive standard for secure Software updates Over-the-Air (SOTA) and demonstrate a proof-of-concept integration in a vehicle.

Resources

For the latest information about S&T Cybersecurity, visit the S&T Cybersecurity News, Publications, Videos and Events pages.

Publications, Fact Sheets & Videos

Last Updated: 08/02/2024
Was this page helpful?
This page was not helpful because the content