This project will deliver a methodology and framework that will enable ICS operators to quickly and effectively verify the security of 3rd party devices. Such COTS devices can often compromise the security of an otherwise well-designed system.

These devices can often be hard to check, because the source code and design is often not available, and sometimes not even known the to the supplier of the device. We will ease the challenge such checking imposes to obtain NIS compliance by providing detailed guidance and analysis on the best methods of checking such components. This will be based on our experience of such analysis and validated by new analysis of common ICS components. This will lead to a body of knowledge that ICS owners could use to review potential issues that may exist in their systems, as well as providing contextual information about the source of that vulnerability and how it may be mitigated.

We will use this body of knowledge to compare different assessment methods and provide the results as a report that ICS owners can used to decide on the most effective analysis methods, for their needs. We will also investigate automatic analysis methods, such as common scanning tools and also more advanced research tools that could be used by ICS owners to analyse their systems without requiring major resources and expertise. We will assess such tools on a range of ICS components, and again provide guidance to ICS owners on their use and effectiveness.