Current Information and Communication Technology (ICT) systems are rapidly increasing in scale and complexity, driven by the need to support sophisticated processes and the growing volume of heterogeneous data from interconnected services and devices. At the same time, rising concerns over cybersecurity and legal obligations demand greater attention to security, governance, and regulatory compliance. In this context, compliance management and cybersecurity forensics have become critical priorities, requiring innovative strategies and more effective tools, frameworks, and methodologies for audit and forensic analysis.This paper presents an integrated Forensics and Compliance Auditing framework, designed to support the identification and analysis of past security incidents and non-compliance events across both generic and domain-specific ICT systems, which stems from a PhD dissertation carried out in a mixed industrial/academic environment.

The Message Queuing Telemetry Transport (MQTT) protocol is a cornerstone of IoT communications. It relies on service brokers to enable reliable data delivery between devices and clients. In modern deployments, MQTT brokers are frequently hosted in virtualized environments to support scalability, flexibility, and resource efficiency. However, virtualization enlarges the attack surface, posing challenges to service reliability and security. This paper investigates the use of Virtual Machine (VM) migration as a Moving Target Defense (MTD) to enhance security in MQTT-based IoT services. While VM migration is an established technique in network and service management for workload balancing and fault tolerance, its impact, when used as a proactive security mechanism in MQTT deployments, remains unexplored. This work shows a comprehensive performance evaluation of VM migration under both normal and active attack scenarios. The results demonstrate that the security benefits of VM migration come with minimal performance degradation, characterized by a modest effect size (Cohen D measure<0.5), thus ensuring service continuity and operational stability. However, it comes with a cost of increased performance oscillation (i.e., higher incidences of peaks in the response time). This paper also introduces an interactive, web-based tool that enables pre-deployment MTD simulation. This work offers insights into integrating security-aware VM migration within IoT service management.

5G technology brings several improvements to mobile communication systems. The ability to provide much faster connections, lower latency and greater scalability enables 5G to be employed in scenarios where previous generations failed to succeed. However, the growing number of connected devices, with a high proportion of Internet of Things (IoT) devices, expands the cyberattack surface and creates new vulnerabilities, including the heightened risk of Distributed Denial of Service (DDoS) attacks. This research explores the feasibility of using extended Berkeley Packet Filter/eXpress Data Path (eBPF/XDP) technology to enhance the security and robustness of 5G SA Core Network services against DDoS attacks. We evaluate the effectiveness of this approach through several SYN flooding attacks to the 5G Network Repository Function (NRF). In scenarios without eBPF/XDP, DDoS attacks caused significant disruptions, highlighting its impact in the 5G Core Network. With the eBPF/XDP framework in place, the NRF service demonstrated considerable resilience against the SYN Flooding attacks. Thus, we conclude eBPF/XDP effectively helped detecting and mitigating potential DDoS threats, ensuring uninterrupted service for legitimate traffic.

Energy smart grids and other modern industrial control systems networks impose considerable security management challenges due to several factors: their broad geographic dispersion and capillarity, the constrained nature of many of the devices and network links that integrate them, and the fact that they are often fragmented across multiple domains, owned and managed by different entities which often have nonaligned or even competing interests. Due to this scenario, we propose to improve federated learning-based anomaly detection for smart grids and other industrial control networks, using a federated data-centric methodology that attends to the balance and causality of the data, improving the representation of the different classes of anomalies of the ingested data, which directly impact the classifier's performance. The proposed approach shows up to 33% performance improvements in terms of F1-score for attack classification, compared to the baseline federated approach (not attending to class imbalance and causality) on a broad range of industrial control systems traffic datasets.

In the domain of Industrial Automation and Control Systems (IACS), security was traditionally downplayed to a certain extent, as it was originally deemed an exclusive concern of Information and Communications Technology (ICT) systems. The myth of the air-gap, as well as other preconceived notions about implicit IACS security, constituted dangerous fallacies that were debunked once successful attacks become known. Ultimately, the industry started shifting away from this dangerous mindset, discussing how to properly secure those systems. In many ways, IACS security should not be treated differently from modern ICT security. For sure, IACS have distinct characteristics, assets, protocols and even priorities that should be considered – but security should never be an optional concern.In this publication, we present the main results of a PhD dissertation that proposes a holistic and data-driven framework capable of leveraging distinct techniques to increase situational awareness and provide continuous and near real-time monitoring of IACS. For such purposes, it proposes an evolution of the Security Information and Event Management (SIEM) concept, geared towards providing a unified security data monitoring solution by leveraging recent advances in the field of real-time Big Data analytics. In the same way, the most recent machine-learning-based anomaly-detection techniques (which are becoming increasingly prominent in the cybersecurity field) are also analyzed and studied to understand their benefits for developing and advancing IACS cyber-intrusion detection processes.

When it comes to protecting confidential and/or sensitive information, organizations have a plethora of recommendations, standards, policies and security controls at their disposal, conceived to deal with a wide variety of threats. However, most of them share the same fundamental premise: that weaknesses are inline by nature, as a consequence of infrastructure, social and/or technological gaps that can be detected, controlled, mitigated or constrained. Side channel threats are a different matter, though. Stemming from unconventional intrusion or attack vectors whose existence was inconceivable, unexpected or deemed unfeasible, their successful exploitation may provide attackers with the means to bypass and render most security controls ineffective or even useless. In this paper we address one such case: the use of a KNX-based building automation and control system to exfiltrate data from an air-gapped infrastructure. The introduction of a small device provides connectivity to the existing KNX fieldbus and enables sending data through it or even control other devices, with no interference in the operation of the building automation and control network. We validated the feasibility of this approach by means of an experimental setup, which was used to successfully evaluate two different techniques: inline bus exfiltration and optical transmission, via dimmer control. Finally, some measures for detecting and mitigating this type of attacks are proposed.

Building Automation and Control Systems (BACS) designate the mechanisms that are used to automate buildings’ operations such as climate control, lightning and access control. As such, traditional BACS encompass extensively automated buildings managed in an integrated manner, with the support of Supervisory Control and Data Acquisition (SCADA) systems and specialized industry standards such as BACnet and KNX. More recently, the increasing adoption of IP-connected, IoT-like devices for automating single tasks led to a substantial increase in the number of automated building functions (especially for the smart home domain), although rarely with extensive or integrated automation levels. The interconnection with the building local area network (LAN) and even the Internet, comes with the cost of a wider exposition to attacks, that can either begin inside of the building or be initiated from anywhere outside of it. In contrast with other domains that recently received substantial attention (e.g. industrial control and automation systems), the security of BACS has been addressed in a somehow more superficial and less structured manner. Nevertheless, recent security incidents, combined with the fact that these systems are becoming more interconnected with the building networks and the Internet, are raising security concerns. This paper provides a systematic survey of recent research and industry developments related with the security and safety of building automation and control systems. It also presents an overview of the existing threats and known attacks against BACS, as well as open issues and future research directions.

Due to the growing complexity and scale of IT systems, there is an increasing need to automate and streamline routine maintenance and security management procedures, to reduce costs and improve productivity. In the case of security incidents, the implementation and application of response actions require significant efforts from operators and developers in translating policies to code. Even if Machine Learning (ML) models are used to find anomalies, they need to be regularly trained/updated to avoid becoming outdated. In an evolving environment, a ML model with outdated training might put at risk the organization it was supposed to defend. To overcome those issues, in this paper we propose an automated closed-loop process with three stages. The first stage focuses on obtaining the Decision Trees (DT) that classify anomalies. In the second stage, DTs are translated into security Policies as Code based on languages recognized by the Policy Engine (PE). In the last stage, the translated security policies feed the Policy Engines that enforce them by converting them into specific instruction sets. We also demonstrate the feasibility of the proposed framework, by presenting an example that encompasses the three stages of the closed-loop process. The proposed framework may integrate a broad spectrum of domains and use cases, being able for instance to support the decide and the act stages of the ETSI Zero-touch Network & Service Management (ZSM) framework.

Quite often, the deployment of components for network monitoring or security purposes constitutes a burden, due to the need for IT teams to perform on-site setup procedures, and/or to manually configure diversified equipment or services. While this approach may still be somehow manageable for contained infrastructures such as LANs, it cannot cope with the scale of certain telecommunications service provider or industrial IoT environments.This paper proposes a solution for flexible virtualized component deployment, which takes advantage of containerized probes, together with SDN-assisted network traffic steering mechanisms. In this scope, the integration of SDN and Docker containers constitutes a relevant development, enabling the creation of probe deployment mechanisms which dismiss the need for physical appliance configuration and/or deployment.

The residential gateway (RGW) is a widely deployed device in the context of telecommunication services such as triple play and internet access. Designed to make the connection between the customer home and the operator infrastructure, it provides wired and/or wireless connectivity capabilities, also handling services such as Domain Name Service (DNS) proxying, routing, Network Address Translation (NAT) or firewalling, among others. Its increased complexity, together with other factors - such as device-related costs, or the increased reliance on RGWs for providing critical services - has prompted an interest in its virtualization, also motivated by the evolution of network and service-centric virtualization concepts. This paper presents an approach for the virtualization of the residential gateway (vRGW). It starts by giving an overview of the concept, explaining it and pointing out its benefits. It also explains the virtualization techniques and paradigms that have pushed this movement, namely software defined networking (SDN), network function virtualization (NFV), and service function chaining (SFC). Additionally, it describes the implementation of the vRGW architecture, including a description of its components and their integration.

As Supervisory Control and Data Acquisition (SCADA) and Industrial and Automation Control System (IACS) architectures became more open and interconnected, some of their remotely controlled processes also became more exposed to cyber threats. Aspects such as the use of mature technologies and legacy equipment or even the unforeseen consequences of bridging IACS with external networks have contributed to this situation. This situation prompted the involvement of governmental, industrial and research organizations, as well as standardization entities, in order to create and promote a series of recommendations and standards for IACS cyber-security. Despite those efforts, which are mostly focused on prevention and mitigation, existing literature still lacks attack descriptions that can be reused to reproduce and further research specific use cases and scenarios of security incidents, useful for improving and developing new security detection strategies. In this paper, we describe the implementation of a set of attacks targeting a SCADA hybrid testbed that reproduces an electrical grid for energy distribution (medium and high voltage). This environment makes use of real SCADA equipment to faithfully reproduce a real operational deployment, providing a better insight into less evident SCADA- and device-specificities.

This paper presents a distributed intrusion detection system (DIDS) for supervisory control and data acquisition (SCADA) industrial control systems, which was developed for the CockpitCI project. Its architecture was designed to address the specific characteristics and requirements for SCADA cybersecurity that cannot be adequately fulfilled by techniques from the information technology world, thus requiring a domain-specific approach. DIDS components are described in terms of their functionality, operation, integration, and management. Moreover, system evaluation and validation are undertaken within an especially designed hybrid testbed emulating the SCADA system for an electrical distribution grid.

Programmable Logic Controller (PLC) technology plays an important role in the automation architectures of several critical infrastructures such as Industrial Control Systems (ICS), controlling equipment in contexts such as chemical processes, factory lines, power production plants or power distribution grids, just to mention a few examples. Despite their importance, PLCs constitute one of the weakest links in ICS security, frequently due to reasons such as the absence of secure communication mechanisms, authenticated access or system integrity checks. While events such as the Stuxnet worm have raised awareness for this problem, industry has slowly reacted, either due to reliability or cost concerns. This paper introduces the Shadow Security Unit, a low-cost device deployed in parallel with a PLC or Remote Terminal Unit (RTU), being capable of transparently intercepting its communications control channels and physical process I/O lines to continuously assess its security and operational status. The proposed device does not require significant changes to the existing control network, being able to work in standalone or integrated within an ICS protection framework.

Abstract From an internet service provider's (ISP) perspective, modern broadband access networks pose significant and ever increasing challenges in terms of security management. The growing number of permanently connected home networks, with a myriad of poorly managed devices, imposes significant security risks not only to the domestic customers, unable to defend themselves from security attacks, but also to the ISP and third‐parties potentially targeted by large‐scale distributed botnet attacks fed by swarms of zombie domestic personal computers. In this context, the traditional delimitation of customer and ISP perimeters is no longer effective. Home networks became too complex and vulnerable to be autonomously managed by the average customer, and the scale and sophistication of distributed security attacks make it more and more difficult for the ISP to properly manage security without intervening outside the boundaries of its own network. Considering this state of affairs, we propose an alternative architecture for security management. This architecture increases the level of integration and cooperation between the domains of the ISP infrastructure and the home network. At the same time, it potentially improves the scalability and granularity of traditional intrusion detection and prevention mechanisms. Copyright © 2015 John Wiley & Sons, Ltd.

Machine-to-Machine technology supports several application scenarios, such as smart metering, automotive, healthcare and city monitoring. Smart metering applications have attracted the interest of companies and governments since these applications bring many benefits (e.g. costs reduction and increased reliability) for production, monitoring and distribution of utilities, such as gas, water and electricity. Multi-hop wireless communication is a cost-effective technology for smart metering applications because it extends the wireless range and enables fast deployment. Smart metering data communicated via wireless multi-hop approaches needs mechanisms that makes the communication less vulnerable to security threats and saves the device resources. Data encryption and data aggregation mechanisms emerge as potential solutions to fulfill these requirements. However, the simultaneous execution of data encryption and data aggregation mechanisms is not a trivial task. This is because the data encryption prevents the data aggregation mechanism to summarize the data along the path. Another challenge is to manage both mechanisms according to the concurrent Machine-to-Machine (M2M) applications interests. In this context, we present sMeter, which is a framework that deals with multiple applications interests, avoiding interest conflicts of concurrent users and supporting the management of data aggregation and data encryption. sMeter is implemented using low-cost hardware in an indoor environment. The communication is performed via a wireless multi-hop technology, and the performance of this communication is evaluated in terms of delay, data reception ratio and received signal strength indication.

Despite the incommensurable effort made from across computer sciences disciplines to provide more secure systems, compromising the security of a system has now become a very common and stark reality for organizations of all sizes and from a variety of sectors. The lax in the technology has often been cited as the salient cause of systems insecurity. In this paper we advocate the need for a Security Assurance (SA) system to be embedded within current IT systems. Such a system has the potential to address one facet of cyber insecurity, which is the exploit of lax within the deployed security and its underlining policy. We discuss the challenges associated to such an SA assessment and present the flavor of its evaluation and monitoring through an initial prototype. By providing indicators on the status of a security matter that is more and more devolved to the provider as it is the case in the cloud, the SA tool can be used as a means of fostering better security transparency between a cloud provider and client.

Together with the developments in terms of broadband connectivity and IP-based service consolidation, the introduction of cloud technologies is opening a whole new window of opportunity for service and telecommunications operators alike, to improve and expand their service portfolio. In this line of thought, this paper presents an innovative proposal to improve the delivery of IPTV services for residential users. It departs from the existing model, based on fat Set-Top Box (STB) appliances designed for specific IPTV frameworks, going instead for a solution that turns STBs into stateless devices, with the whole service interface being moved to the provider infrastructure. This thin-client STB-based service delivery model for IPTV, also includes the necessary management mechanisms to provision and configure the involved components. Overall, this approach is designed to enable providers to improve and simplify their IPTV delivery infrastructure, while maintaining backwards-compatibility with their existing Operations Support Systems.

The Universal Plug and Play (UPnP) protocol framework was conceived to allow seamless device discovery, control and configuration on domestic LANs, with minimum user intervention. It supports a wide range of devices, from printers to network equipment, having become an important mechanism for automatic configuration of devices within domestic LANs.

Integrated services delivered over broadband connections are becoming the norm in domestic households, as it is the case with triple-play bundles which offer combined Voice, Television and Data services delivered using IP-based technologies and protocols. As a result, the usage of SIP-based (Session Initiation Protocol) VoIP devices has known a significant growth in domestic environments, either in the form of standalone (e.g. SIP telephones) or embedded devices (as it happens with some domestic gateways, which embed analog-to-SIP adaptors). For Internet Service Providers (ISPs), the provisioning and management of those devices is a challenge — especially standalone SIP phones, since most of them were exclusively designed for corporate LAN usage, not supporting adequate mechanisms for remote management over broadband access networks. In this paper we propose a framework which allows the integration of off-the-shelf SIP phones with the CWMP protocol suite, the prevailing standard for remote management of Customer Premises Devices (CPEs) in broadband access networks. This integration framework supports the vast majority of commercially available SIP phones whilst maintaining full compatibility with the original CWMP specification — thus allowing ISPs to reuse their CWMP management infrastructure to configure and provision off-the-shelf SIP telephones.

Presently there is a lack of remote desktop management solutions for domestic and SOHO users connected to broadband access networks. This contrasts with the enterprise LAN environment, where there are several standards, resources and frameworks for PC or thin-client management. Among these, one specific remote boot technology the Preboot execution Environment (PXE) is now the basis for a wide array of LAN-wide desktop management applications. In this context, integrating PXE-based solutions into broadband access networks would allow novel management paradigms, targeting not just domestic end-users but also telecommuters working from their homes and small businesses which are too small for local deployment of full-fledged enterprise desktop management platforms. In this paper we propose a solution that brings the benefits of managed desktop computing to home users, telecommuters and small businesses by integrating PXE technologies into broadband access network environments. In addition, we also propose a desktop services delivery model capable of efficiently providing a secure and quality managed desktop experience to domestic and SOHO end-users, using a PXE-based thin-client platform for broadband environments that can replace a full-fledged PC whilst maintaining most of its benefits.

Broadband Forum's CPE Wan Management Protocol (CWMP/TR-069) became, in the last few years, a key industry standard for the management of devices that, despite located in the local network of domestic broadband users, still need to be directly managed by operators due to their relevance to added value services such as VoIP, IPTV, VoD or femtocell applications. Despite its relevance, the adoption of CWMP is still slow, in part because current CWMP applications do not cope well (yet) with the dynamic environment of domestic LANs, where the nature of topologies and services to be managed quickly evolves. In this paper we propose an extensible CWMP agent framework that, whilst keeping full compatibility with the original specification, allows it to better adapt to the home network environment, by incorporating the notion of extensible CWMP agents and proxying mechanisms.