Stuxnet: A Qualitative Risk Analysis and Enterprise Security Architecture

Running head: STUXNET
STUXNET
Name of the Student
Name of the University
Author note

1
STUXNET
Table of Contents
Introduction......................................................................................................................................2
Qualitative risk analysis...................................................................................................................4
Enterprise Security Architecture......................................................................................................6
The regulations................................................................................................................................9
Conclusion.......................................................................................................................................9
Reference:......................................................................................................................................11

2
STUXNET
Introduction
From the innovation of first computer-associated industrial control system devices, the
concern around the hardware and software vulnerabilities and potential security risk associate
with the devices are overwhelming. Stuxnet is a type of computer worm which infect industrial
control systems that are mainly utilized in infrastructure supporting facilities such as gas lines,
water treatment facility and power plants. This worms effects can be found in various region all
over the world, mostly in Iran, India and Indonesia. The Stuxnet warm first discovered in 2010
by security firm in a Belarus (Iasiello, 2014). The malware was designed to attack a particular
type of ICS specialty which is a nuclear plants for power or uranium enrichment. This warm has
the capability to spread through an air-gapped network by a removal disk such a thumb drives.
Industrial control systems are generally operated by assembly code on programmable logic
controllers. They are designed to work without any internet connection. To gain access over
PlCs, third parties must conduct reconnaissance(Gellman & Nakashima, 2013). However, every
PLC is designed differently, for integrates any PLC system attacker first needs ICS’s schematics.
This Schematics can also be stolen from inside by utilizing an early version of Stuxnet. Each
component of Stuxnet was implemented for specific reason and for the final goal of potentially
sabotage for the final goal of potentially sabotage for the final goal of potentially sabotaging the
ICS. Attackers create a mirror environment of the ICS hardware such as DLCs to test their code.
For infect the target ICS, removal disks are used to directly by some unknown third party such as
contractor who perhaps has the access over ICS. When Stuxnet infected in a system its spread in
search of field all over the organization. When stuxnet has the access over the target computer
it’s modify the PLC code which sabotage the whole system. The massive piece of malware
secretly mapped and monitored Iran’s computer networks, sending back a steady stream of

3
STUXNET
intelligence to prepare for a cyber-warfare campaign, according to the officials. The effort,
involving the National Security Agency, the CIA and Israel’s military, has included the use of
destructive software such as the Stuxnet virus to cause malfunctions in Iran’s nuclear enrichment
equipment (Singer, 2015). This malicious malware attacks in three phases. Firstly, it infect the
windows networks and system and make multiple replicate of itself. Then it search for out
Siemens Step7 software, which is also Windows-based and used to program industrial control
systems that operate equipment, such as centrifuges. Finally, it compromised the programmable
logic controllers.
1. Infection
Stuxnet infect system via an USB
device and proceeds to infect all
machines running Microsoft
Windows. By brandishing a digital
certificate that seems to show that it
comes from a reliable company, the
worm is able to evade automated-
detection systems.
2. Search
Stuxnet then checks whether a
given machine is part of the
targeted industrial control system
made by seimens. Such systems are
deployed in Iran to run high-speed
centrifuges that help to enrich
nuclear fuel.
3. Update
If the system is not a
target. Stuxnet is
unable to do any
damage. It will try to
access the internet to
download a more
recent version of itself.