🎓 Lesson 13
D5
Attack Surface Scoring Using Connected Device Inventory
Attack surface scoring is a way to measure how exposed a mine’s power system is to cyberattacks by counting and rating all its connected devices.
🎯 Learning Objectives
- ✓ Calculate attack surface score for a given mine substation using device inventory and risk-weighting factors
- ✓ Analyze how device connectivity type (e.g., Modbus TCP vs. isolated RS-485) impacts individual device contribution to total score
- ✓ Explain the relationship between attack surface score thresholds and IEC 62443 security level (SL) requirements
- ✓ Apply NIST SP 800-82 guidance to identify high-scoring devices requiring immediate segmentation or hardening
📖 Why This Matters
In modern mines, power systems increasingly integrate IoT sensors, remote SCADA, and cloud-connected battery management systems—creating new pathways for cyber intrusion. A 2023 ICME report found that 78% of mining OT incidents originated from unsecured connected devices in energy infrastructure. Scoring the attack surface transforms abstract 'cyber risk' into an actionable, prioritized metric—enabling engineers to allocate limited hardening resources where they prevent cascading blackouts, equipment damage, or safety-critical failures.
📘 Core Principles
Attack surface scoring begins with comprehensive device inventory: every IP-addressable, serial-connected, or wireless-enabled component in the power system (e.g., protection relays, VFDs, solar inverters, grid-tie controllers). Each device is scored across three dimensions: (1) Exposure—how reachable it is (public internet, corporate network, or isolated OT segment); (2) Vulnerability—based on known CVEs, default credentials, or unsupported firmware; and (3) Criticality—its impact on power continuity, safety interlocks, or regulatory compliance. These are combined into a normalized 0–100 score per device, then aggregated using weighted summation—not simple addition—to reflect architectural hierarchy (e.g., a primary substation RTU contributes more than a local temperature sensor).
📐 Weighted Attack Surface Score (WASS)
The Weighted Attack Surface Score (WASS) aggregates device-level scores while accounting for network topology and functional criticality. It uses exponential decay weighting for downstream devices to avoid overcounting redundant exposures and emphasizes upstream control points.
Weighted Attack Surface Score (WASS)
WASS = Σ [w_i × ((E_i + V_i + C_i) / 3)]Aggregates normalized device risk scores using topology-based weights to quantify overall cyber exposure of mine power infrastructure.
Variables:
| Symbol | Name | Unit | Description |
|---|---|---|---|
| w_i | Topology weight for device i | dimensionless | Decay-weighted factor based on device position in network hierarchy (1.0 for upstream controllers, αⁿ for nth tier) |
| E_i | Exposure score for device i | 0–10 scale | Measures network accessibility: 0 = air-gapped, 10 = publicly routable IPv4 |
| V_i | Vulnerability score for device i | 0–10 scale | Based on CVSS v3.1 base score of known vulnerabilities, default credentials, or unsupported software |
| C_i | Criticality score for device i | 0–10 scale | Assesses impact on power continuity, personnel safety, environmental controls, or regulatory reporting |
Typical Ranges:
Low-risk mine site: 0 – 24
Medium-risk integrated operation: 25 – 45
High-risk automated mine with cloud integration: 46 – 100
💡 Worked Example
Problem: A mine’s 33 kV substation has: (1) RTU (Exposure=8, Vulnerability=6, Criticality=9), (2) 3x digital relays (each: E=5, V=4, C=7), (3) 12x smart meters (each: E=3, V=2, C=3). All devices are on same VLAN. RTU is upstream; relays are mid-tier; meters are leaf nodes. Use WASS with α=0.7 (decay factor) and base weight = 1.0 for RTU.
1.
Step 1: Compute base device score = (E + V + C) / 3 → RTU = (8+6+9)/3 = 7.67; Relay = (5+4+7)/3 = 5.33; Meter = (3+2+3)/3 = 2.67
2.
Step 2: Apply topology weights: RTU weight = 1.0; Relay weight = α¹ = 0.7; Meter weight = α² = 0.49
3.
Step 3: Aggregate: WASS = (1.0 × 7.67) + (3 × 0.7 × 5.33) + (12 × 0.49 × 2.67) = 7.67 + 11.19 + 15.69 = 34.55
Answer:
The total WASS is 34.55, which falls within the medium-risk range (25–45) per ICME Cyber Resilience Benchmark v2.1, indicating need for VLAN segmentation and relay firmware updates—but not urgent isolation.
🏗️ Real-World Application
At Vale’s Sossego copper mine (Pará, Brazil), engineers inventoried 217 connected devices across its 230 kV switchyard and onsite microgrid. Using WASS, they identified the SEL-751A feeder protection relay (connected via unsegmented Modbus TCP to corporate IT) as contributing 18.2 points—27% of total WASS (67.3). Post-scoring, they implemented a unidirectional data diode between relay and SCADA, updated firmware, and moved the relay to a dedicated OT VLAN—reducing total WASS to 41.1 and achieving IEC 62443-3-3 SL2 compliance.