A Cybersecurity Architecture to Mitigate Shamoon Attacks

Theyab Alrubaie; Wael Elmedany; Nedal Ababneh; Sherali Zeadally; Kevin Curran

doi:10.1109/3ICT56508.2022.9990865

A Cybersecurity Architecture to Mitigate Shamoon Attacks

Theyab Alrubaie, Wael Elmedany, Nedal Ababneh, Sherali Zeadally, Kevin Curran

School of Information Science

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

2 Scopus citations

Abstract

Shamoon attacks are one of the most recent Advanced Persistent Threat (APT) attacks that is being used against several organizations in the energy sector in Saudi Arabia. It is a very destructive malware that corrupts files on the targeted computer and overwrites the Master Boot Record (MBR) to render a computer unusable. In this paper, we propose an enhanced cybersecurity architecture that helps in the effort of halting the chain of attack at any stage and mitigate Shamoon attacks. Before that, we analyze the historical, tactical, and technical aspects of the Shamoon attacks. Our analysis explores the various methods of attack and the different stages through which the attackers achieve their penetration to the targeted organization network. By conducting such analysis, we reveal the weaknesses of the cybersecurity architecture that were exploited by the attackers.

Original language	English
Title of host publication	2022 International Conference on Innovation and Intelligence for Informatics, Computing, and Technologies, 3ICT 2022
Pages	266-277
Number of pages	12
ISBN (Electronic)	9781665451932
DOIs	https://doi.org/10.1109/3ICT56508.2022.9990865
State	Published - 2022
Event	2022 International Conference on Innovation and Intelligence for Informatics, Computing, and Technologies, 3ICT 2022 - Virtual, Online, Bahrain Duration: Nov 20 2022 → Nov 21 2022

Publication series

Name	2022 International Conference on Innovation and Intelligence for Informatics, Computing, and Technologies, 3ICT 2022

Conference

Conference	2022 International Conference on Innovation and Intelligence for Informatics, Computing, and Technologies, 3ICT 2022
Country/Territory	Bahrain
City	Virtual, Online
Period	11/20/22 → 11/21/22

Bibliographical note

Publisher Copyright:
© 2022 IEEE.

Keywords

Cybersecurity
Industrial Internet of Things
Internet of Things
Threats Mitigation

ASJC Scopus subject areas

Artificial Intelligence
Computer Networks and Communications
Computer Science Applications
Information Systems
Information Systems and Management
Control and Optimization

Access to Document

10.1109/3ICT56508.2022.9990865

Cite this

Alrubaie, T., Elmedany, W., Ababneh, N., Zeadally, S., & Curran, K. (2022). A Cybersecurity Architecture to Mitigate Shamoon Attacks. In 2022 International Conference on Innovation and Intelligence for Informatics, Computing, and Technologies, 3ICT 2022 (pp. 266-277). (2022 International Conference on Innovation and Intelligence for Informatics, Computing, and Technologies, 3ICT 2022). https://doi.org/10.1109/3ICT56508.2022.9990865

Alrubaie, Theyab ; Elmedany, Wael ; Ababneh, Nedal et al. / A Cybersecurity Architecture to Mitigate Shamoon Attacks. 2022 International Conference on Innovation and Intelligence for Informatics, Computing, and Technologies, 3ICT 2022. 2022. pp. 266-277 (2022 International Conference on Innovation and Intelligence for Informatics, Computing, and Technologies, 3ICT 2022).

@inproceedings{7e151c5fa26c4cf3b7431a1cb42c1d67,

title = "A Cybersecurity Architecture to Mitigate Shamoon Attacks",

abstract = "Shamoon attacks are one of the most recent Advanced Persistent Threat (APT) attacks that is being used against several organizations in the energy sector in Saudi Arabia. It is a very destructive malware that corrupts files on the targeted computer and overwrites the Master Boot Record (MBR) to render a computer unusable. In this paper, we propose an enhanced cybersecurity architecture that helps in the effort of halting the chain of attack at any stage and mitigate Shamoon attacks. Before that, we analyze the historical, tactical, and technical aspects of the Shamoon attacks. Our analysis explores the various methods of attack and the different stages through which the attackers achieve their penetration to the targeted organization network. By conducting such analysis, we reveal the weaknesses of the cybersecurity architecture that were exploited by the attackers.",

keywords = "Cybersecurity, Industrial Internet of Things, Internet of Things, Threats Mitigation",

author = "Theyab Alrubaie and Wael Elmedany and Nedal Ababneh and Sherali Zeadally and Kevin Curran",

note = "Publisher Copyright: {\textcopyright} 2022 IEEE.; 2022 International Conference on Innovation and Intelligence for Informatics, Computing, and Technologies, 3ICT 2022 ; Conference date: 20-11-2022 Through 21-11-2022",

year = "2022",

doi = "10.1109/3ICT56508.2022.9990865",

language = "English",

series = "2022 International Conference on Innovation and Intelligence for Informatics, Computing, and Technologies, 3ICT 2022",

pages = "266--277",

booktitle = "2022 International Conference on Innovation and Intelligence for Informatics, Computing, and Technologies, 3ICT 2022",

}

Alrubaie, T, Elmedany, W, Ababneh, N, Zeadally, S & Curran, K 2022, A Cybersecurity Architecture to Mitigate Shamoon Attacks. in 2022 International Conference on Innovation and Intelligence for Informatics, Computing, and Technologies, 3ICT 2022. 2022 International Conference on Innovation and Intelligence for Informatics, Computing, and Technologies, 3ICT 2022, pp. 266-277, 2022 International Conference on Innovation and Intelligence for Informatics, Computing, and Technologies, 3ICT 2022, Virtual, Online, Bahrain, 11/20/22. https://doi.org/10.1109/3ICT56508.2022.9990865

A Cybersecurity Architecture to Mitigate Shamoon Attacks. / Alrubaie, Theyab; Elmedany, Wael; Ababneh, Nedal et al.
2022 International Conference on Innovation and Intelligence for Informatics, Computing, and Technologies, 3ICT 2022. 2022. p. 266-277 (2022 International Conference on Innovation and Intelligence for Informatics, Computing, and Technologies, 3ICT 2022).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - A Cybersecurity Architecture to Mitigate Shamoon Attacks

AU - Alrubaie, Theyab

AU - Elmedany, Wael

AU - Ababneh, Nedal

AU - Zeadally, Sherali

AU - Curran, Kevin

PY - 2022

Y1 - 2022

N2 - Shamoon attacks are one of the most recent Advanced Persistent Threat (APT) attacks that is being used against several organizations in the energy sector in Saudi Arabia. It is a very destructive malware that corrupts files on the targeted computer and overwrites the Master Boot Record (MBR) to render a computer unusable. In this paper, we propose an enhanced cybersecurity architecture that helps in the effort of halting the chain of attack at any stage and mitigate Shamoon attacks. Before that, we analyze the historical, tactical, and technical aspects of the Shamoon attacks. Our analysis explores the various methods of attack and the different stages through which the attackers achieve their penetration to the targeted organization network. By conducting such analysis, we reveal the weaknesses of the cybersecurity architecture that were exploited by the attackers.

AB - Shamoon attacks are one of the most recent Advanced Persistent Threat (APT) attacks that is being used against several organizations in the energy sector in Saudi Arabia. It is a very destructive malware that corrupts files on the targeted computer and overwrites the Master Boot Record (MBR) to render a computer unusable. In this paper, we propose an enhanced cybersecurity architecture that helps in the effort of halting the chain of attack at any stage and mitigate Shamoon attacks. Before that, we analyze the historical, tactical, and technical aspects of the Shamoon attacks. Our analysis explores the various methods of attack and the different stages through which the attackers achieve their penetration to the targeted organization network. By conducting such analysis, we reveal the weaknesses of the cybersecurity architecture that were exploited by the attackers.

KW - Cybersecurity

KW - Industrial Internet of Things

KW - Internet of Things

KW - Threats Mitigation

UR - http://www.scopus.com/inward/record.url?scp=85146428754&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=85146428754&partnerID=8YFLogxK

U2 - 10.1109/3ICT56508.2022.9990865

DO - 10.1109/3ICT56508.2022.9990865

M3 - Conference contribution

AN - SCOPUS:85146428754

T3 - 2022 International Conference on Innovation and Intelligence for Informatics, Computing, and Technologies, 3ICT 2022

SP - 266

EP - 277

BT - 2022 International Conference on Innovation and Intelligence for Informatics, Computing, and Technologies, 3ICT 2022

T2 - 2022 International Conference on Innovation and Intelligence for Informatics, Computing, and Technologies, 3ICT 2022

Y2 - 20 November 2022 through 21 November 2022

ER -

Alrubaie T, Elmedany W, Ababneh N, Zeadally S, Curran K. A Cybersecurity Architecture to Mitigate Shamoon Attacks. In 2022 International Conference on Innovation and Intelligence for Informatics, Computing, and Technologies, 3ICT 2022. 2022. p. 266-277. (2022 International Conference on Innovation and Intelligence for Informatics, Computing, and Technologies, 3ICT 2022). doi: 10.1109/3ICT56508.2022.9990865

A Cybersecurity Architecture to Mitigate Shamoon Attacks

Abstract

Publication series

Conference

Bibliographical note

Keywords

ASJC Scopus subject areas

Access to Document

Other files and links

Fingerprint

Cite this