Technical Cyber Threats in Undersea Infrastructure - Hartikainen, Hans (2025)
Subsea infrastructure (gas, data and electricity transmission) is integral to the functioning of societies and therefore has been subject of multiple (assumed) hybrid operations. In order to understand and safeguard against Cyber Threats, EU has funded and set up the VIGIMARE consortium, which is a key resource in multiple ways for this thesis. Furthermore, the results of these thesis will be used for the VIGIMARE project. Due to the importance of subsea infrastructure, various threat actors might be interested in attacking with whatever means at their disposal, including cyber. In order to understand and to safeguard against said threats, a analysis using a Cyber Threat Management Framework is conducted. The constituent steps are a System-of-Systems Description, Threat Actor Analysis, Vulnerability Analysis, which were conducted as a literature survey, and an Attack Model, which is a novel artifact done using a constructive research approach. The focusing on the technical aspects of cyber threats. In the System-of-System description, we abstract the commonalities between the different transmission types, such as use of SCADA (Supervisory Control And Data Acquisition), while also covering the differing aspects, such as key features of cables and pipes. For the Threat Actor Analysis, previously used classification regarding threat actors concerning critical infrastructure in general is adopted to reflect this particular setting (particularly in light of threat actor motivations), and updated in light of recent observations and trends. For the Vulnerability analysis, both Informational and Operational Technology concerns of system under consideration are considered, leveraging the MITRE ATT&CK classification, research done regarding SCADA vulnerabilities, and observations of recent trends. The Attack Model was constructed using a workshop method. The uses of said model include attack analysis, converting and storing observed attacks as data, and presenting example scenarios.