{"id":"https://openalex.org/W2996864715","doi":"https://doi.org/10.1145/3372318.3372323","title":"A Strategy for Security Testing Industrial Firewalls","display_name":"A Strategy for Security Testing Industrial Firewalls","publication_year":2019,"publication_date":"2019-12-10","ids":{"openalex":"https://openalex.org/W2996864715","doi":"https://doi.org/10.1145/3372318.3372323","mag":"2996864715"},"language":"en","primary_location":{"id":"doi:10.1145/3372318.3372323","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3372318.3372323","pdf_url":null,"source":null,"license":"public-domain","license_id":"https://openalex.org/licenses/public-domain","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the Fifth Annual Industrial Control System Security (ICSS) Workshop","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5103588664","display_name":"Thuy D. Nguyen","orcid":null},"institutions":[{"id":"https://openalex.org/I35364215","display_name":"Naval Postgraduate School","ror":"https://ror.org/033yfkj90","country_code":"US","type":"education","lineage":["https://openalex.org/I1330347796","https://openalex.org/I3130687028","https://openalex.org/I35364215"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Thuy D. Nguyen","raw_affiliation_strings":["Naval Postgraduate School"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Naval Postgraduate School","institution_ids":["https://openalex.org/I35364215"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5030544832","display_name":"Steve C. Austin","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Steve C. Austin","raw_affiliation_strings":[""],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"","institution_ids":[]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5113498499","display_name":"Cynthia E. Irvine","orcid":null},"institutions":[{"id":"https://openalex.org/I35364215","display_name":"Naval Postgraduate School","ror":"https://ror.org/033yfkj90","country_code":"US","type":"education","lineage":["https://openalex.org/I1330347796","https://openalex.org/I3130687028","https://openalex.org/I35364215"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Cynthia E. Irvine","raw_affiliation_strings":["Naval Postgraduate School"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Naval Postgraduate School","institution_ids":["https://openalex.org/I35364215"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.3823,"has_fulltext":false,"cited_by_count":3,"citation_normalized_percentile":{"value":0.54835011,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":89,"max":94},"biblio":{"volume":"1","issue":null,"first_page":"38","last_page":"47"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.9995999932289124,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9983999729156494,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/security-testing","display_name":"Security testing","score":0.8546684980392456},{"id":"https://openalex.org/keywords/vendor","display_name":"Vendor","score":0.7097105979919434},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.6095656752586365},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.6080152988433838},{"id":"https://openalex.org/keywords/documentation","display_name":"Documentation","score":0.566943883895874},{"id":"https://openalex.org/keywords/firewall","display_name":"Firewall (physics)","score":0.5501905679702759},{"id":"https://openalex.org/keywords/industrial-control-system","display_name":"Industrial control system","score":0.5398854613304138},{"id":"https://openalex.org/keywords/test-strategy","display_name":"Test strategy","score":0.4870608150959015},{"id":"https://openalex.org/keywords/black-box-testing","display_name":"Black-box testing","score":0.47246789932250977},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.45811620354652405},{"id":"https://openalex.org/keywords/fuzz-testing","display_name":"Fuzz testing","score":0.428548663854599},{"id":"https://openalex.org/keywords/security-controls","display_name":"Security controls","score":0.4272226095199585},{"id":"https://openalex.org/keywords/control","display_name":"Control (management)","score":0.31951212882995605},{"id":"https://openalex.org/keywords/cloud-computing-security","display_name":"Cloud computing security","score":0.2618885636329651},{"id":"https://openalex.org/keywords/security-information-and-event-management","display_name":"Security information and event management","score":0.16423261165618896},{"id":"https://openalex.org/keywords/cloud-computing","display_name":"Cloud computing","score":0.15720126032829285},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.10237300395965576},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.08933764696121216}],"concepts":[{"id":"https://openalex.org/C195518309","wikidata":"https://www.wikidata.org/wiki/Q13424265","display_name":"Security testing","level":5,"score":0.8546684980392456},{"id":"https://openalex.org/C2777338717","wikidata":"https://www.wikidata.org/wiki/Q1762621","display_name":"Vendor","level":2,"score":0.7097105979919434},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.6095656752586365},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6080152988433838},{"id":"https://openalex.org/C56666940","wikidata":"https://www.wikidata.org/wiki/Q788790","display_name":"Documentation","level":2,"score":0.566943883895874},{"id":"https://openalex.org/C77714075","wikidata":"https://www.wikidata.org/wiki/Q5452017","display_name":"Firewall (physics)","level":5,"score":0.5501905679702759},{"id":"https://openalex.org/C40071531","wikidata":"https://www.wikidata.org/wiki/Q2513962","display_name":"Industrial control system","level":3,"score":0.5398854613304138},{"id":"https://openalex.org/C188598960","wikidata":"https://www.wikidata.org/wiki/Q7705805","display_name":"Test strategy","level":3,"score":0.4870608150959015},{"id":"https://openalex.org/C24169984","wikidata":"https://www.wikidata.org/wiki/Q879969","display_name":"Black-box testing","level":5,"score":0.47246789932250977},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.45811620354652405},{"id":"https://openalex.org/C111065885","wikidata":"https://www.wikidata.org/wiki/Q1189053","display_name":"Fuzz testing","level":3,"score":0.428548663854599},{"id":"https://openalex.org/C178148461","wikidata":"https://www.wikidata.org/wiki/Q1632136","display_name":"Security controls","level":3,"score":0.4272226095199585},{"id":"https://openalex.org/C2775924081","wikidata":"https://www.wikidata.org/wiki/Q55608371","display_name":"Control (management)","level":2,"score":0.31951212882995605},{"id":"https://openalex.org/C184842701","wikidata":"https://www.wikidata.org/wiki/Q370563","display_name":"Cloud computing security","level":3,"score":0.2618885636329651},{"id":"https://openalex.org/C103377522","wikidata":"https://www.wikidata.org/wiki/Q3493999","display_name":"Security information and event management","level":4,"score":0.16423261165618896},{"id":"https://openalex.org/C79974875","wikidata":"https://www.wikidata.org/wiki/Q483639","display_name":"Cloud computing","level":2,"score":0.15720126032829285},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.10237300395965576},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.08933764696121216},{"id":"https://openalex.org/C74650414","wikidata":"https://www.wikidata.org/wiki/Q11397","display_name":"Classical mechanics","level":1,"score":0.0},{"id":"https://openalex.org/C162853370","wikidata":"https://www.wikidata.org/wiki/Q39809","display_name":"Marketing","level":1,"score":0.0},{"id":"https://openalex.org/C124017977","wikidata":"https://www.wikidata.org/wiki/Q11412","display_name":"Gravitation","level":2,"score":0.0},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.0},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.0},{"id":"https://openalex.org/C115304011","wikidata":"https://www.wikidata.org/wiki/Q72755","display_name":"Schwarzschild radius","level":3,"score":0.0},{"id":"https://openalex.org/C149091818","wikidata":"https://www.wikidata.org/wiki/Q2429814","display_name":"Software system","level":3,"score":0.0},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0},{"id":"https://openalex.org/C183915046","wikidata":"https://www.wikidata.org/wiki/Q1316152","display_name":"Charged black hole","level":4,"score":0.0},{"id":"https://openalex.org/C186846655","wikidata":"https://www.wikidata.org/wiki/Q3398377","display_name":"Software construction","level":4,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1145/3372318.3372323","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3372318.3372323","pdf_url":null,"source":null,"license":"public-domain","license_id":"https://openalex.org/licenses/public-domain","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the Fifth Annual Industrial Control System Security (ICSS) Workshop","raw_type":"proceedings-article"},{"id":"pmh:oai:calhoun.nps.edu:10945/65000","is_oa":false,"landing_page_url":"https://hdl.handle.net/10945/65000","pdf_url":null,"source":{"id":"https://openalex.org/S4306400952","display_name":"Calhoun: The Naval Postgraduate School Institutional Archive (Naval Postgraduate School)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I35364215","host_organization_name":"Naval Postgraduate School","host_organization_lineage":["https://openalex.org/I35364215"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":5,"referenced_works":["https://openalex.org/W111947461","https://openalex.org/W2036757496","https://openalex.org/W2112488900","https://openalex.org/W2147983543","https://openalex.org/W2618452333"],"related_works":["https://openalex.org/W3208265074","https://openalex.org/W2399088936","https://openalex.org/W4234658024","https://openalex.org/W2062583373","https://openalex.org/W114061091","https://openalex.org/W2980609145","https://openalex.org/W2766295568","https://openalex.org/W4323054491","https://openalex.org/W3153868358","https://openalex.org/W107788109"],"abstract_inverted_index":{"The":[0,112,142],"ability":[1],"to":[2,35,74],"secure":[3],"industrial":[4,26,41],"control":[5,161],"systems":[6],"(ICS)":[7],"against":[8],"adversaries":[9,34],"relies":[10],"on":[11,126],"defense":[12],"in":[13],"depth":[14],"and":[15,23,38,45,109,120,140,155],"implementation":[16],"of":[17,25,69,83,103],"security":[18,55,67,104],"controls.":[19],"However,":[20],"as":[21,85],"automation":[22],"networking":[24],"processes":[27],"increases,":[28],"so":[29],"do":[30],"the":[31,51,66,93,146],"opportunities":[32],"for":[33,101,153,159],"cause":[36],"destruction":[37],"disruption.":[39],"Many":[40],"firewalls":[42,52,73,80,157],"are":[43],"proprietary":[44],"often":[46],"users":[47],"blindly":[48],"trust":[49],"that":[50],"meet":[53],"vendor":[54],"claims.":[56,62],"Independent":[57],"testing":[58,68,99,143,156],"can":[59],"assess":[60],"these":[61,79],"This":[63],"paper":[64],"describes":[65],"two":[70,134],"commercial":[71],"ICS":[72],"determine":[75],"whether":[76],"or":[77],"not":[78],"provide":[81],"protection":[82],"resources":[84],"advertised.":[86],"Our":[87],"test":[88,113],"philosophy":[89],"is":[90,124,145],"guided":[91],"by":[92],"Flaw":[94],"Hypothesis":[95],"Methodology":[96],"(FHM)---a":[97],"penetration":[98,121],"technique":[100],"discovery":[102],"flaws":[105],"derived":[106],"from":[107],"documentation":[108],"other":[110],"evidence.":[111],"coverage":[114],"includes":[115],"functional":[116],"testing,":[117,119],"exception":[118],"testing.":[122],"Testing":[123],"conducted":[125],"a":[127,150],"simulated":[128],"natural":[129],"gas":[130],"compressor":[131],"system,":[132],"utilizing":[133],"open-source":[135],"vulnerability":[136],"analysis":[137],"tools,":[138],"Nessus":[139],"Metasploit.":[141],"methodology":[144],"first":[147],"step":[148],"toward":[149],"general":[151],"approach":[152],"selecting":[154],"intended":[158],"critical":[160],"systems.":[162]},"counts_by_year":[{"year":2024,"cited_by_count":1},{"year":2022,"cited_by_count":1},{"year":2020,"cited_by_count":1}],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2025-10-10T00:00:00"}