Table Of ContentSokratis Katsikas · Frédéric Cuppens ·
Christos Kalloniatis · John Mylopoulos ·
Frank Pallas · Jörg Pohle · M. Angela Sasse ·
Habtamu Abie · Silvio Ranise · Luca Verderame ·
Enrico Cambiaso · Jorge Maestre Vidal ·
Marco Antonio Sotelo Monge ·
Massimiliano Albanese · Basel Katt ·
Sandeep Pirbhulal · Ankur Shukla (Eds.)
5
8
7
3
Computer Security
1
S
C
N
ESORICS 2022 International Workshops
L
CyberICPS 2022, SECPRE 2022, SPOSE 2022, CPS4CIP 2022,
CDT&SECOMANE 2022, EIS 2022, and SecAssure 2022
Copenhagen, Denmark, September 26–30, 2022
Revised Selected Papers
Lecture Notes in Computer Science 13785
FoundingEditors
GerhardGoos
JurisHartmanis
EditorialBoardMembers
ElisaBertino,PurdueUniversity,WestLafayette,IN,USA
WenGao,PekingUniversity,Beijing,China
BernhardSteffen ,TUDortmundUniversity,Dortmund,Germany
MotiYung ,ColumbiaUniversity,NewYork,NY,USA
TheseriesLectureNotesinComputerScience(LNCS),includingitssubseriesLecture
Notes in Artificial Intelligence (LNAI) and Lecture Notes in Bioinformatics (LNBI),
hasestablisheditselfasamediumforthepublicationofnewdevelopmentsincomputer
scienceandinformationtechnologyresearch,teaching,andeducation.
LNCSenjoysclosecooperationwiththecomputerscienceR&Dcommunity,the
seriescountsmanyrenownedacademicsamongitsvolumeeditorsandpaperauthors,and
collaborateswithprestigioussocieties.Itsmissionistoservethisinternationalcommu-
nitybyprovidinganinvaluableservice,mainlyfocusedonthepublicationofconference
andworkshopproceedingsandpostproceedings.LNCScommencedpublicationin1973.
Sokratis Katsikas · Frédéric Cuppens ·
Christos Kalloniatis · John Mylopoulos ·
Frank Pallas · Jörg Pohle · M. Angela Sasse ·
Habtamu Abie · Silvio Ranise · Luca Verderame ·
Enrico Cambiaso · Jorge Maestre Vidal ·
Marco Antonio Sotelo Monge ·
Massimiliano Albanese · Basel Katt ·
Sandeep Pirbhulal · Ankur Shukla
Editors
Computer Security
ESORICS 2022 International Workshops
CyberICPS 2022, SECPRE 2022, SPOSE 2022, CPS4CIP 2022,
CDT&SECOMANE 2022, EIS 2022, and SecAssure 2022
Copenhagen, Denmark, September 26–30, 2022
Revised Selected Papers
Editors
SokratisKatsikas FrédéricCuppens
NorwegianUniversityofScienceandTechnology PolytechniqueMontréal
Gjøvik,Norway Montreal,Canada
ChristosKalloniatis JohnMylopoulos
UniversityoftheAegean UniversityofToronto
Mytilene,Greece Toronto,ON,Canada
FrankPallas JörgPohle
TechnicalUniversityofBerlin AlexandervonHumboldtInstituteforInternet
Berlin,Germany andSociety
Berlin,Germany
M.AngelaSasse
RuhrUniversityBochum HabtamuAbie
Bochum,Germany NorwegianComputingCenter
Oslo,Norway
SilvioRanise
UniversityofTrento LucaVerderame
Trento,Italy UniversityofGenoa
Genoa,Italy
EnricoCambiaso
ConsiglioNazionaledelleRicerche(CNR) JorgeMaestreVidal
Genoa,Italy Indra
Alcobendas,Spain
MarcoAntonioSoteloMonge
Indra MassimilianoAlbanese
Alcobendas,Spain GeorgeMasonUniversity
Fairfax,VA,USA
BaselKatt
NorwegianUniversityofScienceandTechnology SandeepPirbhulal
Gjøvik,Norway NorwegianComputingCenter
Oslo,Norway
AnkurShukla
InstituteforEnergyTechnology
Halden,Norway
ISSN 0302-9743 ISSN 1611-3349 (electronic)
LectureNotesinComputerScience
ISBN 978-3-031-25459-8 ISBN 978-3-031-25460-4 (eBook)
https://doi.org/10.1007/978-3-031-25460-4
©TheEditor(s)(ifapplicable)andTheAuthor(s),underexclusivelicensetoSpringerNatureSwitzerlandAG2023
Chapters“InfluencingFactorsforUsers’PrivacyandSecurityProtectionBehaviorinSmartSpeakers:InsightsfromaSwiss
UserStudy”and“RebootingITSecurityAwareness–HowOrganisationsCanEncourageandSustainSecureBehaviours”
arelicensedunderthetermsoftheCreativeCommonsAttribution4.0InternationalLicense(http://creativecommons.org/lic
enses/by/4.0/).Forfurtherdetailsseelicenseinformationinthechapters.
Thisworkissubjecttocopyright.AllrightsarereservedbythePublisher,whetherthewholeorpartofthematerialis
concerned,specificallytherightsoftranslation,reprinting,reuseofillustrations,recitation,broadcasting,reproductionon
microfilmsorinanyotherphysicalway,andtransmissionorinformationstorageandretrieval,electronicadaptation,computer
software,orbysimilarordissimilarmethodologynowknownorhereafterdeveloped.
Theuseofgeneraldescriptivenames,registerednames,trademarks,servicemarks,etc.inthispublicationdoesnotimply,
evenintheabsenceofaspecificstatement,thatsuchnamesareexemptfromtherelevantprotectivelawsandregulationsand
thereforefreeforgeneraluse.
Thepublisher,theauthors,andtheeditorsaresafetoassumethattheadviceandinformationinthisbookarebelievedtobe
trueandaccurateatthedateofpublication.Neitherthepublishernortheauthorsortheeditorsgiveawarranty,expressedor
implied,withrespecttothematerialcontainedhereinorforanyerrorsoromissionsthatmayhavebeenmade.Thepublisher
remainsneutralwithregardtojurisdictionalclaimsinpublishedmapsandinstitutionalaffiliations.
ThisSpringerimprintispublishedbytheregisteredcompanySpringerNatureSwitzerlandAG
Theregisteredcompanyaddressis:Gewerbestrasse11,6330Cham,Switzerland
Preface
The 27th edition of the European Symposium on Research in Computer Security
(ESORICS) was held as a hybrid event in Copenhagen, Denmark, September 26–30,
2022.Inadditiontothemainconference,13workshopswereorganizedandheldinthe
sametimeperiod.
Thisvolumeincludestheacceptedcontributionsto7oftheseworkshops,asfollows:
(cid:129) the8thWorkshopontheSecurityofIndustrialControlSystemsandofCyber-Physical
Systems(CyberICPS2022);
(cid:129) the6thInternationalWorkshoponSecurityandPrivacyRequirementsEngineering
(SECPRE2022);
(cid:129) the 4th Workshop on Security, Privacy, Organizations, and Systems Engineering
(SPOSE2022);
(cid:129) the 3rd Cyber-Physical Security for Critical Infrastructures Protection (CPS4CIP
2022);
(cid:129) the 2nd International Workshop on Cyber Defence Technologies and Secure Com-
municationsattheNetworkEdge(CDT&SECOMANE2022).
(cid:129) the1stInternationalWorkshoponElectionInfrastructureSecurity(EIS2022);and
(cid:129) the1stInternationalWorkshoponSystemSecurityAssurance(SecAssure2022).
Whileeachoftheworkshopshadahigh-qualityprogramofitsown,theorganizers
optedforpublishingjointlytheproceedings;theseareincludedinthisvolume,which
contains39fullpapers.Theauthorsimprovedandextendedthesepapersbasedonthe
reviewers’feedbackaswellasthediscussionsattheworkshops.
We would like to thank each and every one who was involved in the organization
oftheESORICS2022workshops.SpecialthanksgototheESORICS2022Workshop
ChairsandtoalltheworkshoporganizersandtheirrespectiveProgramCommitteeswho
contributed to making the ESORICS 2022 workshops a real success. We would also
vi Preface
liketothanktheESORICS2022OrganizingCommitteeforsupportingtheday-to-day
operationandexecutionoftheworkshops.
October2022 SokratisKatsikas
FrédéricCuppens
JohnMylopoulos
ChristosKalloniatis
FrankPallas
JörgPohle
AngelaSasse
HabtamuAbie
SilvioRanise
LucaVerderame
EnricoCambiaso
JorgeMaestreVidal
MarcoAntonioSoteloMonge
MassimilianoAlbanese
JackDavidson
BaselKatt
SandeepPirbhulal
AnkurShukla
Contents
8th Workshop on Security of Industrial Control Systems and of
Cyber-PhysicalSystems(CyberICPS2022)
Towards Comprehensive Modeling of CPSs to Discover and Study
Interdependencies ..................................................... 5
AidaAkbarzadehandSokratisKatsikas
CoordinatedNetworkAttacksonMicrogridDispatchFunction:AnEPIC
CaseStudy ........................................................... 26
MuhammadRamadanSaifuddin, LinWei, HengChuanTan,
andBinbinChen
Adversarial Attacks and Mitigations on Scene Segmentation
ofAutonomousVehicles ................................................ 46
YuqingZhu,SridharAdepu,KushagraDixit,YingYang,andXinLou
Threat Sensitive Networking: On the Security of IEEE 802.1CB
and(un)EffectivenessofExistingSecuritySolutions ........................ 67
AdriaandeVos,AlessandroBrighente,andMauroConti
The Effects of the Russo-Ukrainian War on Network Infrastructures
ThroughtheLensofBGP .............................................. 81
ZisisTsiatsikas,GeorgiosKaropoulos,andGeorgiosKambourakis
Cybersecurity Awareness for Small and Medium-Sized Enterprises
(SMEs): Availability and Scope of Free and Inexpensive Awareness
Resources ............................................................ 97
SunilChaudhary,VasileiosGkioulos,andDavidGoodman
AFrameworkforDevelopingTabletopCybersecurityExercises .............. 116
NabinChowdhuryandVasileiosGkioulos
A Hybrid Dynamic Risk Analysis Methodology for Cyber-Physical
Systems .............................................................. 134
ChristosLyvas, KonstantinosMaliatsos, AndreasMenegatos,
ThrasyvoulosGiannakopoulos, CostasLambrinoudakis,
ChristosKalloniatis,andAthanasiosKanatas
viii Contents
6thInternationalWorkshoponSecurityandPrivacyRequirements
Engineering(SECPRE2022)
OntoCyrene:TowardsOntology-EnhancedAssetModellingforSupply
ChainsintheContextofCyberSecurity .................................. 157
MohammadHeydari, HaralambosMouratidis,
andVahidHeydariFamiTafreshi
MeasuringtheAdoptionofTLSEncryptedClientHelloExtensionandIts
ForebearintheWild ................................................... 177
ZisisTsiatsikas,GeorgiosKaropoulos,andGeorgiosKambourakis
4th Workshop on Security, Privacy, Organizations, and Systems
Engineering(SPOSE2022)
InfluencingFactorsforUsers’PrivacyandSecurityProtectionBehavior
inSmartSpeakers:InsightsfromaSwissUserStudy ....................... 195
FrankEbbersandMuratKaraboga
Towards a Security Impact Analysis Framework: A Risk-Based
andMITREAttackApproach ........................................... 212
AbdelhadiBelfadel,MartinBoyer,JérômeLetailleur,YohannPetiot,
andRedaYaich
DataProtectionOfficers’PerspectivesonPrivacyChallengesinDigital
Ecosystems ........................................................... 228
StephanWiefling,JanTolsdorf,andLuigiLoIacono
RebootingITSecurityAwareness–HowOrganisationsCanEncourage
andSustainSecureBehaviours .......................................... 248
M.AngelaSasse, JonasHielscher, JenniferFriedauer,
andAnnalinaBuckmann
3rdCyber-PhysicalSecurityforCriticalInfrastructuresProtection
(CPS4CIP2022)
TowardsReverseEngineeringofIndustrialPhysicalProcesses ............... 273
MarianoCeccato, YoussefDriouich, RuggeroLanotte,
MarcoLucchese,andMassimoMerro
Contents ix
Solutions for Protecting the Space Ground Segments: From Risk
AssessmenttoEmergencyResponse ..................................... 291
IliasGkotsis,LeonidasPerlepes,AggelosAggelis,KaterinaValouma,
AntonisKostaridis, EftichiaGeorgiou, NikolaosLalazisis,
andVasilikiMantzana
ModellingandSimulationofRailwayNetworksforResilienceAnalysis ....... 308
KushalSrivastava, CorinnaKöpke, JohannesWalter, KatjaFaist,
JohnMarschalkBerry,ClaudioPorretti,andAlexanderStolz
HoneyChart:AutomatedHoneypotManagementoverKubernetes ............ 321
GeorgeKokolakis, GrigorisNtousakis, IrodotosKaratsoris,
SpirosAntonatos,ManosAthanatos,andSotirisIoannidis
ComSEC:SecureCommunicationsforBaggageHandlingSystems ........... 329
FilipeApolinário, JoãoGuiomar, ÉricHervé, SvenHrastnik,
NelsonEscravana,MiguelL.Pardal,andMiguelCorreia
Methodology for Resilience Assessment for Rail Infrastructure
ConsideringCyber-PhysicalThreats ...................................... 346
CorinnaKöpke,JohannesWalter,ErosCazzato,CatalinLinguraru,
UliSiebold,andAlexanderStolz
Coverage-GuidedFuzzingofEmbeddedSystemsLeveragingHardware
Tracing .............................................................. 362
MaximilianBeckmannandJanSteffan
Challenges and Pitfalls in Generating Representative ICS Datasets
inCyberSecurityResearch ............................................. 379
AsyaMitseva, PaulThierse, HaraldHoffmann, DevranEr,
andAndriyPanchenko
Securing Cyber-Physical Spaces with Hybrid Analytics: Vision
andReferenceArchitecture ............................................. 398
DanielDePascale, MirellaSangiovanni, GiuseppeCascavilla,
DamianA.Tamburri,andWillem-JanVanDenHeuvel
APrecisionCybersecurityWorkflowforCyber-physicalSystems:The
IoTHealthcareUseCase ............................................... 409
FrancescoSpegni, AntonioSabatelli, AlessioMerlo, LuciaPepa,
LucaSpalazzi,andLucaVerderame
