2

This work investigates the effect of interaction level, network type, and geographic location on the attractiveness of ICS honeypots. We deploy 16 honeypots, a mix of low- and high-interaction emulations and a physical PLC, across a corporate network and cloud networks in multiple geographic regions, and collect HTTP, S7Comm, and Modbus traffic over a three-month period. Our results show that, for ICS traffic, network type has the largest influence, while interaction level and geographic location have a limited impact. We also find that low-interaction honeypots capture traffic comparable to high-interaction setups, supporting their use for general threat intelligence collection. While most traffic consists of automated reconnaissance, filtering it reveals more complex activities, such as multi-stage campaigns, cross-environment scans, and device manipulation.

In this paper we present A2thOS, a framework to calculate the availability of partially outsourced IT services in the presence of SLAs and to achieve a cost-optimal choice of availability levels for outsourced IT components while guaranteeing a target availability level for the service.

In this paper we present the qualitative time dependency (QualTD) model and technique, which is meant to be employed together with standard RA methods for the qualitative assessment of availability risks based on the propagation of availability incidents in an IT architecture.