Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

An Ontology-Based Approach to Security Risk Identification of Container Deployments in OT Contexts

Yannick Landeck, Dian Balta, Martin Wimmer, Christian Knierim

TL;DR

This work addresses security risk identification for container deployments in OT by introducing the Container Security Risk Ontology (CSRO), a modular, ontology-based model that links adversarial techniques, contextual assumptions, attack scenarios, risk rules, and container artefacts. Implemented as a knowledge graph with SPARQL-based risk calculation and a command-line tool, CSRO enables end-to-end, artefact-to-risk identification that is reproducible and adaptable to changing OT environments. A large-scale industrial OT case study demonstrates automated risk levels and executable risk treatments, illustrating the approach’s practical viability and integration potential with existing workflows (e.g., policy engines like OPA). The work lays a foundation for extending risk identification to host-level and organizational factors and suggests directions for reducing maintenance overhead and incorporating Generative AI to enhance usability and workflow integration.

Abstract

In operational technology (OT) contexts, containerised applications often require elevated privileges to access low-level network interfaces or perform administrative tasks such as application monitoring. These privileges reduce the default isolation provided by containers and introduce significant security risks. Security risk identification for OT container deployments is challenged by hybrid IT/OT architectures, fragmented stakeholder knowledge, and continuous system changes. Existing approaches lack reproducibility, interpretability across contexts, and technical integration with deployment artefacts. We propose a model-based approach, implemented as the Container Security Risk Ontology (CSRO), which integrates five key domains: adversarial behaviour, contextual assumptions, attack scenarios, risk assessment rules, and container security artefacts. Our evaluation of CSRO in a case study demonstrates that the end-to-end formalisation of risk calculation, from artefact to risk level, enables automated and reproducible risk identification. While CSRO currently focuses on technical, container-level treatment measures, its modular and flexible design provides a solid foundation for extending the approach to host-level and organisational risk factors.

An Ontology-Based Approach to Security Risk Identification of Container Deployments in OT Contexts

TL;DR

This work addresses security risk identification for container deployments in OT by introducing the Container Security Risk Ontology (CSRO), a modular, ontology-based model that links adversarial techniques, contextual assumptions, attack scenarios, risk rules, and container artefacts. Implemented as a knowledge graph with SPARQL-based risk calculation and a command-line tool, CSRO enables end-to-end, artefact-to-risk identification that is reproducible and adaptable to changing OT environments. A large-scale industrial OT case study demonstrates automated risk levels and executable risk treatments, illustrating the approach’s practical viability and integration potential with existing workflows (e.g., policy engines like OPA). The work lays a foundation for extending risk identification to host-level and organizational factors and suggests directions for reducing maintenance overhead and incorporating Generative AI to enhance usability and workflow integration.

Abstract

In operational technology (OT) contexts, containerised applications often require elevated privileges to access low-level network interfaces or perform administrative tasks such as application monitoring. These privileges reduce the default isolation provided by containers and introduce significant security risks. Security risk identification for OT container deployments is challenged by hybrid IT/OT architectures, fragmented stakeholder knowledge, and continuous system changes. Existing approaches lack reproducibility, interpretability across contexts, and technical integration with deployment artefacts. We propose a model-based approach, implemented as the Container Security Risk Ontology (CSRO), which integrates five key domains: adversarial behaviour, contextual assumptions, attack scenarios, risk assessment rules, and container security artefacts. Our evaluation of CSRO in a case study demonstrates that the end-to-end formalisation of risk calculation, from artefact to risk level, enables automated and reproducible risk identification. While CSRO currently focuses on technical, container-level treatment measures, its modular and flexible design provides a solid foundation for extending the approach to host-level and organisational risk factors.
Paper Structure (42 sections, 5 equations, 4 figures, 2 tables, 1 algorithm)

This paper contains 42 sections, 5 equations, 4 figures, 2 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Background and Motivation
  3. Software Containers in OT Contexts
  4. Importance of Security Risk Assessment
  5. Challenges in Security Risk Identification
  6. Challenges in Security Risk Identification
  7. C1: Complexity of Security Risk Identification
  8. C2: Need for Context-Specific Knowledge Exchange
  9. C3: Continuous System Changes
  10. Gaps in State-of-the-Art Approaches
  11. Research Design
  12. Evaluation Case Study
  13. Ontology Engineering
  14. Objectives of a Solution
  15. O1: Reproducible Security Risk Identification
  16. ...and 27 more sections

Figures (4)

  • Figure 1: Overview of our ontology-based approach to complement risk assessment for container deployments in OT contexts using the Container Security Risk Ontology (CSRO) and an integrated risk identification tool.
  • Figure 2: Overview of the five domains of our Container Security Risk Ontology (CSRO)
  • Figure 3: Core concepts and relationships in the Container Security Risk Ontology (CSRO). The ontology integrates five domains: ATT&CK Techniques (red, solid), Context Scenarios (green, dashed), Attack Scenarios (orange, wide-dotted), Risk Assessment Rules (purple, dotted), and Container Security Artefacts (grey, wide-dashed). Prefixes and namespace annotations are omitted.
  • Figure 4: CSRO knowledge graph instances of the shellcode injection technique for three context scenarios.