Denial of Service and Availability
Attacks that overwhelm or exhaust a system to make it unavailable, threatening the one security property control systems value most.
Attacking Availability
A denial-of-service (DoS) attack does not steal or alter data; it makes a system unavailable to its legitimate users by exhausting a resource, network bandwidth, connections, CPU, or memory. A distributed denial-of-service (DDoS) attack uses many machines at once, often a botnet, to amplify the flood. For control systems, where availability is the top priority, loss of availability can itself be a safety concern.
How the Attacks Work
- Volumetric: saturate network capacity with sheer traffic
- Protocol: exhaust connection tables or state with malformed or half-open requests
- Application: send requests that are cheap to make but expensive to serve
- Amplification: abuse services that reply with far more data than the request
Defenses
Availability is defended through overprovisioning and rate limiting, filtering and scrubbing malicious traffic upstream, distributing load across locations, and designing services to degrade gracefully rather than collapse. For critical systems, the most important defense is isolation: the systems that must stay available are kept off the paths where an internet-facing flood could reach them at all.
Availability Beyond Attacks
Denial of service is one cause of unavailability; hardware failure, misconfiguration, and overload are others. Resilience and redundancy address the whole spectrum, ensuring essential function survives whatever the cause.
Fusion Context
For the Hyperion breeder and burner control networks, the systems whose availability matters most are segmented away from internet-facing paths, so a flood cannot reach them. Crucially, the fail-safe design means that even a total loss of the control network does not create a hazard: the machine moves toward its safe state, and the independent safety instrumentation continues to protect it regardless of the availability of higher layers.