An Integrated Cyber Security Risk Management Approach for a Cyber-Physical System
Source abstract
Abstract
A cyber-physical system (CPS) is a combination of physical system components with cyber capabilities that have a very tight interconnectivity. CPS is a widely used technology in many applications, including electric power systems, communications, and transportation, and healthcare systems. These are critical national infrastructures. Cybersecurity attack is one of the major threats for a CPS because of many reasons, including complexity and interdependencies among various system components, integration of communication, computing, and control technology. Cybersecurity attacks may lead to various risks affecting the critical infrastructure business continuity, including degradation of production and performance, unavailability of critical services, and violation of the regulation. Managing cybersecurity risks is very important to protect CPS. However, risk management is challenging due to the inherent complex and evolving nature of the CPS system and recent attack trends. This paper presents an integrated cybersecurity risk management framework to assess and manage the risks in a proactive manner. Our work follows the existing risk management practice and standard and considers risks from the stakeholder model, cyber, and physical system components along with their dependencies. The approach enables identification of critical CPS assets and assesses the impact of vulnerabilities that affect the assets. It also presents a cybersecurity attack scenario that incorporates a cascading effect of threats and vulnerabilities to the assets. The attack model helps to determine the appropriate risk levels and their corresponding mitigation process. We present a power grid system to illustrate the applicability of our work. The result suggests that risk in a CPS of a critical infrastructure depends mainly on cyber-physical attack scenarios and the context of the organization. The involved risks in the studied context are both from the technical and nontechnical aspects of the CPS.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Smart Grid Security and Resilience · Information and Cyber Security · Infrastructure Resilience and Vulnerability Analysis
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
School of Architecture, Computing and Engineering, University of East London, London E16 2RD, UK
School of Computing, Media and Arts, Teesside University, Middleborough TS1 3BX, UK
References (41)
Show source-provided references
1. Wu, W., Kang, R., and Li, Z. (2015, January 21–23). Risk assessment method for cyber security of cyber physical systems. Proceedings of the 2015 First International Conference on Reliability Systems Engineering (ICRSE), Beijing, China.10.1109/ICRSE.2015.7366430 ↗
2. An overview and some challenges in cyber-physical systems
3. Abouzakhar, N. (2013, January 11–12). Critical Infrastructure Cybersecurity: A Review of Recent Threats and Violations. Proceedings of the European Conference on Information Warfare and Security, Jyväskylä, Finland.
4. Marvell, S. (2015). The Real and Present Threat of a Cyber Breach Demands Real-Time Risk Management, Acuity Risk Management.
5. Adar, E., and Wuchner, A. (2005, January 3–4). Risk management for critical infrastructure protection (CIP) challenges, best practices & tools. Proceedings of the First IEEE International Workshop on Critical Infrastructure Protection (IWCIP’05), Darmstadt, Germany.
6. Real-Time Cyber Security Risk Management10.1093/itnow/bwv097 ↗
7. Harvey, J., and Service, T.I. (2018, May 29). Introduction to Managing Risk. Available online: http://www.cimaglobal.com/Documents/ImportedDocuments/cid_tg_intro_to_managing_rist.apr07.pdf.
8. Georgieva, K., Farooq, A., and Dumke, R.R. (2009). Analysis of the Risk Assessment Methods–A Survey. International Workshop on Software Measurement, Springer.10.1007/978-3-642-05415-0_6 ↗
9. A review of cyber security risk assessment methods for SCADA systems10.1016/j.cose.2015.09.009 ↗
10. Quantitatively assessing the vulnerability of critical information systems: A new method for evaluating security enhancements10.1016/j.ijinfomgt.2008.01.009 ↗
11. Cyber-physical security testbeds: Architecture, application, and evaluation for smart grid10.1109/TSG.2012.2226919 ↗
12. Cárdenas, A.A., Amin, S., Lin, Z.S., Huang, Y.L., Huang, C.Y., and Sastry, S. (2011, January 22–24). Attacks against process control systems: Risk assessment, detection, and response. Proceedings of the 6th ACM Symposium on Information, Computer and Communications Security, Hong Kong, China.10.1145/1966913.1966959 ↗
13. Peng, Y., Lu, T., Liu, J., Gao, Y., Guo, X., and Xie, F. (2013, January 6–18). Cyber-physical system risk assessment. Proceedings of the Ninth International Conference on Intelligent Information Hiding and Multimedia Signal Processing, Beijing, China.10.1109/IIH-MSP.2013.116 ↗
14. Cardenas, A., Amin, S., Sinopoli, B., Giani, A., Perrig, A., and Sastry, S. (2009, January 23–24). Challenges for securing cyber physical systems. Proceedings of the Workshop on Future Directions in Cyber-Physical Systems Security, Newark, NJ, USA.
15. Cyber–physical system security for the electric power grid10.1109/JPROC.2011.2165269 ↗
16. Yoneda, S., Tanimoto, S., Konosu, T., Sato, H., and Kanai, A. (2015, January 2–4). Risk Assessment in Cyber-Physical System in Office Environment. Proceedings of the 2015 18th International Conference on Network-Based Information Systems (NBiS), Taipei, Taiwan.10.1109/NBiS.2015.63 ↗
17. Cybersecurity for critical infrastructures: Attack and defense modeling10.1109/TSMCA.2010.2048028 ↗
18. Spoofing-jamming attack strategy using optimal power distributions in wireless smart grid networks10.1109/TSG.2017.2664043 ↗
19. Dynamic energy-aware cloudlet-based mobile cloud computing model for green computing10.1016/j.jnca.2015.05.016 ↗
20. Gai, K., and Qiu, M. (2017). Blend arithmetic operations on tensor-based fully homomorphic encryption over real numbers. IEEE Trans. Ind. Inform.10.1109/CSCloud.2017.61 ↗
21. Ray, P.D., Harnoor, R., and Hentea, M. (2010, January 5–8). Smart power grid security: A unified risk management approach. Proceedings of the 2010 IEEE International Carnahan Conference on Security Technology (ICCST), San Jose, CA, USA.
22. Smart Grid Cyber Security and Risk Assessment: An Overview
23. Mitigating the risk of cyber attack on smart grid systems10.1016/j.procs.2014.03.070 ↗
24. ISO (2009). Risk Management—Principles and Guidelines, International Organization for Standardization. ISO 31000:2009.
25. GOST-R (2009). Risk Management. Risk Assessment Methods, International Organization for Standardization. ISO/IEC 31010-2011.
26. Cybersecurity, C.I. (2018, May 29). Framework for Improving Critical Infrastructure Cybersecurity, Available online: http:// www.nist.gov/sites/default/files/documents/cyberframework/cybersecurity-framework-021214.pdf.
27. ISO 31000:2009—Setting a new standard for risk management10.1111/j.1539-6924.2010.01442.x ↗
28. Islam, S., Fenz, S., Weippl, E., and Mouratidis, H. (2017). A Risk Management Framework for Cloud Migration Decision Support. J. Risk Financial Manag., 10.10.3390/jrfm10020010 ↗
29. An empirical study on the implementation and evaluation of a goal-driven software development risk management model10.1016/j.infsof.2013.06.003 ↗
30. Risk management: Procedures, methods and experiences
31. CISO (2018, May 29). Information Risk Assessment Handbook, Available online: http://www.nationalarchives.gov.uk/documents/information-management/risk-assessment-handbook.pdf.
32. AIRMIC, ALARM, and IRM (2010). A Structured Approach to Enterprise Risk Management (ERM) and the Requirements of ISO 31000, The Public Risk Management Association.
33. NERC, CIP (2006). Standards as Approved by the NERC Board of Trustees May 2006, North American Electric Reliability Corporation.
34. Bialas, A. (2016). Risk management in critical infrastructure—Foundation for its sustainable work. Sustainability, 8.10.3390/su8030240 ↗
35. Rahman, A.A.L.A., Islam, S., Kalloniatis, C., and Gritzalis, S. (2017). A Risk Management Approach for a Sustainable Cloud Migration. J. Risk Financial Manag., 10.10.3390/jrfm10040020 ↗
36. Review of cybersecurity issues in industrial critical infrastructure: Manufacturing in perspective10.1080/23742917.2016.1252211 ↗
37. Infrastructure Vulnerability Assessment Model (I-VAM)10.1111/j.1539-6924.2007.00907.x ↗
38. Foundations 2025: A value model for evaluating future air and space forces10.1287/mnsc.44.10.1336 ↗
39. Blank, R., and Gallagher, P. (2012). NIST Special Publication 800-30 Revision 1 Guide for Conducting Risk Assessments, National Institute of Standards and Technology. Technical Report.
40. Baldoni, R. (2018, May 29). Available online: http://www.dis.uniroma1.it/~tenace/download/deliverable/Deliverable4a.pdf.
41. Utne, I.B., Hokstad, P., Kjølle, G., Vatn, J., Tøndel, I., Bertelsen, D., Fridheim, H., and Røstum, J. (2008, January 6–7). Risk and vulnerability analysis of critical infrastructures-The DECRIS approach. Proceedings of the SAMRISK Conference, Oslo, Norway.