Availability Based Risk Analysis for SCADA Embedded Computer Systems

Information Technology (IT) Security is often focused on Confidentiality, Integrity and Availability of software and data (information) contained in networked computers, servers and storage devices. In embedded industrial control or Supervisory Control and Data Acquisition (SCADA) systems the security focus must be on the protection of the availability of the system’s functions. This basic paradigm change of maintaining availability is not subtle and system protection cannot be met with the application of IT security measures alone. This paper advocates focusing on maintaining Availability and using Confidentiality and Integrity to secure an embedded control or SCADA system from attack. A risk assessment process to identify attacks on each system element’s availability is the first step to determining where protection mechanisms should be applied.