Analyzing security risks in critical infrastructures embedded in systems of systems: How to capture the impact of interdependencies

K. Stølen

Scholarly record

Analyzing security risks in critical infrastructures embedded in systems of systems: How to capture the impact of interdependencies

K. Stølen

Abstract

Our economy and national well-being is highly dependent on Critical Infrastructures (CIs). Today, CIs rely heavily on ICT and are often embedded within systems of systems. This makes CIs particularly vulnerable to security threats. In this paper we address the methodological challenge of how to estimate the impact that interdependencies within a System of Systems (SoS) have on the overall security risk picture of an embedded CI. becomes possible, at least in theory, to access the ICT systems from anywhere in the world. This makes information security (International Organization for Standardization 2005) a central part of Critical Infrastructure Protection (CIP), and this is also supported by numerous examples of ICT incidents in CIs, such as (Poulsen 2003, Poulsen 2004, Lemos 2007). Informally, an SoS may be thought of as a kind of “super system” comprised of a set of interconnected systems that work together towards some common goals. One example is the system consisting of the electrical grid and its supporting systems, such as telecommunication systems. Here the common goal is to provide electrical power. It is also an example of a CI embedded within an SoS. To assess the security of a CI within an SoS may be extremely challenging. Firstly, the individual systems in an SoS may be highly dependent. Secondly, the individual systems may be under different managerial control and within different jurisdictions. For the systems that are outside our control, we often have a limited knowledge of their security risks, structure, and behavior. In general, it is much easier to model and analyze intradependencies between systems that are controlled by the same party, than interdependencies between systems in an SoS, of which many we have only restricted documentation and control. In this paper we address these challenges. In particular, how to estimate the impact that interdependencies within an SoS have on the overall security risk picture of an embedded CI. The rest of the paper is structured as follows: In Section 2 we provide definitions for different types of dependencies. In Section 3 we demonstrate our

Similar items

Using Indicators to Monitor Security Risk in Systems of Systems: How to Capture and Measure the Impact of Service Dependencies on the Security of Provided Services
Scholarly record2016Olav Skjelkvåle Ligaarden
Systems of systems are collections of systems interconnected through the exchange of services. Their often complex service dependencies and very dynamic nature make them hard to analyze and predict with respect to quality in general, and security in particular. In this chapter, t
Security Requirements Driven Risk Assessment for Critical Infrastructure Information Systems
Scholarly record2005Seok-Won Lee, Robin A. Gandhi, Gail-Joon Ahn
Major information processing and associated value-added services provided by information systems in critical infrastructures are being increasingly used for various purposes irrespective of their security posture. Although several infrastructure-wide standard security Certificati
Performance, Robustness, and Cyber Security of Critical Infrastructure Systems – A Cyber-Physical Systems Research Theme
Scholarly record2008
Critical infrastructures are complex physical and cyber-based systems that form the lifeline of modern society, and their reliable and secure operation is of paramount importance to national security and economic vitality. The US President’s Commission on Critical Infrastructure
Critical infrastructure protection system design based on SCOUT multitech seCurity system for intercOnnected space control groUnd staTions
Open-access article2021International Journal of Critical Infrastructure Protection['Alessandro Cantelli-Forti', 'A. Capria', 'Anna Lisa Saverino', 'F. Berizzi', 'Davide Adami', 'Christian Callegari', '']
The security of the critical infrastructure requires increasing effort. protection must consider both: cyber-attack vectors, especially when IoT or hardware attacks are possibility, as well physical attack cheap unmanned vehicles pose a threat. In such scenarios, development more
MANAGING THE RISKS OF INFORMATION AND COMMUNICATION NETWORK IN THE CONTEXT OF PLANNING THE SECURITY OF CRITICAL INFRASTRUCTURE SYSTEMS
Open-access article2018Bulletin of NTU "KhPI". Series: Strategic Management, Portfolio, Program and Project ManagementRomanArtiukh, ViktorKosenko, OlgaMalyeyeva, EduardLysenko
A Process for the Identification of Security Risks from Critical Infrastructure Interdependencies
Scholarly record2013P. BERAUD, A. AHMAD
Traditional security risk assessment takes a broad asset-based view of organizations. The risk identification process therefore focuses on well-known threats and vulnerabilities to static and discrete assets that fall within the scope of organizational boundaries under investigat

Analyzing security risks in critical infrastructures embedded in systems of systems: How to capture the impact of interdependencies

Abstract

Similar items

Using Indicators to Monitor Security Risk in Systems of Systems: How to Capture and Measure the Impact of Service Dependencies on the Security of Provided Services

Security Requirements Driven Risk Assessment for Critical Infrastructure Information Systems

Performance, Robustness, and Cyber Security of Critical Infrastructure Systems – A Cyber-Physical Systems Research Theme

Critical infrastructure protection system design based on SCOUT multitech seCurity system for intercOnnected space control groUnd staTions

MANAGING THE RISKS OF INFORMATION AND COMMUNICATION NETWORK IN THE CONTEXT OF PLANNING THE SECURITY OF CRITICAL INFRASTRUCTURE SYSTEMS

A Process for the Identification of Security Risks from Critical Infrastructure Interdependencies