Cyber Risk in Industrial Control Systems

To enhance the security of any system, and to defend it effectively, one must understand the risk due to the potential for security failures in its computing and communications infrastructure. Practitioners in the cyber security field often identify three modes of failure: (1) breach of confidentiality, which is a failure to protect sensitive system information from unauthorized disclosure, (2) loss of availability, which is a failure to provide reliable access to system data for those users or machines that legitimately require it, and (3) violation of integrity, which is a failure to protect system data from unauthorized manipulation. A useful definition of cyber risk, then, is the potential for any of these failure modes and their corresponding consequences. In the case of industrial control systems (ICS), these consequences can extend into the physical domain.

[1]  Chuei-Tin Chang,et al.  Petri-Net models for risk analysis of hazardous liquid loading operations , 2002 .

[2]  Mathias Ekstedt,et al.  Empirical Analysis of System-Level Vulnerability Metrics through Actual Attacks , 2012, IEEE Transactions on Dependable and Secure Computing.

[3]  Tadao Murata,et al.  Petri nets: Properties, analysis and applications , 1989, Proc. IEEE.

[4]  Ole Martin Dahl,et al.  Using Coloured Petri Nets in Penetration Testing , 2005 .

[5]  Yacov Y Haimes,et al.  A comprehensive Network Security Risk Model for process control networks. , 2009, Risk analysis : an official publication of the Society for Risk Analysis.

[6]  Thomas Llansó,et al.  CyMRisk: An approach for computing mission risk due to cyber attacks , 2014, 2014 IEEE International Systems Conference Proceedings.

[7]  L. Shapley,et al.  Stochastic Games* , 1953, Proceedings of the National Academy of Sciences.

[8]  O. H. Brownlee,et al.  ACTIVITY ANALYSIS OF PRODUCTION AND ALLOCATION , 1952 .

[9]  Joel Veness,et al.  Monte-Carlo Planning in Large POMDPs , 2010, NIPS.

[10]  Richard Lippmann,et al.  Modeling Modern Network Attacks and Countermeasures Using Attack Graphs , 2009, 2009 Annual Computer Security Applications Conference.

[11]  Ulrich Berger,et al.  Brown's original fictitious play , 2007, J. Econ. Theory.

[12]  T. Basar,et al.  A game theoretic approach to decision and analysis in network intrusion detection , 2003, 42nd IEEE International Conference on Decision and Control (IEEE Cat. No.03CH37475).

[13]  William H. Sanders,et al.  RRE: A Game-Theoretic Intrusion Response and Recovery Engine , 2014, IEEE Trans. Parallel Distributed Syst..

[14]  Ryan M. Layer,et al.  Evaluating the risk of cyber attacks on SCADA systems via Petri net analysis with application to hazardous liquid loading operations , 2009, 2009 IEEE Conference on Technologies for Homeland Security.

[15]  Yacov Y. Haimes,et al.  Robust multiobjective dynamic programming:Minimax envelopes for efficient decisionmaking under scenariouncertainty , 2009 .

[16]  T. Basar,et al.  A game theoretic analysis of intrusion detection in access control systems , 2004, 2004 43rd IEEE Conference on Decision and Control (CDC) (IEEE Cat. No.04CH37601).

[17]  Duminda Wijesekera,et al.  Scalable, graph-based network vulnerability analysis , 2002, CCS '02.

[18]  W. Lovejoy.  A survey of algorithmic methods for partially observed Markov decision processes , 1991 .

[19]  Paul Ammann,et al.  A host-based approach to network attack chaining analysis , 2005, 21st Annual Computer Security Applications Conference (ACSAC'05).

[20]  Sushil Jajodia,et al.  Minimum-cost network hardening using attack graphs , 2006, Comput. Commun..

[21]  Xia Wang,et al.  Software fault tree and coloured Petri net-based specification, design and implementation of agent-based intrusion detection systems , 2007, Int. J. Inf. Comput. Secur..

[22]  T. E. S. Raghavan,et al.  Algorithms for stochastic games — A survey , 1991, ZOR Methods Model. Oper. Res..

[23]  Wolfgang Reisig.  Petri Nets: An Introduction , 1985, EATCS Monographs on Theoretical Computer Science.

[24]  Jeannette M. Wing,et al.  Game strategies in network security , 2005, International Journal of Information Security.

[25]  James P. McDermott,et al.  Attack net penetration testing , 2001, NSPW '00.

[26]  Wei Chen,et al.  Colored Petri Net Based Attack Modeling , 2003, RSFDGrC.

[27]  Y. Haimes.  Risk Modeling, Assessment, and Management: Haimes/Risk Modeling, Assessment 2e , 2005 .

[28]  Alain Finkel,et al.  The Minimal Coverability Graph for Petri Nets , 1991, Applications and Theory of Petri Nets.

[29]  Ryan M. Layer,et al.  Coupled Petri nets for computer network risk analysis , 2010, Int. J. Crit. Infrastructure Prot..

[30]  Javier Esparza,et al.  Decidability and Complexity of Petri Net Problems - An Introduction , 1996, Petri Nets.