The risk of cyber attacks on process control networks (PCN) is receiving significant attention due to the potentially catastrophic extent to which PCN failures can damage the infrastructures and commodity flows that they support. Risk management addresses the coupled problems of (1) reducing the likelihood that cyber attacks would succeed in disrupting PCN operation and (2) reducing the severity of consequences in the event of PCN failure or manipulation. The Network Security Risk Model (NSRM) developed in this article provides a means of evaluating the efficacy of candidate risk management policies by modeling the baseline risk and assessing expectations of risk after the implementation of candidate measures. Where existing risk models fall short of providing adequate insight into the efficacy of candidate risk management policies due to shortcomings in their structure or formulation, the NSRM provides model structure and an associated modeling methodology that captures the relevant dynamics of cyber attacks on PCN for risk analysis. This article develops the NSRM in detail in the context of an illustrative example.

Human activities are defined and influenced by interdependent engineered and socioeconomic systems. In particular, the global economy is increasingly dependent on an interconnected web of infrastructures that permit hitherto unfathomable rates of information exchange, commodity flow and personal mobility. The interconnectedness and interdependencies exhibited by these infrastructures enable them to provide the quality of life to which we have become accustomed and, at the same time, expose seemingly robust and secure systems to risk to which they would otherwise not be subjected. This paper examines several analytical methodologies for risk assessment and management of interdependent macroeconomic and infrastructure systems. They include models for estimating the economic impact of disruptive events, describing complex systems from multiple perspectives, combining sparse data to enhance estimation, and assessing the risk of cyber attack on process control systems.

No abstract

No abstract

No abstract