Document embargo till 13/10/2016.This paper reviews the state of the art in cyber security risk assessment of Supervisory Control and Data Acquisition (SCADA) systems. We select and in-detail examine twenty-four risk assessment methods developed for or applied in the context of a SCADA system. We describe the essence of the methods and then analyse them in terms of aim; application domain; the stages of risk management addressed; key risk management concepts covered; impact measurement; sources of probabilistic data; evaluation and tool support. Based on the analysis, we suggest an intuitive scheme for the categorisation of cyber security risk assessment methods for SCADA systems. We also outline five research challenges facing the domain and point out the approaches that might be taken.Peer reviewe

Information Assurance & Security (IAS) is a dynamic domain which changes continuously in response to the evolution of society, business needs and technology. This paper proposes a Reference Model of Information Assurance & Security (RMIAS), which endeavours to address the recent trends in the IAS evolution, namely diversification and deperimetrisation. The model incorporates four dimensions: Information System Security Life Cycle, Information Taxonomy, Security Goals and Security Countermeasures. In addition to the descriptive knowledge, the RMIAS embeds the methodological knowledge. A case study demonstrates how the RMIAS assists with the development and revision of an Information Security Policy Document.

Background Previous studies assessing the prevalence of COVID-19 sequelae in adults and children were performed in the absence of an agreed definition. We investigated prevalence of post-COVID-19 condition (PCC) (WHO definition), at 6- and 12-months follow-up, amongst previously hospitalised adults and children and assessed risk factors. Methods Prospective cohort study of children and adults with confirmed COVID-19 in Moscow, hospitalised between April and August, 2020. Two follow-up telephone interviews, using the International Severe Acute Respiratory and Emerging Infection Consortium survey, were performed at 6 and 12 months after discharge. Results One thousand thirteen of 2509 (40%) of adults and 360 of 849 (42%) of children discharged participated in both the 6- and 12-month follow-ups. PCC prevalence was 50% (95% CI 47–53) in adults and 20% (95% CI 16–24) in children at 6 months, with decline to 34% (95% CI 31–37) and 11% (95% CI 8–14), respectively, at 12 months. In adults, female sex was associated with PCC at 6- and 12-month follow-up (OR 2.04, 95% CI 1.57 to 2.65) and (OR 2.04, 1.54 to 2.69), respectively. Pre-existing hypertension (OR 1.42, 1.04 to 1.94) was associated with post-COVID-19 condition at 12 months. In children, neurological comorbidities were associated with PCC both at 6 months (OR 4.38, 1.36 to 15.67) and 12 months (OR 8.96, 2.55 to 34.82) while allergic respiratory diseases were associated at 12 months (OR 2.66, 1.04 to 6.47). Conclusions Although prevalence of PCC declined one year after discharge, one in three adults and one in ten children experienced ongoing sequelae. In adults, females and persons with pre-existing hypertension, and in children, persons with neurological comorbidities or allergic respiratory diseases are at higher risk of PCC.

No abstract

The actions carried out following any cyber-attack are vital in limiting damage, regaining control and determining the cause and those responsible. Within SCADA and ICS environments there is certainly no exception. Critical National Infrastructure (CNI) relies heavily on SCADA systems to monitor and control critical processes. Many of these systems span huge geographical areas and contain thousands of individual devices, across an array of asset types. When an incident occurs, those assets contain forensic artefacts, which can be thought of as any data that provides explanation to the current state of the SCADA system. Knowing what devices exist within the network and the tools and methods to retrieve data from them are some of the biggest challenges for incident response within CNI. This paper aims to identify those assets and their forensic value whilst providing the tools needed to perform data acquisition in a forensically sound manner. It will also discuss the key stages in which the incident response process can be managed.