A framework for Operational Security Metrics Development for industrial control environment

Abstract

Security metrics are very crucial towards providing insights when measuring security states and susceptibilities in industrial operational environments. Obtaining practical security metrics depend on effective security metrics development approaches. To be effective, a security metrics development framework should be scopedefinitive, objective-oriented, reliable, simple, adaptable, and repeatable (SORSAR). A framework for Operational Security Metrics Development (OSMD) for industry control environments is presented, which combines concepts and characteristics from existing approaches. It also adds the new characteristic of adaptability. The OSMD framework is broken down into three phases of: target definition, objective definition, and metrics synthesis. A case study scenario is used to demonstrate an instance of how to implement and apply the proposed framework to demonstrate its usability and workability. Expert elicitation has also be used to consolidate the validity of the proposed framework. Both validation approaches have helped to show that the proposed framework can help create effective and efficient ICScentric security metrics taxonomy that can be used to evaluate capabilities or vulnerabilities. The understanding from this can help enhance security assurance within industrial operational environments.

Design and Analysis of Cyber Security Capability Maturity Model

“…Apart from the financial impact, there were other severe impacts on human life. Hospital systems got infected, and appointments for outpatients [1,2]. The motivation for protecting assets and mitigating threats is not always for fear of financial loss; there are behavioral, managerial, philosophical, and organizational aspects, too [3].…”

A Systematic Analysis of Security Metrics for Industrial Cyber–Physical Systems

“…Automatic generation: Used by Ani et al [14], i.e., a framework that generates specific security metrics after a preliminary study that analyzes the context and the security objectives of that field.…”