Analysis of Affordance, Time, and Adaptation in the Assessment of Industrial Control System Cybersecurity Risk

Abstract

Industrial control systems increasingly use standard communication protocols and are increasingly connected to public networks-creating substantial cybersecurity risks, especially when used in critical infrastructures such as electricity and water distribution systems. Methods of assessing risk in such systems have recognized for some time the way in which the strategies of potential adversaries and risk managers interact in defining the risk to which such systems are exposed. But it is also important to consider the adaptations of the systems' operators and other legitimate users to risk controls, adaptations that often appear to undermine these controls, or shift the risk from one part of a system to another. Unlike the case with adversarial risk analysis, the adaptations of system users are typically orthogonal to the objective of minimizing or maximizing risk in the system. We argue that this need to analyze potential adaptations to risk controls is true for risk problems more generally, and we develop a framework for incorporating such adaptations into an assessment process. The method is based on the principle of affordances, and we show how this can be incorporated in an iterative procedure based on raising the minimum period of risk materialization above some threshold. We apply the method in a case study of a small European utility provider and discuss the observations arising from this.

"How Long is a Piece of String":

“…Where we see "understanding the system" to be a key phase within the overall assessment process, it also presents a challenge to assessors. This is a salient point to which we experienced a similar reaction during some of our previous work [3,15]. Also, we see from the broader literature that this phase receives little attention from within the academic community [6].…”

“…While there are a number of established approaches to the assessment of risk, particularly within the standards community [2], it can be seen that their application to ICSs poses a challenge. Therefore, the development of tailored ICS specific approaches have been witnessed across both academic [3] and industry contexts [17]. Our previous work summarised a handful of approaches within existing industry standards and guidelines (S&G) [13], with the work of [20] and [6] providing more comprehensive discussions.…”

A disaster typology towards informing humanitarian relief supply chain design

“…At the extreme end of the spatial considerations, non-geographically bound systems (such as the internet) require minimal logistical capabilities, yet may require HRSC intervention due to the interconnectivity of critical infrastructure with the internet (Umberger and Gheorghe, 2011). Cyber-attacks can cripple infrastructure across non-geographically bound space (Paté-Cornell et al, 2017), particularly when such systems are connected to public assets (Busby et al, 2017). As such, HRSCs tasked with delivering aid to spatially dispersed communities will have vastly different design considerations to their counterparts servicing settings with higher population concentrations.…”

Adversarial Risk Analysis to Allocate Optimal Defense Resources for Protecting Cyber–Physical Systems from Cyber Attacks

“…In the context of military combat modeling, the effects of military deceit and of gaining insights into aggregating longer chains of military events were modeled (Roponen & Salo, ). Recently, Busby, Green, and Hutchison () analyzed the effects of cyber attacks on industrial control systems.…”