Cyber-Informed Engineering

Abstract

Securing critical digital assets in an ever-changing threat landscape requires more than a dedicated team of cybersecurity professionals. Traditional static defense mechanisms like airgaps and reliance on obscure protocols and access mechanisms may not be sufficient for in-depth defense in an always-connected, information-rich cyber environment. Though technical solutions exist to protect availability, integrity and confidentiality of industrial control systems, these solutions typically secure external system boundaries and not the underlying digital systems themselves. Training engineering personnel in cybersecurity or training information technology specialists in engineering is expensive and often ineffective at addressing systemic vulnerabilities in large and complex digital systems. ENGINEERING LIFE CYCLE AND POST-BUILT DEFINITIONSCyber-informed engineering (CIE) can be used across the entire life cycle from conceptual design to decommissioning (using cyber and engineering controls) on non-digital and digital systems. The life-cycle phases are based on the IEEE 1220-2005 standard. C-1. CONCEPTUAL DESIGN PHASEConceptual design is the first step of any new engineering design. After the find for need, the idea is studied, evaluated, and budgeted to determine if the need is real. It is during this phase that provides the understanding of how the required systems will work, and the how behaviors and performance can be understood. C-2. REQUIREMENTS/SCHEMATIC PHASEThe requirements/schematic phase is when the development team develops the final product requirements. Information, such as technical and functional requirements and specifications are defined. C-3. DESIGN DEVELOPMENT PHASEThe design development phase is when the conceptual design ideas and the requirements information turn into documents such as blueprints where the required systems are described in architectural and engineering drawings and if needed, construction documents. C-4. COMPUTER SIMULATION PHASEA computer model of the proposed system may be developed and examined to ensure that all system requirements have been accurately determined.

Attack Surface Analysis of the Digital Twins interface with Advanced Sensor and Instrumentation Interfaces: Cyber Threat Assessment and Attack Demonstration for Digital Twins in Advanced Reactor Architectures

“…Cyber-Informed Engineering (CIE) is a methodology or approach that can be used by engineers to characterize the risks presented by the implementation of digital assets in control system environments and provides a strategy to apply engineering risk processes to mitigate those risks [47]. CIE is applied throughout the entire systems engineering lifecycle, from conceptual design to decommissioning.…”

Cyber-Informed Engineering for Nuclear Reactor Digital Instrumentation and Control

“…CIE is a multidisciplinary approach that advocates the use of CIE principles in each of the systems engineering lifecycle stages to ensure that cyber considerations are included in every aspect of design, testing, implementation, operation, maintenance, and disposal or decommissioning [36]. CIE is fundamentally a cyber risk management tool that complements existing OT cybersecurity risk standards and guidelines by incorporating engineering solutions along with ICT and OT cyber solutions to minimize risks from malicious and unintentional cyber incidents.…”

“…On the other hand, implementing engineering risk treatments during design stages can actually eliminate specifically identified risks by designing it out altogether or more efficiently and effectively reduce risk by incorporating security controls into the design. CIE principles adapted from [36].…”

Cyber-Informed Engineering Case Study of an Integrated Hydrogen Generation Plant

“…CIE is a multidisciplinary approach to integrating cybersecurity concepts into all phases of the systems engineering lifecycle. Using CIE provides stakeholders unfamiliar with cybersecurity practices the knowledge to incorporate risk management techniques to understand, eliminate, and/or mitigate cyber risks from the conceptual design phase through operation, maintenance, and disposal phases [12]. Considering and designing for cyber risks early in the lifecycle provides a simplified, more secure solution at lower cost.…”

“…Figure 3 illustrates CIE elements adapted from the framework provided by Anderson et al [12]. The CIE secure-bydesign elements are those fundamental cybersecurity engineering design practices and techniques that build cybersecurity and cyber-resilience into the system early in the lifecycle.…”