Enhancing the Safety, Security and Resilience of ICT and Scada Systems Using Action Research

Johnsen, Stig Ole; Skramstad, Torbjørn; Hagen, Janne Merete

doi:10.1007/978-3-642-04798-5_8

Cited by 10 publications

(7 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Key hazards impacting ICT/SAS used in integrated operations are the result of organizational, technical and human factors [8]. The hazards along with their mitigating resilience principles and associated resilience techniques are:…”

Section: Oil and Gas Production Systemsmentioning

confidence: 99%

Resilience in Risk Analysis and Risk Assessment

Johnsen

2010

Critical Infrastructure Protection IV

Self Cite

View full text Add to dashboard Cite

Resilience is the ability of a system to react to and recover from disturbances with minimal effects on dynamic stability. Resilience is needed as systems and organizations become more complex and interrelated and the consequences of accidents and incidents increase. This paper analyzes the notion of resilience based on a literature survey and an exploration of incidents. In particular, resilience involves the ability of systems to undergo graceful and controlled degradation, the ability to rebound from degradation, the presence of redundancy, the ability to manage margins close to the performance boundaries, the establishment and exploration of common mental models, the presence of flexibility in systems and organizations, and the reduction of complexity and coupling. The paper describes how resilience can be included in system development and operations by considering organizations, technology and human factors. Also, it shows how past strengths and weaknesses can be considered in risk analysis to enhance safety, security and resilience.

show abstract

Section: Oil and Gas Production Systemsmentioning

confidence: 99%

Resilience in Risk Analysis and Risk Assessment

Johnsen

2010

Critical Infrastructure Protection IV

Self Cite

View full text Add to dashboard Cite

show abstract

“…Among techno-centric resilience, specific attention has been devoted to those systems with a large Information Technology dimension (Haass et al 2015). For example, Johnsen et al (2009) aim at assessing the safety, security, and resilience of Information and Communication Technology (ICT) and Supervisory Control And Data Acquisition (SCADA) systems used in the Norwegian oil and gas industry through surveying 46 Norwegian offshore oil and gas installations. In the survey, Yes/No answers were possible, but respondents could also provide free-form comments.…”

Section: Techno-centric Resiliencementioning

confidence: 99%

“…A continuous trusted learning process is crucial for both organisations and communities. For these settings, it is frequently reported a poor risk awareness, as well as the absence of systematic knowledge sharing, and poor scenario training and emergency preparedness (Johnsen et al 2009). Solutions about organisations available in the literature refer to the preparation of inter-teams' meetings, where diverse personnel are involved (technicians, operators, managers, etc.…”

Section: Continuous Trusted Learningmentioning

confidence: 99%

Reviewing qualitative research approaches in the context of critical infrastructure resilience

2021

View full text Add to dashboard Cite

Modern societies are increasingly dependent on the proper functioning of critical infrastructures (CIs). CIs produce and distribute essential goods or services, as for power transmission systems, water treatment and distribution infrastructures, transportation systems, communication networks, nuclear power plants, and information technologies. Being resilient becomes a key property for CIs, which are constantly exposed to threats that can undermine safety, security, and business continuity. Nowadays, a variety of approaches exist in the context of CIs’ resilience research. This paper provides a state-of-the-art review on the approaches that have a complete qualitative dimension, or that can be used as entry points for semi-quantitative analyses. The study aims to uncover the usage of qualitative research methods through a systematic review based on PRISMA (Preferred Reporting Items for Systematic Reviews and Meta-Analyses). The paper identifies four principal dimensions of resilience referred to CIs (i.e., techno-centric, organisational, community, and urban) and discusses the related qualitative methods. Besides many studies being focused on energy and transportation systems, the literature review allows to observe that interviews and questionnaires are most frequently used to gather qualitative data, besides a high percentage of mixed-method research. The article aims to provide a synthesis of literature on qualitative methods used for resilience research in the domain of CIs, detailing lessons learned from such approaches to shed lights on best practices and identify possible future research directions.

show abstract

“…Ruighaver et al, 2007;van Niekerk and von Solms, 2010). Johnsen et al (2009) andJohnsen (2012) have made the first initial attempts to apply adaptive industrial safety management principles on issues related to information security by discussing how safety and security of control systems can be dealt with. The field of industrial safety is more mature when it comes to applying social science theories (step 4 and 5).…”

Section: Information Security Management and Industrial Safety Managementioning

confidence: 99%

Examining the suitability of industrial safety management approaches for information security incident management

Line

Albrechtsen

2016

Information &Amp; Computer Security

View full text Add to dashboard Cite

Purpose This paper discusses whether recent theoretical and practical approaches within industrial safety management might be applicable to, and solve challenges experienced in, the field of information security, specifically related to incident management.Design/methodology/approach Literature review. FindingsPrinciples, research, and experiences on the issues of plans, training, and learning in the context of industrial safety management would be suitable for adoption into the field of information security incident management and aid in addressing current challenges. Research limitations/implications (if applicable)There are a number of reasons why approaches from industrial safety management have something to offer to information security incident management: the former field is more mature and has longer traditions, there is more organizational research on industrial safety issues than on information security issues so far, individual awareness is higher for industrial safety risks, and worker participation in systematic industrial safety work is ensured by law. More organizational research on information security issues and continuous strengthening of individual security awareness would push information security to further maturity levels where current challenges are solved. Practical implications (if applicable)This paper shows that the field of information security incident management would gain from closer collaborations with industrial safety management, both in research and in practical loss prevention in organizations. The ideas discussed in this paper form a basis for further research on practical implementations and case studies. Originality/valueThe main audience of this paper includes information security researchers and practitioners, as they will find inspirational theories and experiences to bring into their daily work and future projects.

show abstract

Enhancing the Safety, Security and Resilience of ICT and Scada Systems Using Action Research

Cited by 10 publications

References 9 publications

Resilience in Risk Analysis and Risk Assessment

Resilience in Risk Analysis and Risk Assessment

Reviewing qualitative research approaches in the context of critical infrastructure resilience

Examining the suitability of industrial safety management approaches for information security incident management

Contact Info

Product

Resources

About