Evaluation of a Cyber Risk Assessment Approach for Cyber–Physical Systems: Maritime- and Energy-Use Cases

Abstract

In various domains such as energy, manufacturing, and maritime, cyber–physical systems (CPSs) have seen increased interest. Both academia and industry have focused on the cybersecurity aspects of such systems. The assessment of cyber risks in a CPS is a popular research area with many existing approaches that aim to suggest relevant methods and practices. However, few works have addressed the extensive and objective evaluation of the proposed approaches. In this paper, a standard-aligned evaluation methodology is presented and empirically conducted to evaluate a newly proposed cyber risk assessment approach for CPSs. The approach, which is called FMECA-ATT&CK is based on failure mode, effects and criticality analysis (FMECA) risk assessment process and enriched with the semantics and encoded knowledge in the Adversarial Tactics, Techniques, and Common Knowledge framework (ATT&CK). Several experts were involved in conducting two risk assessment processes, FMECA-ATT&CK and Bow-Tie, against two use cases in different application domains, particularly an autonomous passenger ship (APS) as a maritime-use case and a digital substation as an energy-use case. This allows for the evaluation of the approach based on a group of characteristics, namely, applicability, feasibility, accuracy, comprehensiveness, adaptability, scalability, and usability. The results highlight the positive utility of FMECA-ATT&CK in model-based, design-level, and component-level cyber risk assessment of CPSs with several identified directions for improvements. Moreover, the standard-aligned evaluation method and the evaluation characteristics have been demonstrated as enablers for the thorough evaluation of cyber risk assessment methods.

Fuzzy-Based Unified Decision-Making Technique to Evaluate Security Risks: A Healthcare Perspective

“…Similarly, Tables 5-8 show the fuzzy pair-wise comparison matrixes through the hierarchy at level 2. The researcher calculated the fuzzy weights of factors with the help of Equations ( 8)-( 10), and the weight of each element is calculated using Equations ( 11)- (13). Additionally, the BNP values (i.e., best non-fuzzy performance) of each attribute are calculated via Equation (14).…”

“…There is a significant necessity to the CIA triad: confidentiality must be included for highly sensitive data; integrity is essential because it may be fatal to provide an inaccurate procedure based on faulty medical data; and availability is also necessary because the data must be available on time for adequate treatment. In the medical field, the security and privacy of individual data are critical, and it is a major challenge to protect healthcare data [13].…”

Comprehensive Analysis of Maritime Cybersecurity Landscape Based on the NIST CSF v2.0

“…In a strategic approach, Lee et al [60] addressed the potential repercussions of a DDoS attacks on the ISO 19847:2018 [73] shipboard data server, proposing robust risk mitigation strategies. Lastly, Amro et al [61] introduced a hybrid approach called FMECA-ATT&CK for superior cyber risk assessment of cyber-physical systems in diverse settings. Together, these studies underscore the importance of tailored and context-specific risk assessment approaches for effectively managing cybersecurity in the maritime sector.…”

“…Assessment Ashraf et al (2023) [39], Charitos et al (2022) [40], Lee et al (2023) [41], Bolbot et al (2020) [42], Martinie(2021)[43], Yoo et al (2021) [44], Androjna et al (2020) [45], Bolbot et al (2023) [46], Melnyk et al (2023) [47], Soner et al (2024) [23], Park et al (2023) [48], Eichenhofer et al (2020) [49], Trimble et al (2017) [50], Poyhonen et al (2023) [51], Progoulakis et al (2022) [52], Weaver et al (2022) [53], Progoulakis et al (2021) [54], Gurren et al (2023) [55], Oruc et al (2024) [56], Kechagias et al (2022) [57], Putra et al (2023) [58], Illiashenko et al (2023) [59], Lee (2023) [60], Amro et al (2023)[61] …”