Gap-Analysis of Assurance Case-Based Cybersecurity Assessment: Technique and Case Study

Abstract

The subject matter of the article is the processes of cybersecurity assessment. The goal is to develop technique for gapanalysis of cybersecurity analysis process. The task to be solved is to develop a method for analyzing gaps in the process of assessment of non-functional requirements for safety and cybersecurity of ICS. It is based on the classification of requirements, taking into account the possibility of their decomposition, which includes the construction of an advanced security assurance and determination of countermeasures to address detected gaps. Conclusions. The scientific novelty of the results obtained is as follows: the method for ensuring the information security of digital components of the I&Cs was further developed by analyzing the discrepancies of requirements using vulnerability description procedures and assessing the severity of the intrusions consequences, as well as determining the set of countermeasures by the "security-cost" criterion, which makes it possible to reduce risks to an acceptable level.