Mission-Based Analysis for Assessing Cyber Risk in Critical Infrastructure Systems

Abstract

Adversaries with the appropriate expertise and access can potentially exploit the large attack surface provided by the cyber component of critical infrastructure assets to target operations across the various sectors and significantly impact society. This paper describes a family of cyber risk methodologies known as "mission-based analysis" (MBA) that assist system designers in identifying the threats that pose the highest risk to mission execution and in prioritizing mitigation actions against the threats. This paper describes our experiences applying MBA and discusses its benefits and limitations. Also, it describes future enhancements of MBA and compares the approach with other assurance methodologies.

CyMRisk: An approach for computing mission risk due to cyber attacks

“…In CyMRisk, after an initial SME preparatory step, the rest of the steps occur in an automated fashion. We briefly summarize the approach here; see [2], [3] for details. To seed the process, SMEs consider the different types of cyber nodes in a target architecture.…”

“…To motivate the rationale for CyMRisk, we begin by introducing an example of a mission-cyber risk analysis methodology that could leverage CyMRisk called Mission Information Risk Analysis (MIRA) [2], [3]. One can regard MIRA as an instance of the risk framework developed by the National Standards of Standards and Technology (NIST) [4].…”

Estimating Software Vulnerability Counts in the Context of Cyber Risk Assessments

“…We therefore suggest caution in interpreting results from such assessments because the number of unknown vulnerabilities in large-scale software tends to exceed known vulnerabilities, and we furthermore suggest risk assessment methodologies should consider both known and unknown vulnerabilities, something not commonly done today, though there are exceptions. For example, as part of the risk analysis process, MIRA [30] hypothesizes the existence of latent vulnerabilities and analyzes their potential effects. The findings also support the concept that mission resilience to cyber attack should be nurtured and explored, as preventioncentric mitigation strategies are inherently disadvantaged given that latent vulnerabilities lie in wait for adversaries.…”

Emerging Risks: Methodology, Classification and Policy Implications

“…Wheat and rice alone account for almost half of the world's serial production. The third example relates to technical infrastructure (Kröger, 2008;Llanso, 2013) 13 . Human activities have become more and more interconnected and mutually dependent.…”