Unified enterprise modelling language-based interoperability for collaborative access control framework in critical infrastructures

Abstract

Due to physical and logical vulnerabilities, a critical infrastructure (CI) can encounter failures of various degrees of severity, and since there are many interdependencies between CIs, simple failures can have dramatic consequences on the whole infrastructure. In this paper, we mainly focus on malicious threats that might affect the communication and information systems (the critical information infrastructure, or CII) dedicated to critical infrastructures. We define a new collaborative access control framework called PolyOrBAC, to address the security problems that are specific of CIIs. This approach offers each organisation taking part in the CII the capacity of collaborating with the other ones, while maintaining a control on its resources and on its internal security policy. The approach is demonstrated on a practical scenario, based on real emergency actions in an electric power grid infrastructure.

Framework for critical information infrastructure protection in smart government: a case study in Indonesia

“…Within the security objective dimension, the authors identify eight measurement variables (see Table 4). Confidentiality focuses on ensuring that physical and logical assets are only accessed by authorized individuals and verifying user identities (Baina et al , 2020; Eckel et al , 2021; Ramtohul and Soyjaudah, 2016). Integrity ensures that physical and logical assets can only be modified by authorized parties and tracks user actions related to accessed assets (Baina et al , 2020).…”

“…Confidentiality focuses on ensuring that physical and logical assets are only accessed by authorized individuals and verifying user identities (Baina et al , 2020; Eckel et al , 2021; Ramtohul and Soyjaudah, 2016). Integrity ensures that physical and logical assets can only be modified by authorized parties and tracks user actions related to accessed assets (Baina et al , 2020). Availability ensures that physical and logical assets are accessible for authorized use and includes auditability (Baina et al , 2020; Eckel et al , 2021; Ramtohul and Soyjaudah, 2016).…”

“…Integrity ensures that physical and logical assets can only be modified by authorized parties and tracks user actions related to accessed assets (Baina et al , 2020). Availability ensures that physical and logical assets are accessible for authorized use and includes auditability (Baina et al , 2020; Eckel et al , 2021; Ramtohul and Soyjaudah, 2016). Nonrepudiation confirms that users cannot deny their involvement in transactions related to physical and logical assets, and those transactions are traceable (Eckel et al , 2021).…”

“…The security function dimension comprises four elements with five variables. The first element, protection, encompasses preventive measures that aim to reduce security issues and deter criminal actors (Baina et al , 2020; Huang and Zhu, 2019). The detection element focuses on the ability to identify security issues (Cruz et al , 2016; Sahay et al , 2019).…”

“…In other studies, the development of security controls refers to standard security programs or enterprise architecture (EA) with complete security functions (ISO/IEC, 2013; Suter, 2007; NIST, 2018; Center for Internet Security, 2021). CII protection for several service providers results from developing EA (Baina et al , 2020; Erastus et al , 2020; Große et al , 2021; Ramtohul and Soyjaudah, 2016). Despite the variety of approaches for developing security control, the EA approach is more necessary for CII protection at the national level because EA accounts for threats, vulnerabilities, security principles and functions (Putro and Sensuse, 2021).…”