1. Model-Based Cybersecurity Analysis
- Author
-
Yuning Jiang, Manfred A. Jeusfeld, Jianguo Ding, and Elin Sandahl
- Subjects
Cybersecurity ,Datavetenskap (datalogi) ,Computer Sciences ,Domain-specific language ,Power grids ,Systemvetenskap, informationssystem och informatik ,Critical infrastructure ,Information Systems - Abstract
Critical infrastructure (CIs) such as power grids link a plethora of physical components from many different vendors to the software systems that control them. These systems are constantly threatened by sophisticated cyber attacks. The need to improve the cybersecurity of such CIs, through holistic system modeling and vulnerability analysis, cannot be overstated. This is challenging since a CI incorporates complex data from multiple interconnected physical and computation systems. Meanwhile, exploiting vulnerabilities in different information technology (IT) and operational technology (OT) systems leads to various cascading effects due to interconnections between systems. The paper investigates the use of a comprehensive taxonomy to model such interconnections and the implied dependencies within complex CIs, bridging the knowledge gap between IT security and OT security. The complexity of CI dependence analysis is harnessed by partitioning complicated dependencies into cyber and cyber-physical functional dependencies. These defined functional dependencies further support cascade modeling for vulnerability severity assessment and identification of critical components in a complex system. On top of the proposed taxonomy, the paper further suggests power-grid reference models that enhance the reproducibility and applicability of the proposed method. The methodology followed was design science research (DSR) to support the designing and validation of the proposed artifacts. More specifically, the structural, functional adequacy, compatibility, and coverage characteristics of the proposed artifacts are evaluated through a three-fold validation (two case studies and expert interviews). The first study uses two instantiated power-grid models extracted from existing architectures and frameworks like the IEC 62351 series. The second study involves a real-world municipal power grid. CC BY 4.0© 2023 Springer Nature Switzerland AG. Part of Springer Nature.Paper is partly based on the results of the EU ISF project ELVIRA, his.se/elviraWe thank the colleagues from the ELVIRA project for their contributions to earlier versions of the taxonomy. We are in particular grateful to Yacine Atif for his support and encouragement. Many thanks also to the interview partners for helping to validate the usefulness of our approach. Finally, we thank the anonymous reviewers for their diligent and constructive evaluationsOpen access funding provided by University of Skövde.
- Published
- 2023
- Full Text
- View/download PDF