Evaluating Cascading Impact of Attacks on Resilience of Industrial Control Systems: A Design-Centric Modeling Approach

A design-centric modeling approach was proposed to model the behaviour of the physical processes controlled by Industrial Control Systems (ICS) and study the cascading impact of data-oriented attacks. A threat model was used as input to guide the construction of the CPS model where control components which are within the adversary's intent and capabilities are extracted. The relevant control components are subsequently modeled together with their control dependencies and operational design specifications. The approach was demonstrated and validated on a water treatment testbed. Attacks were simulated on the testbed model where its resilience to attacks was evaluated using proposed metrics such as Impact Ratio and Time-to-Critical-State. From the analysis of the attacks, design strengths and weaknesses were identified and design improvements were recommended to increase the testbed's resilience to attacks

Risk assessment methodologies for Critical Infrastructure Protection. Part I: A state of the art

Effective risk assessment methodologies are the cornerstone of a successful Critical Infrastructure Protection program. The extensive number of risk assessment methodologies for critical infrastructures clearly supports this argument. Risk assessment is indispensable in order to identify threats, assess vulnerabilities and evaluate the impact on assets, infrastructures or systems taking into account the probability of the occurrence of these threats. This is a critical element that differentiates a risk assessment from a typical impact assessment methodologyJRC.G.6-Security technology assessmen

Risk Assessment Methodology for Critical Infrastructure Protection

The European Programme for Critical Infrastructure Protection is the main vehicle for the protection of critical infrastructures in Europe. The Directive 2008/114/EC is the legislative instrument of this programme. Risk assessment is an important element that is mentioned throughout the Directive text. However, there is no harmonized methodology in Europe for the assessment of interconnected infrastructures. The present work describes such a methodology and its implementation for the assessment of critical infrastructures of European dimension. The methodology accounts for impact at asset level, evaluates the propagation of a failure at network level due to interdependencies and assess the economic impact of critical infrastructure disruption at national level.JRC.G.6-Security technology assessmen

Full Paper: Digital Resilience in Critical Infrastructures: A Systematic Literature Review

In times of disruptive events, effective response by organizations, critical systems, and society is paramount. The response process involves pre-event preparation, impact absorption, and system restoration, which together represent the concept of resilience. Critical infrastructures (CI) are essential to the functioning of society and require a high level of resilience to ensure that they can withstand and quickly recover from disruptive events. With the incorporation of Information Systems (IS) into CI, there is a need to study Digital Resilience to identify potential risks and develop strategies to mitigate them effectively. In this research, we conducted a Systematic Literature Review on Digital Resilience to understand its scope, and classified articles based on their scope, resilience dimensions, and phases they address, as well as interdependence between systems. We aim to contribute to the scientific understanding of Digital Resilience by analyzing existing gaps and proposing possible future research directions. This study provides an overview of the current state-of-the-art, the types of research conducted, and the resulting artifacts. Additionally, it introduces a new area of focus within the field of resilience: Digital Resilience

Assessing Resilience in Power Grids as a Particular Case of Supply Chain Management

Electrical power grids represent a critical infrastructure for a nation as well as strategically important. Literature review identified that power grids share basic characteristics with Supply Chain Management. This thesis presents a linear programming model to assess power grid resilience as a particular case of Supply Chain Management. Since resilient behavior is not an individual or specific system\u27s attribute but a holistic phenomenon based on the synergic interaction within complex systems, resilience drivers in power grids were identified. Resilience is a function of Reliability, Recovery Capability, Vulnerability and Pipeline Capacity. In order to embed heterogeneous variables into the model, parameterization of resilience drivers were developed. A principle of improving resilience through redundancy was applied in the model by using a virtual redundancy in each link which allows reliability improvement throughout the entire network. Vulnerability was addressed through the standard MIL-STD 882D, and mitigated through security allocation. A unique index (R) integrates the resilience complexity to facilitate alternate scenarios analysis toward strategic decision making. Decision makers are enabled to improve overall power grid performance through reliability development as well as security allocation at the more strategic links identified by the optimal solutions. Moreover, this tool lets decision makers fix grid variables such as reliability, reduced pipeline capacity, or vulnerabilities within the model in order to find optimal solutions that withstand disruptions. The model constitutes an effective tool not only for efficient reliability improvement but also for rational security allocation in the most critical links within the network. Finally, this work contributes to the federal government mandates accomplishment, intended to address electrical power-related risks and vulnerabilities

The role of urban built heritage in qualify and quantify resilience. Specific issues in Mediterranean city

The Mediterranean city represents a significant example of urban organism, based on masonry construction and characterized by typological processes of growth. The material consistency and the temporal continuity of built heritage in Mediterranean city make relevant its interpretation and analysis according to the resilient approach. The declination of this approach in many disciplines generated a substantial diversity among the definitions of resilience (Francis and Bekera, 2014). Consequently, frameworks, adopted for a quantitative or qualitative assessment, underline the lack of standardization and rigor in defining resilience measurements. A review of resilience literature and actual applications in urban context permit to understand that there are different operators working on the field: on the one hand there are international organizations, on the other hand there are academics. The review of both the two ambits of investigation intends to clarify specific properties and convergence points in order to trace an evolution of conceptual framework and to identify general features of urban resilience. This process is fundamental in focusing the main aims of the research program: the definition of the role of urban built heritage, given by the close correlation between masonry constructive technique, typologies and morphologies, its material value in urban system, and its relevance in Mediterranean city in constitution of urban resilience (UNISDR, 2012a). Despite an increasing number of academic studies concerning the role of built environment in defining and improving cities resilience, their major attention is still focused on street patterns and lifelines infrastructures. The paper concludes how the role of built heritage remains insufficiently explored and a correct definition of urban structure is still missing inside the domain of infrastructural resilience

Understanding and mitigating cascading crises in the global interconnected system

Cascading crises and disasters in the global interconnected system are emerging topics in today's disaster risk reduction research. The primary objective is improving the capability of our societies to cope with such events and mitigate their detrimental consequences through an evolved understanding of their nature. Rather than being merely considered as an outcome of low-probability/high-impact processes, cascading events can be associated with the cross-scale accumulation of vulnerability paths constituted by events waiting to happen. In this context, instead of focusing solely on triggering events, it seems important to point out the interactions orienting the escalation of secondary emergencies through vulnerability paths. This special issue integrates those emerging aspects with an operational approach that considers cascades as the complex, non-linear escalation of secondary emergencies. Key topics addressed by the contributions include: cross-domain modelling of interdependent systems; decision support systems; economic impact assessment of critical events; and cascades in the built environment, in social domains, and in applied emergency management. Our conclusions support the work of academia, and of public and private stakeholders, by providing a comprehensive analysis of the topic for the improvement of theory, the assessment of resilience, the formulation of policies for managing crises, and operational planning for emergencies