The cyber threat to industrial control systems is an acknowledged security issue, but a
qualified dataset to quantify the risk remains largely unavailable. Senior executives of
facilities that operate these systems face competing requirements for investment budgets,
but without an understanding of the nature of the threat cyber security may not
be a high priority. Operational managers and cyber incident responders at these facilities
face a similarly complex situation. They must plan for the defence of critical
systems, often unfamiliar to IT security professionals, from potentially capable, adaptable
and covert antagonists who will actively attempt to evade detection. The scope
of the challenge requires a coherent, enterprise-level awareness of the threat, such that
organisations can assess their operational priorities, plan their defensive posture, and
rehearse their responses prior to such an attack.
This thesis proposes a novel combination of concepts found in risk assessment,
intrusion detection, education, exercising, safety and process models, fused with experiential
learning through serious games. It progressively builds a common set of shared
mental models across an ICS operation to frame the nature of the adversary and establish
enterprise situational awareness that permeates through all levels of teams involved
in addressing the threat. This is underpinned by a set of coping strategies that identifies
probable targets for advanced threat actors, proactively determining antagonistic
courses of actions to derive an appropriate response strategy
