Critical Infrastructure Security Research Articles

Vulnerability of the Infrastructure: Risk Management and Implementation of the Information Systems

This article focuses on a comprehensive view of the connection between infrastructure, risks, and Geographic Information System (GIS). In the context of the current era, where critical infrastructure faces various threats and risks, it is essential to explore new methods and technologies that enable better identification, assessment, and management of these challenges. The first part of the article analyzes the current state of critical infrastructure and its connection to risks. Understanding how various threats, from natural disasters to cyber-attacks, affect infrastructure elements is crucial for effective protection and resilience. The second part examines the benefits and uses of Geographic Information Systems (GIS) in the context of risk assessment and management of critical infrastructure. GIS provides tools for collecting, analyzing, and visualizing spatial data, improving the ability to identify key risk areas and their interconnections. The results of this paper demonstrate how effectively linking these elements can enhance the resilience of critical infrastructure to various hazards.Overall, this article provides an overview of current trends in connecting infrastructure, risks, and Information Systems, emphasizing the importance of this comprehensive approach to ensuring the security and sustainability of critical infrastructure.

A novel approach detection for IIoT attacks via artificial intelligence

AbstractThe Industrial Internet of Things (IIoT) is a paradigm that enables the integration of cyber-physical systems in critical infrastructures, such as power grids, water distribution networks, and transportation systems. IIoT devices, such as sensors, actuators, and controllers, can provide various benefits, such as performance optimization, efficiency improvement, and remote management. However, these devices also pose new security risks and challenges, as they can be targeted by malicious actors to disrupt the normal operation of the infrastructures they are connected to or to cause physical damage or harm. Therefore, it is essential to develop effective and intelligent solutions to detect and prevent attacks on IIoT devices and to ensure the security and resilience of critical infrastructures. In this paper, we present a comprehensive analysis of the types and impacts of attacks on IIoT devices based on a literature review and a data analysis of real-world incidents. We classify the attacks into four categories: denial-of-service, data manipulation, device hijacking, and physical tampering. We also discuss the potential consequences of these attacks on the safety, reliability, and availability of critical infrastructures. We then propose an expert system that can detect and prevent attacks on IIoT devices using artificial intelligence techniques, such as rule-based reasoning, anomaly detection, and reinforcement learning. We describe the architecture and implementation of our system, which consists of three main components: a data collector, a data analyzer, and a data actuator. We also present a table that summarizes the main features and capabilities of our system compared to existing solutions. We evaluate the performance and effectiveness of our system on a testbed consisting of programmable logic controllers (PLCs) and IIoT protocols, such as Modbus and MQTT. We simulate various attacks on IIoT devices and measure the accuracy, latency, and overhead of our system. Our results show that our system can successfully detect and mitigate different types of attacks on IIoT devices with high accuracy and low latency and overhead. We also demonstrate that our system can enhance the security and resilience of critical infrastructures by preventing or minimizing the impacts of attacks on IIoT devices.

Transforming Cybersecurity into Critical Energy Infrastructure: A Study on the Effectiveness of Artificial Intelligence

This work explores the integration and effectiveness of artificial intelligence in improving the security of critical energy infrastructure, highlighting its potential to transform cybersecurity practices in the sector. The ability of artificial intelligence solutions to detect and respond to cyber threats in critical energy infrastructure environments was evaluated through a methodology that combines empirical analysis and artificial intelligence modeling. The results indicate a significant increase in the threat detection rate, reaching 98%, and a reduction in incident response time by more than 70%, demonstrating the effectiveness of artificial intelligence in identifying and mitigating cyber risks quickly and accurately. In addition, implementing machine learning algorithms has allowed for the early prediction of failures and cyber-attacks, significantly improving proactivity and security management in energy infrastructure. This study highlights the importance of integrating artificial intelligence into energy infrastructure security strategies, proposing a paradigmatic change in cybersecurity management that increases operational efficiency and strengthens the resilience and sustainability of the energy sector against cyber threats.

The Use of Means of Military Diplomacy in Providing Information Security as a Peacebuilding Factor

The research aims to determine the role of military diplomacy in providing information security as a key factor in building peace through the identification of key measures to counter information threats in the digital environment. The research employed the following methods: content analysis, rating analysis, and survey results processing. As a result of the conducted research, the place of digital diplomacy was determined concerning military diplomacy as a special form of its implementation to provide information security. The security of cyber-physical systems has been proven to be one of the most important approaches to data protection in military diplomacy because, among other things, the security of critical infrastructures depends on it. The research findings can be used by diplomatic service officers to increase the effectiveness of military diplomacy in the digital environment by implementing the proposed measures and directions in their activities.

STRATEGIC GUIDELINES AND THE ROLE OF HUMAN CAPITAL FOR RESTORATION OF THE FINANCIAL AND ECONOMIC SECURITY OF CRITICAL INFRASTRUCTURE IN THE CONDITIONS OF BANI WORLD AND INDUSTRY 4.0

The purpose of the study was to determine strategic guidelines and specify the role of human capital for restoring the financial and economic security of critical infrastructure in the conditions of BANI World and Industry 4.0. Method. In the research process, such methods were used as content analysis of scientific sources and literature, generalization, systematization and addition of the work of domestic and foreign scientists in the field of clarifying the role of human capital in the restoration of economic systems, as well as in establishing the influence of trends in the modern world on the quality of human capital and on its ability to positively influence the development of Ukraine's economy and the restoration of the financial and economic security of its critical infrastructure in the post-war period. A graphic method of visualization of individual provisions, assumptions and conclusions obtained in the research process is used. The results. It has been established that the financial and economic security of critical infrastructure facilities is an important economic characteristic of national security. A high level of financial and economic security of strategically important enterprises means their ability to withstand economic risks, to be independent of external financing, to carry out effective financial and economic activity even in a situation of significant resource limitations, which will certainly be characteristic of the post-war economy. Although European partners and the whole world promise Ukraine financial support in the process of its recovery after the war, critical infrastructure enterprises in the economic plane must be characterized by a high level of functional independence, and therefore, the problem of their financial and economic security must be solved at the levels of top management and the state without the involvement of third parties or organizations. The vectors of influence of Industry 4.0 and the world of BANI on the critical infrastructure of the state are summarized. The role of human capital in restoring the financial and economic security of critical infrastructure objects is outlined. Scientific novelty. Strategic guidelines for restoring the financial and economic security of critical infrastructure in the conditions of BANI World and Industry 4.0 are proposed. Practical significance. The proposals presented in the study can serve as a supplement to the state policy of post-war recovery and development of the economy of Ukraine in terms of managing its critical infrastructure and can be used by critical infrastructure objects when developing their own financial and economic security management strategies.

Security of critical infrastructure in Poland – selected aspects of research

Security of critical infrastructure in Poland – selected aspects of research

An Analysis of Cybersecurity Architectures

The 4th Industrial Revolution has increased high-capacity connectivity, new human-machine interactions largely with IoTs and smart devices. This digital revolution offers incredible conveniences such as the ability for users to access volumes of data, governments can address social challenges, connect remote villages in the country, and more. Once secluded systems are now connected and sharing information. This connectedness also poses some inconveniences as well, whenever a device joins the Internet, it becomes publicly discovered. Once these devices are discovered, they become open to cyberattacks. Cybersecurity has become a crucial part of daily life as cyberattacks have increased over time and have become more and more severe. The challenge that cybersecurity consultants find is the difficulty of measuring cybersecurity efforts in organizations. Another challenge could be finding a cybersecurity architecture that is effective and can fit different situations. The main aim of this study was to develop a comprehensive cybersecurity architecture that can be used by cybersecurity consultants when measuring cybersecurity effectiveness. This study conducted an in-depth literature review on current cybersecurity architectures offered by national and international cybersecurity organizations. The identified cybersecurity architectures that have been developed by other organizations were translated, interpreted, compared, and synthesized and a new cybersecurity architecture is proposed. The proposed cybersecurity architecture has the NIST goals as a foundation and the CIA triad at the center. The proposed cybersecurity architecture has domains such as application and Systems security, Information security, Network security, End-point security, Critical Infrastructure security, Mobile security, Storage security, etc. The proposed cybersecurity architecture seeks to assist cybersecurity consultants in answering questions from executives such as: Are we secure? Are security investments delivering value to the business? What is our preparedness for a cyberattack?

ЭФФЕКТИВНОСТЬ АВТОМАТИЗИРОВАННОГО УПРАВЛЕНИЯ ТРАНСПОРТНЫМИ СРЕДСТВАМИ В ТРАМВАЙНЫХ СИСТЕМАХ

The intellectualization of water transport is accompanied by an expansion of the landscape of threats to transport security, caused by the characteristics and weaknesses of the technologies being introduced, which are the convergence of information and telecommunication technologies, automated and automatic control technologies and artificial intelligence. The peculiarity of these technologies is working with large volumes of information. Violation of the security of information processed in intelligent systems of water transport (illegal access, modification, deletion and similar unauthorized influence) causes a violation of transport security and, as a consequence, the security of critical information infrastructure and the country’s critical infrastructure, national security. Convergent technologies used in intelligent transport systems are characterized by multiple and poorly formalized manifestations of the consequences of threats. The article presents a model for assessing the risks of information security of intelligent water transport systems, based on the methods of the theory of fuzzy sets and fuzzy logic, the use of which makes it possible to take into account the above-mentioned features of the technologies being implemented. The hierarchical structure of the model and the use of fuzzy set theory and fuzzy logic methods make it possible to adapt the model to various risk criteria, types of input data and the level of detail of risk analysis. For the presented model, a methodology for assessing information security risks has been developed and an example of risk calculation is given. The developed model and methodology are intended to build an information security risk management system for autonomous shipping, implementing technologies of hybrid (augmented, extended) intelligence, providing for the use of artificial intelligence controlled by people.

НЕЧЕТКАЯ СИСТЕМА ОЦЕНКИ РИСКОВ ИНФОРМАЦИОННОЙ БЕЗОПАСНОСТИ ИНТЕЛЛЕКТУАЛЬНЫХ СИСТЕМ ВОДНОГО ТРАНСПОРТА

The intellectualization of water transport is accompanied by an expansion of the landscape of threats to transport security, caused by the characteristics and weaknesses of the technologies being introduced, which are the convergence of information and telecommunication technologies, automated and automatic control technologies and artificial intelligence. The peculiarity of these technologies is working with large volumes of information. Violation of the security of information processed in intelligent systems of water transport (illegal access, modification, deletion and similar unauthorized influence) causes a violation of transport security and, as a consequence, the security of critical information infrastructure and the country’s critical infrastructure, national security. Convergent technologies used in intelligent transport systems are characterized by multiple and poorly formalized manifestations of the consequences of threats. The article presents a model for assessing the risks of information security of intelligent water transport systems, based on the methods of the theory of fuzzy sets and fuzzy logic, the use of which makes it possible to take into account the above-mentioned features of the technologies being implemented. The hierarchical structure of the model and the use of fuzzy set theory and fuzzy logic methods make it possible to adapt the model to various risk criteria, types of input data and the level of detail of risk analysis. For the presented model, a methodology for assessing information security risks has been developed and an example of risk calculation is given. The developed model and methodology are intended to build an information security risk management system for autonomous shipping, implementing technologies of hybrid (augmented, extended) intelligence, providing for the use of artificial intelligence controlled by people.

Cybersecurity In The Digital Age: Developing Robust Strategies To Protect Against Evolving Global Digital Threats And Cyber Attacks

In today's digital era, cyber security is a growing challenge, considering increasingly sophisticated cyber attacks and increasing global digital threats. These threats not only pose risks to individual privacy but also to the security of critical infrastructure and the country's economic interests. The need to develop a robust and adaptive cybersecurity strategy is critical to protecting digital assets and maintaining information security. This research aims to analyze the global cyber threat landscape and develop effective cyber security strategies to counter evolving digital threats. The method used is a descriptive qualitative approach by collecting and analyzing data from relevant previous studies. The results of the research show that an effective cybersecurity strategy requires an adaptive and innovative approach, utilizing the latest technology and cross-sector collaboration. The importance of international collaboration and human resource development in the field of cyber security was emphasized as a key factor in building stronger defenses against cyber attacks. Analysis of global cyber threats and their threat actors provides insight into the importance of cybersecurity education and awareness at all levels of organizations and society. The security strategy developed must be able to adapt to changes in technology and attack tactics to ensure effective protection. Cross-sector collaboration and the development of a strong cybersecurity ecosystem are the foundations for facing future cybersecurity challenges.

Cyber Security; Etiology and Importance

Background: Cyber Security is to protect online data and software from cyber threats. These cyberattacks are typically intended to gain access to, change, or delete sensitive information; extort money from users; or disrupt regular corporate activities. It is difficult to keep up a regular follow up with new technologies, so it is necessary to keep the important data safe from cyber threats. There are many types of cyber threats, malware, ransomware, social engineering, phishing etc. To prevent cyber-attacks one can, use password manager tools like LastPass and others. People also use two factor authentication for double security on their accounts. Methods: Boards such as the National Institute of Standards and Technology (NIST) are developing frameworks to assist firms in understanding their security risks, improving cybersecurity procedures, and preventing cyber assaults. The fight against cybercrimes and attack, organizations needed a strong base there are 5 types of cyber securities: Critical Infrastructure Security, application security, network security, cloud security and (IoT) Security. In the modern time the US is highly based on computers and on different software, so it is really important for the US to be more conscious about the security as they get many threats almost every day for hacking their data and accounts. Results and Conclusion: Nowadays, even small businesses rarely recover their loss from the cyber-attacks and many back-off from continuing their businesses after being target of hackers. The first cybercrime attack was recorded in 1988 by a graduate student. Now that large companies and even small businesses are aware of cyber-attacks, they try their best to take every precaution to prevent hacking with double security and password manager tools.

Analysis of terminology for identifying the risks of ensuring security and sustainability of critical information infrastructure in Ukraine

The article is devoted to the definition of the concept of risk in the context of ensuring safety and sustainability of critical information infrastructure in Ukraine. It has been specified that, in general, the risks, which may arise and affect critical information infrastructure objects of Ukraine, are a highly specialized subject matter of research searches. Therefore, there is no clear identification of the term «risk» in the context of the proposed public relations at the scientific level. It has been emphasized that the legislative doctrine also does not define its content and essence.
 The general theoretical and legal definition of the term «risk» has been analyzed. An attempt to differentiate its characteristics as a distinct legal phenomenon from related legal categories has been made.
 It has been summarized that the category of risk in the context of ensuring safety and sustainability of critical information infrastructure in Ukraine is a is a form of manifestation of danger caused by the presence of phenomena, factors, circumstances, events, etc., which can potentially have negative consequences on the course of public relations, functionality of objects or specific legally protected interests in this sphere. In addition, we have clarified that the category of threat should also be understood as a form of manifestation of danger, which is due to the presence of phenomena, factors, circumstances, events, etc., but only those that will damage safety and sustainability of critical information infrastructure in Ukraine in the future (in particular, if it is not neutralized, it will become a risk).
 It has been summarized that to ensure that potential risks in the field of critical information infrastructure protection do not become an actual problem, the State, in formulating its policy in this area, should clearly define, i.e. establish at the legislative level what is a risk to critical infrastructure in general and for information one – in particular. This is necessary to develop clear methodologies for monitoring and forecasting certain risks in the future to avoid their negative effects.

AICrit: A Design-Enhanced Anomaly Detector and Its Performance Assessment in a Water Treatment Plant

Critical Infrastructure Security Showdown 2021—Online (CISS2021-OL) represented the fifth run of iTrust’s international technology assessment exercise. During this event, researchers and experts from the industry evaluated the performance of technologies designed to detect and mitigate real-time cyber-physical attacks launched against the operational iTrust testbeds and digital twins. Here, we summarize the performance of an anomaly detection mechanism, named AICrit, that was used during the exercise. AICrit utilizes the plant’s design to determine the models to be created using machine learning, and hence is referred to as a “design-enhanced” anomaly detector. The results of the validation in this large-scale exercise reveal that AICrit successfully detected 95.83% of the 27 launched attacks. Our analysis offers valuable insights into AICrit’s efficiency in detecting process anomalies in a water treatment plant under a continuous barrage of cyber-physical attacks.

AI and Blockchain-Based Secure Data Dissemination Architecture for IoT-Enabled Critical Infrastructure.

The Internet of Things (IoT) is the most abundant technology in the fields of manufacturing, automation, transportation, robotics, and agriculture, utilizing the IoT's sensors-sensing capability. It plays a vital role in digital transformation and smart revolutions in critical infrastructure environments. However, handling heterogeneous data from different IoT devices is challenging from the perspective of security and privacy issues. The attacker targets the sensor communication between two IoT devices to jeopardize the regular operations of IoT-based critical infrastructure. In this paper, we propose an artificial intelligence (AI) and blockchain-driven secure data dissemination architecture to deal with critical infrastructure security and privacy issues. First, we reduced dimensionality using principal component analysis (PCA) and explainable AI (XAI) approaches. Furthermore, we applied different AI classifiers such as random forest (RF), decision tree (DT), support vector machine (SVM), perceptron, and Gaussian Naive Bayes (GaussianNB) that classify the data, i.e., malicious or non-malicious. Furthermore, we employ an interplanetary file system (IPFS)-driven blockchain network that offers security to the non-malicious data. In addition, to strengthen the security of AI classifiers, we analyze data poisoning attacks on the dataset that manipulate sensitive data and mislead the classifier, resulting in inaccurate results from the classifiers. To overcome this issue, we provide an anomaly detection approach that identifies malicious instances and removes the poisoned data from the dataset. The proposed architecture is evaluated using performance evaluation metrics such as accuracy, precision, recall, F1 score, and receiver operating characteristic curve (ROC curve). The findings show that the RF classifier transcends other AI classifiers in terms of accuracy, i.e., 98.46%.

The impact of educational training on improving the vigilance of public officials against cyber-attacks

Cybersecurity today is a phenomenon of global and multidimensional proportions. Protecting against cyber-attacks is a challenge for governments and the private sector. Increasing the security and protection of data and critical infrastructure against cyber-attacks is one of the essential factors of an institution that manages confidential data. The authors first present the findings from the research conducted regarding the skills that public officials have on various risks from cyber-attacks. The authors then present the results from testing the skills of public officials through the simulation of two cyber-attacks and the method applied by one public institution in Kosovo (as case study for this research is used Ministry of Internal Affairs - MIA) to raise the awareness of its officials about the various risks of cyber-attacks. Also, this paper focuses on analyzing the results before and after increasing the skills of MIA officials against cyber-attacks, as well as giving concrete recommendations from the results and analyses made. The presented results show that the applied method for raising the awareness of public officials on the risks of cyber-attacks has given impressive results. The obtained results are supported by statistics obtained from the conducted tests.

Problems and Prospects of Implementing Assessment of the Level of Maturity of Cyber Security Processes of Critical Infrastructure Objects of the Energy Sector of Ukraine in Accordance with the NIST Cybersecurity Framework

Existing problems regarding compliance with requirements in the field of cyber security of Ukraine's critical infrastructure in the energy sector, prospects for the implementation of the NIST Cybersecurity Framework and ways to solve the identified problems are described. The Ukrainian legislative framework was analyzed and compared with European and American practices, and the issue of compliance with the requirements of the legislation of various jurisdictions was determined.

Cyberterrorism: content, forms and promising countermeasures

The purpose of the study is to clarify the concept of cyber terrorism, its typical features and main forms, and to develop proposals for improving the system of countermeasures. The article highlights modern approaches to defining the content of cyber terrorism and its social and legal nature. This type of terrorism should be regarded as a socially dangerous politically motivated activity aimed at disrupting the critical information infrastructure of the State and thus creating a danger to human life and health or causing other serious consequences, provided that such actions were committed for terrorist purposes, or using cyberspace for other purposes of terrorist activities not directly related to terrorist acts.
 Typical features of cyber terrorism are described and a definition of its concept is proposed. The main forms of cyber terrorism are revealed: the commission of terrorist acts by organisations, groups and individuals using computers and computer networks or by influencing the information processed (circulated) in them, as well as the use of cyberspace for other purposes of terrorist activities not directly related to the commission of terrorist acts.
 The counteraction system may be based on the following: proper regulation of the concept of cyber terrorism in national legislation, criminalisation of acts of cyber terrorism and its components; enhancing the security and protection of critical information infrastructure; improving existing and applying new counteraction methods; improving cooperation in the field of combating cyber terrorism.

Розвиток парадигми резильєнтності в домені безпеки

A review of scientific publications aimed at determining the basis for the formation of the resili-ence paradigm in the security sphere is provided. The main stages of the evolution of the resili-ence paradigm in the context of security are considered, including its origin, development and multifactorial impact on the security of critical systems and infrastructures at different levels. The definitions, concepts, and key ideas underlying the paradigm are examined in detail, high-lighting the fundamental principles that contributed to its emergence. Special attention is paid to the constructs underlying the resilience paradigm in the security domain. Emphasis is placed on their practical implementation in frameworks and international legislation.

Enhancing Security in Cyber-Physical Critical Infrastructures A Focus on Detecting Integrity Attacks through Ensemble Modeling

Improving the safety of cyber-physical key assets is very important to keep their processes safe from attacks on their stability. In this study, we suggest a new way to find these kinds of threats using ensemble modeling methods. Integrity attacks are a big problem for these systems because they can change or control important data, which can have very bad results. Because these threats are so complex, traditional security measures often fail to spot them. This shows how important it is to have more advanced monitoring systems. The suggested method uses ensemble modeling, which blends several machine learning techniques to make identification more accurate. Ensemble modeling has shown promise in a number of defense contexts, providing resilience against different types of attacks. Ensemble approaches are good at finding integrity attacks that single models might miss because they use a variety of models, each with its own pros and cons. The study also talks about how different datasets can be used to teach ensemble models so that they can find a lot of different attack patterns. The study also looks at how to improve the ensemble's ability to find small changes from normal behavior by adding anomaly detection methods like Isolation Forest and Support Vector Machines (SVM). In general, this paper gives a complete plan for using ensemble models to make cyber-physical key systems safer. The suggested method aims to make these systems more resistant to integrity threats by using a variety of datasets and monitoring techniques. This will make sure that they work reliably and securely.

Current issues of the safety of the hospital – as a critical infrastructure

Aim: To explore the current security issues of in-patient care institutions from the perspective of critical infrastructure protection activities.Methodology: Examination of EU and national regulations on critical infrastructure, analysis of the legislative environment applicable to hospitals in security areas, based on practical experience.Findings: The regulation of critical infrastructure protection in the European Union and in Hungary is constantly evolving, and the development of further regulation affecting hospital safety is showing a mixed picture. The new EU Directive, which aims to increase resilience, will allow the introduction of standard methodological approaches that will impact on the complex security level of the hospital through the security of the patient care process.Value: The static operational critical infrastructure security planning practice has evolved over the past seven years, but further development of the planning methodology is needed to enable the organization to respond dynamically to the fundamental challenges of the healthcare sector and its ever-changing environment. To this purpose, standardized planning practices are available, applied and used in production at international level.