Critical Infrastructure Cybersecurity Research Articles

Cyber security for critical national infrastructure

This article discusses the UK critical national infrastructure (CNI), its exposure to cyber risk, the measures and arrangements currently in force to address that risk and suggests some alternative and additional measures to which consideration might be given.

Regulatory approaches for cyber security of critical infrastructures: The case of Turkey

Critical infrastructures are vital assets for public safety, economic welfare and/or national security of countries. Today, cyber systems are extensively used to control and monitor critical infrastructures. A considerable amount of the infrastructures are connected to the Internet over corporate networks. Therefore, cyber security is an important item for the national security agendas of several countries. The enforcement of security principles on the critical infrastructure operators through the regulations is a still-debated topic. There are several academic and governmental studies that analyze the possible regulatory approaches for the security of the critical infrastructures. Although most of them favor the market-oriented approaches, some argue the necessity of government interventions. This paper presents a three phased-research to identify the suitable regulatory approach for the critical infrastructures of Turkey. First of all, the data of the critical infrastructures of Turkey are qualitatively analyzed, by using grounded theory method, to extract the vulnerabilities associated with the critical infrastructures. Secondly, a Delphi survey is conducted with six experts to extract the required regulations to mitigate the vulnerabilities. Finally, a focus group interview is conducted with the employees of the critical infrastructures to specify the suitable regulatory approaches for the critical infrastructures of Turkey. The results of the research show that the critical infrastructure operators of Turkey, including privately held operators, are mainly in favor of regulations.

Lightweight Acknowledgement-Based Method to Detect Misbehavior in MANETs

Due to an increasing number of cyberattacks globally, cybersecurity has become a crucial part of national security in many countries. In particular, the Digital Pearl Harbor has become a real and aggressive security threat, and is considered to be a global issue that can introduce instability to the dynamics of international security. Against this context, the cyberattacks that targeted nuclear power plants (NPPs) in the Republic of Korea triggered concerns regarding the potential effects of cyber terror on critical infrastructure protection (CIP), making it a new security threat to society. Thus, in an attempt to establish measures that strengthen CIP from a cybersecurity perspective, we perform a case study on the cyber-terror attacks that targeted the Korea Hydro & Nuclear Power Co., Ltd. In order to fully appreciate the actual effects of cyber threats on critical infrastructure (CI), and to determine the challenges faced when responding to these threats, we examine factual relationships between the cyberattacks and their responses, and we perform analyses of the characteristics of the cyberattack under consideration. Moreover, we examine the significance of the event considering international norms, while applying the Tallinn Manual. Based on our analyses, we discuss implications for the cybersecurity of CI in South Korea, after which we propose a framework for strengthening cybersecurity in order to protect CI. Then, we discuss the direction of national policies.

Building national cyber resilience and protecting critical information infrastructure

ABSTRACTThe digital transformation poses a challenge to all societies and economies, with Information and Communication Technologies forming a substrate for critical services and economic growth. National cyber policy-makers are faced with many priorities, including protecting critical infrastructure, reducing cybercrime, raising awareness, and following national security and foreign policy interests. The protection of critical services and infrastructure, fight against cybercrime, cyber incident response and recovery form a basis of nations’ cyber resilience in the digital era. In the light of recent cyber security regulations passed in the US and the European Union, the article offers an overview of how to organise and provide leadership for an efficient national cyber effort. It also discusses several methods from a public policy perspective of how to provide better cyber security for critical services and infrastructures.

An Experience Report on Education and Training Programme in Cybersecurity of Critical Infrastructures

An Experience Report on Education and Training Programme in Cybersecurity of Critical Infrastructures

Making Cybersecurity Effective: The Five Governing Principles for Implementing Practical IT Governance and Control

With any complex project deployment, a clearly understood and reliable infrastructure can only be substantiated through a rational and explicit planning process. This planning process is often described as information technology (IT) governance. Governance-based control infrastructures are valuable and can provide the basis for control over every form of organizational resource. Given the level of sophistication of malicious agents, an information and communication technology management control system with even one hole in it is a business catastrophe waiting to happen. Strong executive sponsorship is the prerequisite for effective IT governance and the proper way to establish information security is to engineer an array of interlocking best practices, from a commonly accepted model of best practice. Organizations must define substantive policies, assign roles and responsibilities, educate employees and describe and enforce accountability. This paper presents an understanding and mastery of five strategic principles of cybersecurity best practices based on the Framework for Improving Critical Infrastructure Cybersecurity (CSF).

Secure by Design: Cybersecurity Extensions to Project Management Maturity Models for Critical Infrastructure Projects

Many systems that comprise our critical infrastructures – including electricity, transportation, healthcare, and financial systems – are designed and deployed as information technology (IT) projects using project management practices. IT projects provide a one-time opportunity to securely cybersecurity to the IT components of critical infrastructures. The project management maturity models used by organizations today to assess the quality and rigour of IT project management practices do not explicitly consider cybersecurity. This article makes three contributions to address this gap. First, it develops the argument that cybersecurity can and should be a concern of IT project managers and assessed in the same way as other project management capabilities. Second, it examines three widely used cybersecurity maturity models – i) the National Institute of Science and Technology (NIST) framework for improving critical infrastructure cybersecurity, ii) the United States Department of Energy’s Cybersecurity Capability Maturity Model (C2M2), and iii) the CERT Resilience Management Model (CERT RMM) from the Carnegie Mellon Software Engineering Institute – to identify six cybersecurity themes that are salient to IT project management. Third, it proposes a set of cybersecurity extensions to PjM3, a widely-deployed project management maturity model. The extensions take the form of a five-level cybersecurity capability perspective that augments the seven standard perspectives of the PjM3 by explicitly assessing project management capabilities that impact the six themes where IT project management and cybersecurity intersect. This article will be relevant to IT project managers, the top management teams of organizations that design and deploy IT systems for critical infrastructures, and managers at organizations that provide and maintain critical infrastructures. The challenge in the digital economy is that no chain is stronger than its weakest link.

An Obligation to Act: Holding Government Accountable for Critical Infrastructure Cyber Security

Click to increase image sizeClick to decrease image size ACKNOWLEDGMENTSThe author would like to acknowledge the assistance of Julia Werneburg, Laura Morrison, Kathryn Ball, and Michele Krech, students in the Ottawa office of Gowling Lafleur Henderson LLP, for their contributions in the research and preparation of this article. Please note that this article does not constitute a legal opinion but is intended to provide the views of the author.Additional informationNotes on contributorsJacques J. M. ShoreJacques J. M. Shore is a partner in the Advocacy Department and former Chair of the firm's Government Affairs Practice at the Ottawa, Canada, office of Gowling Lafleur Henderson LLP. Prior to joining the firm he was the first Director of Research of Canada's Security Intelligence Review Committee, and a senior member of the Macdonald Royal Commission on the Economic Union and Development Prospects for Canada. Earlier, he was a staff member at the Secretariat of the Ministry of the Solicitor General. A law graduate of the Université de Montreal and McGill University, Mr. Shore is currently Chairman of the Council of Distinguished Advisors of the Norman Paterson School of International Affairs at Carleton University, Ottawa. He continues to actively support the international development of professional legal activities, specifically in Central and Eastern Europe.

Broker-dealers need to respond to recent focus on cybersecurity threats

Purpose – To alert broker-dealers to several regulatory developments relating to cybersecurity threats. Design/methodology/approach – Reviews four regulatory developments in the cybersecurity area and provides several steps broker-dealers should undertake to review and improve their cybersecurity and information technology protocols and practices. Findings – While FINRA’s new cybersecurity sweep appears to be an exploratory and learning exercise to obtain regulatory knowledge and intelligence, firms should be cognizant of the fact that both FINRA and the SEC have imposed significant sanctions against Firms when it has found inadequate cyber security policies and procedures. Practical implications – Broker-dealers should review the White House’s recent Framework for Improving Critical Infrastructure Cybersecurity and evaluate their own cybersecurity preparedness under the key areas of the Framework. Originality/value – Practical guidance from experienced privacy and securities regulatory lawyers that consolidates several recent developments in one piece.

Evaluating the Impact of Cybersecurity Information Sharing on Cyber Incidents and Their Consequences

The Department of Homeland Security (DHS) facilitates cybersecurity information sharing among federal government departments and agencies and critical infrastructure owners and operators to promote their security. Information sharing is deemed of critical importance to accomplish the department’s cybersecurity mission; indeed, information sharing is one of the central planks of Executive Order 13636: Improving Critical Infrastructure Cybersecurity, which calls for greater cybersecurity information sharing between the government — not least DHS — and the private sector. But while the importance of information sharing in cybersecurity is intuitive — information that is relevant, timely, and accurate should help cyber defenders reduce vulnerabilities and mitigate threats — the impact of information sharing has not been empirically assessed. The lack of empirical support for information sharing raises two notable issues. First, information-sharing partners, particularly those in the private sector, are sometimes reluctant to participate in government-sponsored initiatives because of concerns about liability, resource costs, and return on investment. Absent empirical demonstration of the value of cybersecurity information-sharing efforts, DHS may be unable to better incentivize participation. Second, information-sharing efforts may, for a variety of reasons, be ineffective (not least due to a lack of participation or the dissemination of irrelevant information). Without assessing the relationship between information sharing and the number and severity (i.e., consequences) of cyber incidents, DHS may be unable to identify and improve poorly performing information sharing efforts. A previous Homeland Security Studies and Analysis Institute (HSSAI) study recommended a suite of metrics to measure various relevant inputs, processes, outputs, and outcomes for cyber information-sharing efforts (Fleming and Goldstein 2012). It did not, however, seek to suggest ways to empirically test the hypothesis that information sharing reduces the number or severity of cyber incidents (it was assumed to do so, per DHS guidance). Accordingly, building on the previous HSSAI research, the present paper sets forth views on use of the dependent variable (some measure of cyber incidents), primary independent variable (some measure of information sharing), control variables, and model specifications.

Developing a Framework to Improve Critical Infrastructure Cybersecurity (Response to NIST Request for Information Docket No. 130208119-3119-01)

The National Institute of Standards and Technology (NIST) has issued a request for information (RFI) regarding its charge of developing a framework to improve critical infrastructure cybersecurity. As NIST correctly points out in the RFI, “[t]he national and economic security of the United States depends on the reliable functioning of critical infrastructure.” The following two suggestions are offered in an attempt to aid NIST as it develops a national cybersecurity framework (the Framework) to reduce cybersecurity risks throughout the nation: 1. The Framework should expressly require public interest representation in developing and selecting standards for a national cybersecurity infrastructure. 2. The Framework should adopt approaches that prevent patent disputes from disrupting the broadest possible adoption of cybersecurity standards. Such approaches may include selecting standards for inclusion in the cybersecurity infrastructure only if patent holders have (a) agreed to offer licenses on a royalty-free basis, (b) consented to observe an aggregate royalty cap for all patents covering the standard, or (c) waived their rights to seek injunctive relief.

Cyber security of networked critical infrastructures [Guest Editorial

A new era of cyber warfare has appeared on the horizon with the discovery and detection of Stuxnet. Allegedly planned, designed, and created by the United States and Israel, Stuxnet is considered the first known cyber weapon to attack an adversary state. Stuxnet's discovery put a lot of attention on the outdated and obsolete security of critical infrastructure. It became very apparent that electronic devices that are used to control and operate critical infrastructure like programmable logic controllers (PLCs) or supervisory control and data acquisition (SCADA) systems lack very basic security and protection measures. Part of that is due to the fact that when these devices were designed, the idea of exposing them to the Internet was not in mind. However, now with this exposure, these devices and systems are considered easy prey to adversaries.

Cybersecurity for Critical Infrastructures: Attack and Defense Modeling

Disruption of electric power operations can be catastrophic on national security and the economy. Due to the complexity of widely dispersed assets and the interdependences among computer, communication, and power infrastructures, the requirement to meet security and quality compliance on operations is a challenging issue. In recent years, the North American Electric Reliability Corporation (NERC) established a cybersecurity standard that requires utilities' compliance on cybersecurity of control systems. This standard identifies several cyber-related vulnerabilities that exist in control systems and recommends several remedial actions (e.g., best practices). In this paper, a comprehensive survey on cybersecurity of critical infrastructures is reported. A supervisory control and data acquisition security framework with the following four major components is proposed: (1) <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">real-time monitoring</i> ; (2) <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">anomaly detection</i> ; (3) <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">impact analysis</i> ; and (4) <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">mitigation strategies</i> . In addition, an attack-tree-based methodology for impact analysis is developed. The attack-tree formulation based on power system control networks is used to evaluate <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">system</i> -, <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">scenario</i> -, and <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">leaf</i> -level vulnerabilities by identifying the system's adversary objectives. The leaf vulnerability is fundamental to the methodology that involves port auditing or password strength evaluation. The measure of vulnerabilities in the power system control framework is determined based on existing cybersecurity conditions, and then, the vulnerability indices are evaluated.