Cybersecurity Risk Assessment Research Articles

Simulation-supported aviation cyber-security risk analysis: a case study

Air Traffic Management (ATM) is based on complex processes carried out by several ATM entities, e.g., air traffic control, air traffic flow management and aeronautical information services. The results of these processes rely on the information passed between entities. Respective developments like those outlined in ICAOs Global Air Navigation Plan increase even further the complexity of this federated “system of systems”. Notably the concept of system-wide information management provides efficiency gains for the collaboration of airspace users, airports and air traffic management providers. However, this complexity and dynamic changes provide the ground for “gaps and flanks” between the elements, i.e., in terms of affected individual technical systems and information flows. Recent reports show that such vulnerabilities are explored in aviation similarly to other so called critical infrastructures. And while it is obvious that the failure of ATM elements will impair or even stop air traffic the impact of cyber-attacks on information integrity is less obvious. Thus, a continuous threat and risk analysis is important. This motivated the Air Traffic Resilience (ARIEL) project team to select attacks on the integrity of flight data as a use case for the scenario-oriented and model-based approach for aviation cyber security risk assessment. As part of the overall threat and risk analysis approach of ARIEL, an estimation of the threat potential of a selected attack scenario is made with the aid of an air traffic simulator. Thus, this makes it possible to quantify the threat to the system. The work presented here focuses on the use of simulation methodologies for aviation cyber security risk assessment with different variants of a flight plan data manipulation scenario. How the air traffic simulator TrafficSim could be used to estimate threat potential is presented along a discussion that focusses on approaches for the identification of such abnormalities that need to be counteracted or to treated to minimize its impact.

Risk Assessment Uncertainties in Cybersecurity Investments

When undertaking cybersecurity risk assessments, it is important to be able to assign numeric values to metrics to compute the final expected loss that represents the risk that an organization is exposed to due to cyber threats. Even if risk assessment is motivated by real-world observations and data, there is always a high chance of assigning inaccurate values due to different uncertainties involved (e.g., evolving threat landscape, human errors) and the natural difficulty of quantifying risk. Existing models empower organizations to compute optimal cybersecurity strategies given their financial constraints, i.e., available cybersecurity budget. Further, a general game-theoretic model with uncertain payoffs (probability-distribution-valued payoffs) shows that such uncertainty can be incorporated in the game-theoretic model by allowing payoffs to be random. This paper extends previous work in the field to tackle uncertainties in risk assessment that affect cybersecurity investments. The findings from simulated examples indicate that although uncertainties in cybersecurity risk assessment lead, on average, to different cybersecurity strategies, they do not play a significant role in the final expected loss of the organization when utilising a game-theoretic model and methodology to derive these strategies. The model determines robust defending strategies even when knowledge regarding risk assessment values is not accurate. As a result, it is possible to show that the cybersecurity investments’ tool is capable of providing effective decision support.

A Fuzzy Probability Bayesian Network Approach for Dynamic Cybersecurity Risk Assessment in Industrial Control Systems

With the increasing deployment of data network technologies in industrial control systems (ICSs), cybersecurity becomes a challenging problem in ICSs. Dynamic cybersecurity risk assessment plays a vital role in ICS cybersecurity protection. However, it is difficult to build a risk propagation model for ICSs due to the lack of sufficient historical data. In this paper, a fuzzy probability Bayesian network (FPBN) approach is presented for dynamic risk assessment. First, an FPBN is established for analysis and prediction of the propagation of cybersecurity risks. To overcome the difficulty of limited historical data, the crisp probabilities used in standard Bayesian networks are replaced in our approach by fuzzy probabilities. Then, an approximate dynamic inference algorithm is developed for dynamic assessment of ICS cybersecurity risk. It is embedded with a noise evidence filter in order to reduce the impact from noise evidence caused by system faults. Experiments are conducted on a simplified chemical reactor control system to demonstrate the effectiveness of the presented approach.

Characterizing and Measuring Maliciousness for Cybersecurity Risk Assessment.

Cyber attacks have been increasingly detrimental to networks, systems, and users, and are increasing in number and severity globally. To better predict system vulnerabilities, cybersecurity researchers are developing new and more holistic approaches to characterizing cybersecurity system risk. The process must include characterizing the human factors that contribute to cyber security vulnerabilities and risk. Rationality, expertise, and maliciousness are key human characteristics influencing cyber risk within this context, yet maliciousness is poorly characterized in the literature. There is a clear absence of literature pertaining to human factor maliciousness as it relates to cybersecurity and only limited literature relating to aspects of maliciousness in other disciplinary literatures, such as psychology, sociology, and law. In an attempt to characterize human factors as a contribution to cybersecurity risk, the Cybersecurity Collaborative Research Alliance (CSec-CRA) has developed a Human Factors risk framework. This framework identifies the characteristics of an attacker, user, or defender, all of whom may be adding to or mitigating against cyber risk. The maliciousness literature and the proposed maliciousness assessment metrics are discussed within the context of the Human Factors Framework and Ontology. Maliciousness is defined as the intent to harm. Most maliciousness cyber research to date has focused on detecting malicious software but fails to analyze an individual’s intent to do harm to others by deploying malware or performing malicious attacks. Recent efforts to identify malicious human behavior as it relates to cybersecurity, include analyzing motives driving insider threats as well as user profiling analyses. However, cyber-related maliciousness is neither well-studied nor is it well understood because individuals are not forced to expose their true selves to others while performing malicious attacks. Given the difficulty of interviewing malicious-behaving individuals and the potential untrustworthy nature of their responses, we aim to explore the maliciousness as a human factor through the observable behaviors and attributes of an individual from their actions and interactions with society and networks, but to do so we will need to develop a set of analyzable metrics. The purpose of this paper is twofold: (1) to review human maliciousness-related literature in diverse disciplines (sociology, economics, law, psychology, philosophy, informatics, terrorism, and cybersecurity); and (2) to identify an initial set of proposed assessment metrics and instruments that might be culled from in a future effort to characterize human maliciousness within the cyber realm. The future goal is to integrate these assessment metrics into holistic cybersecurity risk analyses to determine the risk an individual poses to themselves as well as other networks, systems, and/or users.

Cyber-security risk assessment framework for critical infrastructures

Cyber-security risk assessment framework for critical infrastructures

Improving risk assessment model of cyber security using fuzzy logic inference system

This paper describes the impacts of criminal activities based on the nature of the crime, the victim, and the basis (whether short-term or long-range/term) of the impacts of cybercrime on Internet. Recently many countries are facing numerous cyber threats including DoS (and DDoS), malware, website defamation, spam and phishing email attacks. Due to these cybercrimes evolution, identifying and assessing security risk is crucial to access data from new technologies, and also trying to understand how technologies can be abused. Therefore, there is a need to develop a special cyber security risk assessment model to tackle over these cyber threats. In this paper, we propose to utilize Fuzzy Inference Model (FIS) to produce risk assessment result based on the four risk factors which are: vulnerability, threat, likelihood and impact to specify the range of risks that can threaten any entity and try to solve such issues to proposed entities. We have performed various analyses on this factors and finally, our evaluation results show the viability of our proposed approach.

Multicriteria Decision Framework for Cybersecurity Risk Assessment and Management.

Risk assessors and managers face many difficult challenges related to novel cyber systems. Among these challenges are the constantly changing nature of cyber systems caused by technical advances, their distribution across the physical, information, and sociocognitive domains, and the complex network structures often including thousands of nodes. Here, we review probabilistic and risk-based decision-making techniques applied to cyber systems and conclude that existing approaches typically do not address all components of the risk assessment triplet (threat, vulnerability, consequence) and lack the ability to integrate across multiple domains of cyber systems to provide guidance for enhancing cybersecurity. We present a decision-analysis-based approach that quantifies threat, vulnerability, and consequences through a set of criteria designed to assess the overall utility of cybersecurity management alternatives. The proposed framework bridges the gap between risk assessment and risk management, allowing an analyst to ensure a structured and transparent process of selecting risk management alternatives. The use of this technique is illustrated for a hypothetical, but realistic, case study exemplifying the process of evaluating and ranking five cybersecurity enhancement strategies. The approach presented does not necessarily eliminate biases and subjectivity necessary for selecting countermeasures, but provides justifiable methods for selecting risk management actions consistent with stakeholder and decisionmaker values and technical data.

The industrial control system cyber defence triage process

The threat to Industrial Control Systems (ICS) from cyber attacks is widely acknowledged by governments and literature. Operators of ICS are looking to address these threats in an effective and cost-sensitive manner that does not expose their operations to additional risks through invasive testing. Whilst existing standards and guidelines offer comprehensive advice for reviewing the security of ICS infrastructure, resource and time limitations can lead to incomplete assessments or undesirably long countermeasure implementation schedules.In this paper we consider the problem of undertaking efficient cyber security risk assessments and implementing mitigations in large, established ICS operations for which a full security review cannot be implemented on a constrained timescale. The contribution is the Industrial Control System Cyber Defence Triage Process (ICS-CDTP). ICS-CDTP determines areas of priority where the impact of attacks is greatest, and where initial investment reduces the organisation's overall exposure swiftly. ICS-CDTP is designed to be a precursor to a wider, holistic review across the operation following established security management approaches. ICS-CDTP is a novel combination of the Diamond Model of Intrusion Analysis, the Mandiant Attack Lifecycle, and the CARVER Matrix, allowing for an effective triage of attack vectors and likely targets for a capable antagonist. ICS-CDTP identifies and focuses on key ICS processes and their exposure to cyber threats with the view to maintain critical operations. The article defines ICS-CDTP and exemplifies its application using a fictitious water treatment facility, and explains its evaluation as part of a large-scale serious game exercise.

A Cybersecurity Risk Assessment Framework that Integrates Value-Sensitive Design

A Cybersecurity Risk Assessment Framework that Integrates Value-Sensitive Design

A Cybersecurity Risk Assessment Framework that Integrates Value-Sensitive Design

A Cybersecurity Risk Assessment Framework that Integrates Value-Sensitive Design

Multimodel-Based Incident Prediction and Risk Assessment in Dynamic Cybersecurity Protection for Industrial Control Systems

Currently, an increasing number of information/communication technologies are adopted into the industrial control systems (ICSs). While these IT technologies offer high flexibility, interoperability, and convenient administration of ICSs, they also introduce cybersecurity risks. Dynamic cybersecurity risk assessment is a key foundational component of security protection. However, due to the characteristics of ICSs, the risk assessment for IT systems is not completely applicable for ICSs. In this paper, through the consideration of the characteristics of ICSs, a targeted multilevel Bayesian network containing attack, function, and incident models is proposed. Following this proposal, a novel multimodel-based hazardous incident prediction approach is designed. On this basis, a dynamic cybersecurity risk assessment approach, which has the ability to assess the risk caused by unknown attacks, is also devised. Furthermore, to improve the accuracy of the risk assessment, which may be reduced by the redundant accumulation of overlaps amongst different consequences, a unified consequence quantification method is presented. Finally, to verify the effectiveness of the proposed approach, a simulation of a simplified chemical reactor control system is conducted in MATLAB. The simulation results can clearly demonstrate that the proposed approach has the ability to dynamically calculate the cybersecurity risk of ICSs in a timely manner. Additionally, the result of a different comparative simulation shows that our approach has the ability to assess the risk caused by unknown attacks.

From old to new: Assessing cybersecurity risks for an evolving smart grid

Future smart grids will consist of legacy systems and new ICT components, which are used to support increased monitoring and control capabilities in the low- and medium-voltage grids. In this article, we present a cybersecurity risk assessment method, which involves two interrelated streams of analyses that can be used to determine the risks associated with an architectural concept of a smart grid that includes both legacy systems and novel ICT concepts. To ensure the validity of the recommendations that stem from the risk assessment with respect to national regulatory and deployment norms, the analysis is based on a consolidated national smart grid reference architecture. We have applied the method in a national smart grid security project that includes a number of key smart grid stakeholders, resulting in security recommendations that are based on a sound understanding of cybersecurity risks.

When it comes to securing patient health information from breaches, your best medicine is a dose of prevention: A cybersecurity risk assessment checklist.

Health care stakeholders are concerned about the growing risk of protecting sensitive patient health information from breaches. The Federal Emergency Management Agency (FEMA) has identified cyber attacks as an emerging concern, and regulations such as the Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health Act (HITECH) have increased security requirements and are enforcing compliance through stiff financial penalties. The purpose of this study is to describe health care breaches of protected information, analyze the hazards and vulnerabilities of reported breach cases, and prescribe best practices of managing risk through security controls and countermeasures. Prescriptive findings were used to construct a checklist tool to assess and monitor common risks. This research uses a case methodology to describe specific examples of the 3 major types of cyber breach hazards: portable device, insider, and physical breaches. We utilize a risk management framework to prescribe preventative actions that organizations can take to assess, analyze, and mitigate these risks. The health care sector has the largest number of reported breaches, with 3 major types: portable device, insider, and physical breaches. Analysis of actual cases indicates security gaps requiring prescriptive fixes based on "best practices." Our research culminates in a 25-item checklist that organizations can use to assess existing practices and identify security gaps requiring improvement.

Advancing Beyond Predictive to Anticipatory Risk Analytics: CyberFinance: Why Cybersecurity Risk Analytics must Evolve to Survive 90% oemerging Cyber Financial Threats, and, What You Can Do About It?

Current research presented at the 2016 New York State Cybersecurity Conference (June 8-9, 2016) advances further on our Computational Quantitative Risk Analytics and Computational Quantitative Finance and Cybersecurity innovation research selected for 35 Top-10 SSRN Rankings over 2015-2016 and recent invited research presentations at the 2016 Princeton Quant Trading Conference, 2015 Princeton Quant Trading Conference, and, the 2015 Chief Security Officers and CxO Summit, and research paper selected for the 2015 New York Cyber Security & Engineering Technology Association Conference.It draws on our 20-year scholarly and applied research and practices applied and shared by worldwide firms and governments on advancing beyond computerized models of predictive analytics based upon historical data to ‘anticipation of surprise’ for an interconnected cyber world increasingly characterized by growing uncertainty, extreme events, and black swans. (Starting from, for example, our CIO Magazine interview of September 15, 1999, and/ our ‘Expert Systems with Applications’ journal research paper: Expert Systems for Knowledge Management: Crossing the Chasm between Information Processing and Sense Making of 2001 inspired by the communication of 1995 on the design of next-generation self-adaptive complex systems with the Genetic Algorithms pioneer Professor Dr. John Holland while he was at Santa Fe Institute.)It recognizes data (i.e., ‘data in transit’, ‘data in use’, and, ‘data at rest’ from today’s Network and Computer Cyber Security perspective) as the ‘currency’ of the globally networked cyber era. Control and ownership of data – including ‘identity’, ‘intellectual property’, ‘money’, ‘value’, ‘valuations’, ‘prices’, ‘payments’, and ‘transactions’ – characterize the new discipline of Cyber Finance pioneered by our above research. ‘Data driven decision making’ by human-machine systems powered by AI, algorithms, data science, and, machine learning is increasingly subject to human-tech vulnerabilities and exposures to growing threats. Paradigmatic shift in understanding and applying Cybersecurity in terms of Cyber Risk Management requires advancing beyond ‘naive’ choice and application of ‘inappropriate’ models [by humans and/or machines] based on outdated, inaccurate, and incorrect assumptions. Blind and unquestioning reliance upon inappropriate risk models that exponentially underestimate risk is the sure-fire recipe for global financial disasters that can and will pale the severity of impact of the global financial crisis of 2008-2009. A case in point is our recent correction of the computational risk analytics and modeling foundation of cyber risk loss assessment by the global cyber risk insurance industry which had [incorrectly] chosen VaR (Value-at-Risk) as the model for predictive assessment for cyber risk loss assessment. We proposed alternative robust models, methods, and measures, while clearly demonstrating why VaR is inappropriate for Cybersecurity risk assessment as well as for Cyber Finance risk modeling given inherent systemic risks, tail risks, and endogenous risks characterizing the Cyber-Finance contexts.Advances in computational, quantitative, and statistical technologies, models, and methodologies for risk management are necessary for the world wherein decisions and actions occur at warp-speed enabled by sophisticated algorithms, machine learning, and, cognitive computing technologies. With primary focus of risk analysis across industries such as Finance fragmented across Application and Presentation layers (Layers 6 and 7) and Physical and Data Link layers (Layers 1 and 2), risks [and vulnerabilities] are increasingly concentrated in the Session, Transport, and Network layers (Layers 3, 4, and, 5) and associated telecom network protocols and cryptographic protocols. That specific emphasis of 10% risk focus and the 90% hidden and latent risk depicted our ‘iceberg of risk analytics’ which was one of the themes of the invited presentation at the 2015 Princeton Quant Trading Conference.Based upon our analysis of the Finance, Cybersecurity, and Cyber-Finance practices, we foresee rising catastrophic risks and extreme events across domains of Cyber Finance practice consistent and synchronous with similar current observations by top Finance experts and Hedge Fund managers (such as Bill Gross and George Soros) in Finance. Further advancing upon our research focus beyond theoretical Risk Modeling to pragmatic Uncertainty Modeling and Uncertainty Management; beyond Bayesian and Quasi-Bayesian VaR; beyond frequentist Null-Hypothesis Significance Testing to Bayesian Inference methodologies and related Markov Chain Monte Carlo Models; beyond Probability theory models to Imprecise Probability models based upon Bayesian Nets and Credal Nets, and, Possibility theory based Fuzzy Sets and Fuzzy Logic; and emerging focus on Quantum Computing, the current presentation outlines specific Extreme Risks and Catastrophic Risk models suitable for modeling emerging risks in Cybersecurity and Cyber Finance Risk Management.

Comparative Study of Information Security Risk Assessment Models for Cloud Computing systems

This paper reviews the state of the art in cyber security risk assessment of Cloud Computing systems. We select and examine in detail the quantitative security risk assessment models developed for or applied especially in the context of a Cloud Computing system. We review and then analyze existing models in terms of aim; the stages of risk management addressed; key risk management concepts covered; and sources of probabilistic data. Based on the analysis, we propose as well a comparison between these models to pick out limits and advantages of every presented model.

FINRA publishes its 2015 “Report on Cybersecurity Practices”

Purpose – To summarize and comment on FINRA’s report on cybersecurity practices, published on February 4, 2015, which arose from its 2014 targeted examination of firms’ cybersecurity preparedness. Design/methodology/approach – Explains the implications of the FINRA report and general guidance FINRA provides and expects all firms to consider in connection with developing their respective cybersecurity programs in eight areas: governance and risk management for cybersecurity; cybersecurity risk assessment; technical controls; incident response planning; vendor management; staff training; cyber intelligence and information sharing; and cyber insurance. Findings – There is no doubt that cybersecurity is a key risk facing the financial services industry now. Accordingly, FINRA expects that firms will review the report and assess how the principles and effective practices provided therein could help build or improve cybersecurity readiness. The report reflects FINRA’s risk-management-based approach to cybersecurity issues, identifying principles and “effective practices” for member firms to consider, as opposed to decreeing specific requirements, policies or procedures. Originality/value – Expert guidance from experienced securities lawyers.

Trust as a Human Factor in Holistic Cyber Security Risk Assessment

Holistic assessment of cyber security risks is a complex multi-component and multi-level problem involving hardware, software, environmental, and human factors. As part of an on-going effort to develop a holistic, predictive cyber security risk assessment model, the characterization of human factors, which includes human behavior, is needed to understand how the actions of users, defenders, and attackers affect cyber security risk. The work group developing this new cyber security risk assessment model and framework has chosen to distinguish between trust and confidence by using “trust” only for human factors, and “confidence” for all non-human factors (e.g. hardware and software) in order to reduce confusion between the two concepts within our model. We have developed an initial framework for how to incorporate trust as a factor/parameter within a larger characterization of the human influences (users, defenders and attackers) on cyber security risk. Trust in the human factors is composed of two main categories: inherent characteristics, that which is a part of the individual, and situational characteristics, that which is outside of the individual. The use of trust as a human factor in holistic cyber security risk assessment will also rely on understanding how differing mental models and risk postures impact the level trust given to an individual and the biases affecting the ability to give said trust.

A Graphical Adversarial Risk Analysis Model for Oil and Gas Drilling Cybersecurity

Oil and gas drilling is based, increasingly, on operational technology, whose cybersecurity is complicated by several challenges. We propose a graphical model for cybersecurity risk assessment based on Adversarial Risk Analysis to face those challenges. We also provide an example of the model in the context of an offshore drilling rig. The proposed model provides a more formal and comprehensive analysis of risks, still using the standard business language based on decisions, risks, and value.

Introduction of a Cyber Security Risk Analysis and Assessment System for Digital I&C Systems in Nuclear Power Plants

The application of security controls specified in the RG 5.71 in a specific I&C system still requires many analysis efforts based on an understanding of the security controls, since the guideline does not provide the details to system designers or developers regarding what, where, and how to apply the security controls. The Cyber Security Risk Analysis and Assessment System (CSRAS) has been developed as a tool for analyzing security requirements and technical security controls based on a general cyber security risk assessment procedure with the consideration of characteristics of I&C systems and the lifecycle of development in nuclear power plants.

A CYBER SECURITY RISK ASSESSMENT FOR THE DESIGN OF I&C SYSTEMS IN NUCLEAR POWER PLANTS

The applications of computers and communication system and network technologies in nuclear power plants have expanded recently. This application of digital technologies to the instrumentation and control systems of nuclear power plants brings with it the cyber security concerns similar to other critical infrastructures. Cyber security risk assessments for digital instrumentation and control systems have become more crucial in the development of new systems and in the operation of existing systems. Although the instrumentation and control systems of nuclear power plants are similar to industrial control systems, the former have specifications that differ from the latter in terms of architecture and function, in order to satisfy nuclear safety requirements, which need different methods for the application of cyber security risk assessment. In this paper, the characteristics of nuclear power plant instrumentation and control systems are described, and the considerations needed when conducting cyber security risk assessments in accordance with the lifecycle process of instrumentation and control systems are discussed. For cyber security risk assessments of instrumentation and control systems, the activities and considerations necessary for assessments during the system design phase or component design and equipment supply phase are presented in the following 6 steps: 1) System Identification and Cyber Security Modeling, 2) Asset and Impact Analysis, 3) Threat Analysis, 4) Vulnerability Analysis, 5) Security Control Design, and 6) Penetration test. The results from an application of the method to a digital reactor protection system are described.