scholarly journals Assessment of risks of operation of shipboard technical facilities, taking into account the possibility of cyberincidents

2021 ◽  
pp. 58-66
Author(s):  
В.А. Туркин ◽  
Д.А. Давыдов ◽  
А.А. Стяжкин
Keyword(s):  
Control Systems ◽  
Information Technologies ◽  
Operating Experience ◽  
Cyber Attacks ◽  
Technical Equipment ◽  
Monitoring And Control ◽  
Industrial Control Systems ◽  
Industrial Enterprises ◽  
Undesirable Event ◽  
Gas Leak

Показано, что в сфере морского транспорта все активнее идет процесс цифровизации. Приведены требования резолюций ИМО и нового руководства РМРС, направленные на снижение уязвимости судов от кибератак. Изложены основные понятия и определения теории анализа риска. В качестве критерия оценки уровня и обеспечения безопасности представлен техногенный риск. Предоставлен анализ эксплуатации плавучих регазификационных установок сжиженного природного газа, основанный на опыте эксплуатации и собранных статистических данных. На основании собранной статистической информации, построена модель «дерево отказов» результирующим событием в которой является утечка газа. Установлено, что результирующее нежелательное событие «Утечка газа» может произойти с частотой 0,4 1/год. Рассмотрена архитектура системы управления судоходной компании, которая опирается на 4 подсистемы: операционных технологий, информационных технологий, промышленных систем управления и систем диспетчерского управления и сбора данных (SCADA). Системы управления позволяют осуществлять дистанционный контроль и управление установками и оборудованием. Недостатком систем является их уязвимость для кибератак. На основании анализа публикаций классификационного общества DNV было выявлено восемь основных уязвимостей в области кибербезопасности плавучей регазификационной установки. Исходя из статистики кибератак на инфраструктуру промышленных предприятий РФ в 2019 г. установлено, что частота кибератак на судовые технические средства примерно составит 0,009 1/год. It is shown that in the field of maritime transport, the digitalization process is increasingly active. The requirements of the IMO resolutions and the new management of the RMRS are given, aimed at reducing the vulnerability of ships from cyber attacks. The basic concepts and definitions of the theory of risk analysis are presented. Technogenic risk is presented as a criterion for assessing the level and ensuring safety. The analysis of the operation of floating regasification plants of liquefied natural gas, based on the operating experience and collected statistical data, is provided. Based on the collected statistical information, a “tree of failures” model has been built, in which the resulting event is a gas leak. It has been established that the resulting undesirable event "Gas Leak" can occur with a frequency of 0.4 1 / year. The architecture of the control system of a shipping company is considered, which is based on 4 subsystems: operational technologies, information technologies, industrial control systems and systems of dispatch control and data collection (SCADA). Control systems allow remote monitoring and control of plants and equipment. The disadvantage of systems is their vulnerability to cyber attacks. Based on the analysis of publications of the classification society DNV, eight major vulnerabilities in the field of cybersecurity of the floating regasification unit were identified. Based on the statistics of cyberattacks on the infrastructure of industrial enterprises of the Russian Federation in 2019, it was established that the frequency of cyberattacks on ship technical equipment will be approximately 0.009 1 / year.

Building a Cybersecurity Culture in the Industrial Control System Environment

2019 ◽  
Vol 8 (1) ◽  
pp. 39-44
Author(s):  
Claudia ARAUJO MACEDO ◽  
Jos MENTING
Keyword(s):  
Control System ◽  
Control Systems ◽  
Cyber Attacks ◽  
Cyber Attack ◽  
Industrial Control System ◽  
Security Measures ◽  
Industrial Control ◽  
Industrial Control Systems ◽  
System A ◽  
Educational Processes

Cybersecurity in industrial control system environments has become a significant concern and is even more relevant in the context of critical infrastructures where control system disruption could have a profound impact on health, safety and the environment. This makes this type of system a major target for malicious activities. Notwithstanding an organization’s interest in protecting its industrial control systems against cyber-attacks, the implementation of security measures, whether technical, organizational or human, still faces resistance and is often seen as a constraint. Using the best technology to protect industrial control systems makes no sense if persons with access do not act attentively and protectively. Technical and human cybersecurity measures are intrinsically linked, and it is essential that all persons with access to these systems are fully aware of the inherent cyber risks. Organizations must also act so that staff receive appropriate training on how to keep systems continuously protected against cyber-attack when carrying out their daily tasks. These educational processes can contribute to building an effective cybersecurity culture fully reflective of management and staff attitudes, so that the availability, integrity and confidentiality of information in industrial control systems can be assured.

scholarly journals A review: towards practical attack taxonomy for industrial control systems

2018 ◽  
Vol 7 (2.14) ◽  
pp. 145 ◽  
Author(s):  
Qais Saif Qassim ◽  
Norziana Jamil ◽  
Razali Jidin ◽  
Mohd Ezanee Rusli ◽  
Md Nabil Ahmad Zawawi ◽  
...  
Keyword(s):  
Control Systems ◽  
Supervisory Control ◽  
Cyber Attacks ◽  
Critical Infrastructures ◽  
Cyber Attack ◽  
Industrial Control ◽  
Industrial Control Systems ◽  
Scada System ◽  
Water Transportation ◽  
Different Types

Supervisory Control and Data Acquisition (SCADA) system is the underlying control system of most national critical infrastructures such as power, energy, water, transportation and telecommunication. In order to understand the potential threats to these infrastructures and the mechanisms to protect them, different types of cyber-attacks applicable to these infrastructures need to be identified. Therefore, there is a significant need to have a comprehensive understanding of various types of cyber-attacks and its classification associated with both Opera-tion Technology (OT) and Information Technology (IT). This paper presents a comprehensive review of existing cyber-attack taxonomies available in the literature and evaluates these taxonomies based on defined criteria.  

Cybersecurity Leadership: Competencies, Governance, and Technologies for Industrial Control Systems

2017 ◽  
Vol 17 (01) ◽  
pp. 1740001 ◽  
Author(s):  
JEAN-PIERRE AUFFRET ◽  
JANE L. SNOWDON ◽  
ANGELOS STAVROU ◽  
JEFFREY S. KATZ ◽  
DIANA KELLEY ◽  
...  
Keyword(s):  
Smart Grid ◽  
Control Systems ◽  
Leadership Competencies ◽  
Cyber Attacks ◽  
Industrial Control ◽  
Public And Private ◽  
Industrial Control Systems ◽  
Grid Systems ◽  
Private Organizations ◽  
Emerging Risk

The extensive integration of interconnected devices and the inadvertent information obtained from untrusted sources has exposed the Industrial Control Systems (ICS) ecosystem to remote attacks by the exploitation of new and old vulnerabilities. Unfortunately, although recognized as an emerging risk based on the recent rise of cyber attacks, cybersecurity for ICS has not been addressed adequately both in terms of technology but, most importantly, in terms of organizational leadership and policy. In this paper, we will present our findings regarding the cybersecurity challenges for Smart Grid and ICS and the need for changes in the way that organizations perceive cybersecurity risk and leverage resources to balance the needs for information security and operational security. Moreover, we present empirical data that point to cybersecurity governance and technology principles that can help public and private organizations to navigate successfully the technical cybersecurity challenges for ICS and Smart Grid systems. We believe that by identifying and mitigating the inherent risks in their systems, operations, and processes, enterprises will be in a better position to shield themselves and protect against current and future cyber threats.

scholarly journals Digital Forensic Analysis of Industrial Control Systems Using Sandboxing: A Case of WAMPAC Applications in the Power Systems

Energies ◽  
2019 ◽  
Vol 12 (13) ◽  
pp. 2598
Author(s):  
Asif Iqbal ◽  
Farhan Mahmood ◽  
Mathias Ekstedt
Keyword(s):  
Power Systems ◽  
Control Systems ◽  
Forensic Analysis ◽  
Cyber Attacks ◽  
Power Grids ◽  
Cyber Attack ◽  
Industrial Control ◽  
Industrial Control Systems ◽  
Daubert Standard ◽  
And Control

In today’s connected world, there is a tendency of connectivity even in the sectors which conventionally have been not so connected in the past, such as power systems substations. Substations have seen considerable digitalization of the grid hence, providing much more available insights than before. This has all been possible due to connectivity, digitalization and automation of the power grids. Interestingly, this also means that anybody can access such critical infrastructures from a remote location and gone are the days of physical barriers. The power of connectivity and control makes it a much more challenging task to protect critical industrial control systems. This capability comes at a price, in this case, increasing the risk of potential cyber threats to substations. With all such potential risks, it is important that they can be traced back and attributed to any potential threats to their roots. It is extremely important for a forensic investigation to get credible evidence of any cyber-attack as required by the Daubert standard. Hence, to be able to identify and capture digital artifacts as a result of different attacks, in this paper, the authors have implemented and improvised a forensic testbed by implementing a sandboxing technique in the context of real time-hardware-in-the-loop setup. Newer experiments have been added by emulating the cyber-attacks on WAMPAC applications, and collecting and analyzing captured artifacts. Further, using sandboxing for the first time in such a setup has proven helpful.

scholarly journals Analyzing the Impact of Cybersecurity on Monitoring and Control Systems in the Energy Sector

Energies ◽  
2021 ◽  
Vol 15 (1) ◽  
pp. 218
Author(s):  
Mohammed Alghassab
Keyword(s):  
Control System ◽  
Control Systems ◽  
Cyber Security ◽  
Energy Sector ◽  
Industrial Control System ◽  
Monitoring And Control ◽  
Industrial Control ◽  
Industrial Control Systems ◽  
Monitoring And Control Systems ◽  
And Control

Monitoring and control systems in the energy sector are specialized information structures that are not governed by the same information technology standards as the rest of the world’s information systems. Such industrial control systems are also used to handle important infrastructures, including smart grids, oil and gas facilities, nuclear power plants, water management systems, and so on. Industry equipment is handled by systems connected to the internet, either via wireless or cable connectivity, in the present digital age. Further, the system must work without fail, with the system’s availability rate being of paramount importance. Furthermore, to certify that the system is not subject to a cyber-attack, the entire system must be safeguarded against cyber security vulnerabilities, threats, and hazards. In addition, the article looks at and evaluates cyber security evaluations for industrial control systems, as well as their possible impact on the accessibility of industrial control system operations in the energy sector. This research work discovers that the hesitant fuzzy-based method of the Analytic Hierarchy Process (AHP) and the Technique for Order of Preference by Similarity to Ideal Solution (TOPSIS) is an operational procedure for estimating industrial control system cyber security assessments by understanding the numerous characteristics and their impacts on cyber security industrial control systems. The author evaluated the outputs of six distinct projects to determine the quality of the outcomes and their sensitivity. According to the results of the robustness analysis, alternative 1 shows the utmost effective cybersecurity project for the industrial control system. This research work will be a conclusive reference for highly secure and managed monitoring and control systems.

Sign in / Sign up

Export Citation Format

Share Document