Cyber-Physical Security in Healthcare

2020 ◽  
pp. 63-87
Author(s):  
Vasiliki Mantzana ◽  
Eleni Darra ◽  
Ilias Gkotsis
Keyword(s):  
Cyber Security ◽  
Critical Infrastructure ◽  
Integrated Approach ◽  
Healthcare Sector ◽  
Hospital Services ◽  
Physical Security ◽  
Cyber Threats

The healthcare sector has been considered a part of critical infrastructure (CI) of society and has faced numerous physical-cyber threats that affect citizens' lives and habits, increase their fears, and influence hospital services provisions. The two most recent ransomware campaigns, WannaCry and Petya, have both managed to infect victims' systems by exploiting existing unpatched vulnerabilities. It is critical to develop an integrated approach in order to fight against combination of physical and cyber threats. In this chapter, key results of the SAFECARE project (H2020-GA787005), which aims is to provide solutions that will improve physical and cyber security, to prevent and detect complex attacks, to promote incident responses and mitigate impacts, will be presented. More specifically, healthcare critical asset vulnerabilities; cyber-physical threats that can affect them; architecture solutions, as well as, some indicative scenarios that will be validated during the project will be presented.

scholarly journals Cyber Attacks on Critical Infrastructure

2016 ◽  
pp. 448-465
Author(s):  
Ana Kovacevic ◽  
Dragana Nikolic
Keyword(s):  
Control Systems ◽  
Cyber Security ◽  
Critical Infrastructure ◽  
Cyber Attacks ◽  
Cyber Attack ◽  
Future Directions ◽  
Infrastructure Systems ◽  
Cyber Threats ◽  
Scada Systems ◽  
Insight Into

We are facing the expansion of cyber incidents, and they are becoming more severe. This results in the necessity to improve security, especially in the vulnerable field of critical infrastructure. One of the problems in the security of critical infrastructures is the level of awareness related to the effect of cyberattacks. The threat to critical infrastructure is real, so it is necessary to be aware of it and anticipate, predict, and prepare against a cyber attack. The main reason for the escalation of cyberattacks in the field of Critical Infrastructure (CI) may be that most control systems used for CI do not utilise propriety protocols and software anymore; they instead utilise standard solutions. As a result, critical infrastructure systems are more than ever before becoming vulnerable and exposed to cyber threats. It is important to get an insight into what attack types occur, as this may help direct cyber security efforts. In this chapter, the authors present vulnerabilities of SCADA systems against cyber attack, analyse and classify existing cyber attacks, and give future directions to achieve better security of SCADA systems.

Cyber Attacks on Critical Infrastructure

2015 ◽  
pp. 1-18 ◽  
Author(s):  
Ana Kovacevic ◽  
Dragana Nikolic
Keyword(s):  
Control Systems ◽  
Cyber Security ◽  
Critical Infrastructure ◽  
Cyber Attacks ◽  
Cyber Attack ◽  
Future Directions ◽  
Infrastructure Systems ◽  
Cyber Threats ◽  
Scada Systems ◽  
Insight Into

We are facing the expansion of cyber incidents, and they are becoming more severe. This results in the necessity to improve security, especially in the vulnerable field of critical infrastructure. One of the problems in the security of critical infrastructures is the level of awareness related to the effect of cyberattacks. The threat to critical infrastructure is real, so it is necessary to be aware of it and anticipate, predict, and prepare against a cyber attack. The main reason for the escalation of cyberattacks in the field of Critical Infrastructure (CI) may be that most control systems used for CI do not utilise propriety protocols and software anymore; they instead utilise standard solutions. As a result, critical infrastructure systems are more than ever before becoming vulnerable and exposed to cyber threats. It is important to get an insight into what attack types occur, as this may help direct cyber security efforts. In this chapter, the authors present vulnerabilities of SCADA systems against cyber attack, analyse and classify existing cyber attacks, and give future directions to achieve better security of SCADA systems.

scholarly journals Modern legal content of optimization of directions of administrative and legal regulation of the state cybersecurity policy

2021 ◽  
pp. 31-42
Author(s):  
Igor Diorditsa
Keyword(s):  
Cyber Security ◽  
State Policy ◽  
Critical Infrastructure ◽  
Armed Forces ◽  
Legal Regulation ◽  
Training System ◽  
The State ◽  
National Interests ◽  
Cyber Threats ◽  
The Law

The article proposes to consider the author's results of determining the conceptual provisions for optimizing the areas of administrative and legal regulation of state cybersecurity policy. The content of the current state of state policy in the field of cybersecurity is considered. Theoretical and practical aspects of optimization of legal relations in the field of state cybersecurity policy are analyzed. The interpretation of the state cybersecurity policy of Ukraine is determined – the activity of state and legal institutions to manage real and potential cyber threats and dangers to meet the cyber needs of man and citizen, as well as the realization of national interests in this area. The own vision of directions of the state cybersecurity policy according to the maintenance of a number of regulatory legal acts is offered, namely: directions of the state cybersecurity policy according to the Law of Ukraine «About the basic principles of maintenance of cybersecurity of Ukraine»; directions of the state cybersecurity policy in accordance with the Law of Ukraine «On Fundamentals of National Security of Ukraine»; directions of the state cybersecurity policy in accordance with the Doctrine of Information Security of Ukraine. It is concluded that the priority areas for optimizing state policy to strengthen the administrative and legal regulation of cybersecurity of the state are the following reforming cyber law as a segment of information legislation of Ukraine, especially in terms of not only clearly defining current threats and threats to cyber security, but also mechanisms public policy, including symmetric cyber measures; research on the protection of critical infrastructure from cyberattacks; promoting the development of domestic innovative products that can be used to strengthen the cybersecurity of the state; completion of the implementation of the provisions of the Council of Europe Convention on Cybercrime into national law; optimization of the training system in the field of cybersecurity for the needs of the Armed Forces of Ukraine and other bodies of the security and defense sector of Ukraine; promoting a more active policy of state security institutions to inform the public about cyber threats; promoting the militarization of cyberspace; support for both existing multilateral training sessions on countering cyberattacks on the state information infrastructure, and initiating new types of such training sessions. Key words:cybersecurity, cyberspace, state policy, cybersecurity policy, cybercrime.

scholarly journals Beyond Physical Threats: Cyber-attacks on Critical Infrastructure as a Challenge of Changing Security Environment – Overview of Cyber-security legislation and implementation in SEE Countries

2020 ◽  
Vol 3 (1) ◽  
Author(s):  
Ivana Cesarec
Keyword(s):  
European Union ◽  
Cyber Security ◽  
Critical Infrastructure ◽  
Cyber Attacks ◽  
Critical Infrastructures ◽  
Cyber Attack ◽  
Member States ◽  
Industrial Control Systems ◽  
Eu Member States ◽  
Cyber Threats

States, organizations and individuals are becoming targets of both individual and state-sponsored cyber-attacks, by those who recognize the impact of disrupting security systems and effect to people and governments. The energy sector is seen as one of the main targets of cyber-attacks against critical infrastructure, but transport, public sector services, telecommunications and critical (manufacturing) industries are also very vulnerable. One of most used example of cyber-attack is the Ukraine power grid attack in 2015 that left 230,000 people without power for up to 6 hours. Another most high profile example of a cyber-attack against critical infrastructure is the Stuxnet computer virus (first used on Iranian nuclear facility) which could be adapted to attack the SCADA systems (industrial control systems) used by many critical infrastructures in Europe.Wide range of critical infrastructure sectors are reliant on industrial control systems for monitoring processes and controlling physical devices (sensors, pumps, etc.) and for that reason, physical connected devices that support industrial processes are becoming more vulnerable. Not all critical infrastructure operators in all sectors are adequately prepared to manage protection (and raise resilience) effectively across both cyber and physical environments. Additionally there are few challenges in implementation of protection measures, such as lack of collaboration between private and public sector and low levels of awareness on existence of national key legislation.From supranational aspect, in relation to this papers topic, the European Union has took first step in defense to cyber threats in 2016 with „Directive on security of network and information systems“ (NIS Directive) by prescribing member states to adopt more rigid cyber-security standards. The aim of directive is to improve the deterrent and increase the EU’s defenses and reactions to cyber attacks by expanding the cyber security capacity, increasing collaboration at an EU level and introducing measures to prevent risk and handle cyber incidents. There are lot of other „supporting tools“ for Member States countries, such as European Union Agency for Network and Information Security – ENISA (which organize regular cyber security exercises at an EU level, including a large and comprehensive exercise every two years, raising preparedness of EU states); Network of National Coordination Centers and the European Cybersecurity Industrial, Technology and Research Competence Centre; and Coordinated response to major cyber security incidents and crises (Blueprint) with aim to ensure a rapid and coordinated response to large-scale cyber attacks by setting out suitable processes within the EU.Yet, not all Member States share the same capacities for achieving the highest level of cyber-security. They need to continuously work on enhancing the capability of defense against cyber threats as increased risk to state institutions information and communication systems but also the critical infrastructure objects. In Southeast Europe there are few additional challenges – some countries even don't have designated critical infrastructures (lower level of protection; lack of „clear vision“ of criticality) and critical infrastructures are only perceived through physical prism; non-EU countries are not obligated to follow requirements of European Union and its legislation, and there are interdependencies and transboundary cross-sector effects that needs to be taken in consideration. Critical infrastructure Protection (CIP) is the primary area of action, and for some of SEE countries (like the Republic of Croatia) the implementation of cyber security provisions just complements comprehensive activities which are focused on physical protection.This paper will analyze few segments of how SEE countries cope with new security challenges and on which level are they prepared for cyber-attacks and threats: 1. Which security mechanisms they use; 2. The existing legislation (Acts, Strategies, Plan of Action, etc.) related to cyber threats in correlation with strategic critical infrastructure protection documents. Analysis will have two perspectives: from EU member states and from non-EU member states point of view. Additionally, for EU member states it will be analyzed if there were any cyber security legislation before NIS directive that meets same aims. The aim of research is to have an overall picture of efforts in region regarding cyber-security as possibility for improvement thorough cooperation, organizational measures, etc. providing also some recommendations to reduce the gap in the level of cyber-security development with other regions of EU.

scholarly journals Cyber threats confronting the digital built environment

2019 ◽  
Vol 26 (2) ◽  
pp. 245-266 ◽  
Author(s):  
Erika A. Parn ◽  
David Edwards
Keyword(s):  
Built Environment ◽  
Asset Management ◽  
Cyber Security ◽  
Critical Infrastructure ◽  
Smart Cities ◽  
Methodological Approach ◽  
Research Work ◽  
Future Research ◽  
Content Type ◽  
Cyber Threats

Purpose Smart cities provide fully integrated and networked connectivity between virtual/digital assets and physical building/infrastructure assets to form digital economies. However, industrial espionage, cyber-crime and deplorable politically driven cyber-interventions threaten to disrupt and/or physically damage the critical infrastructure that supports national wealth generation and preserves the health, safety and welfare of the populous. The purpose of this paper is to present a comprehensive review of cyber-threats confronting critical infrastructure asset management reliant upon a common data environment to augment building information modelling (BIM) implementation. Design/methodology/approach An interpretivist, methodological approach to reviewing pertinent literature (that contained elements of positivism) was adopted. The ensuing mixed methods analysis: reports upon case studies of cyber-physical attacks; reveals distinct categories of hackers; identifies and reports upon the various motivations for the perpetrators/actors; and explains the varied reconnaissance techniques adopted. Findings The paper concludes with direction for future research work and a recommendation to utilize innovative block chain technology as a potential risk mitigation measure for digital built environment vulnerabilities. Originality/value While cyber security and digitization of the built environment have been widely covered within the extant literature in isolation, scant research has hitherto conducted an holistic review of the perceived threats, deterrence applications and future developments in a digitized Architecture, Engineering, Construction and Operations (AECO) sector. This review presents concise and lucid reference guidance that will intellectually challenge, and better inform, both practitioners and researchers in the AECO field of enquiry.

scholarly journals Distributed vulnerability assessment applied to measuring citizen cyber-health and securing online public services

2018 ◽  
Vol 325 ◽  
pp. 137-144
Author(s):  
Kálmán Hadarics ◽  
Ferenc Leitold ◽  
Anthony Arrott
Keyword(s):  
Public Sector ◽  
Digital Divide ◽  
Cyber Security ◽  
Public Services ◽  
User Behavior ◽  
Integrated Approach ◽  
Cloud Services ◽  
It Infrastructure ◽  
Cyber Threats ◽  
Distributed Approach

Since the introduction of personal computing over the Internet, cyber-security has developed primarily as commercial services providing protection to organizations and individuals as customers of paid services. However, since the introduction of cloud-services and smartphones over a decade ago, this development has been radically altered. Effective cyber-security can no longer be provided as simplistic protective walls around trusted zones of computing (for organizations: isolated private corporate networks with secure network gateways; for individuals: stand-alone personal computers protected by locally-running anti-virus applications). These approaches have always assumed that cyber-threats do not originate from inside trusted zones. Increasingly, cybersecurity is more effectively achieved through detecting and mitigating vulnerabilities discovered through coordinated assessment of malware threats, user behaviors, and IT infrastructure weaknesses. Unlike the traditional focus on malware threats alone, this integrated approach treats the IT infrastructure and user behavior of each individual and each organization department separately. This distributed approach makes no assumptions about the origins of cyber-threats. In this paper, we examine the implications of using this distributed approach in the public sector. Particular emphasis is placed on aspects where the traditional framework of cyber-security as a commercial service can be usefully abandoned and replaced by more effective public sector practices. The recent evolution of the Digital Divide in Central and Eastern Europe has not been a simple story of those with less opportunity and access (old, poor, less educated) being able close the gap by “catching up” with those of greater opportunity and access (young, wealthy, well educated). Rather, the closing of the Digital Divide has been achieved more through the adoption of very different digital activities provided through very differently organized services – activities and services that require very different public sector approaches to cyber-security. These include new approaches to measuring citizen cyber-health; making citizens savvier about their personal cybersecurity; and providing more secure online public services.

scholarly journals Securing Remote Access to Information Systems of Critical Infrastructure Using Two-Factor Authentication

Electronics ◽  
2021 ◽  
Vol 10 (15) ◽  
pp. 1819
Author(s):  
Rasa Bruzgiene ◽  
Konstantinas Jurgilas
Keyword(s):  
Information Systems ◽  
Identity Management ◽  
Critical Infrastructure ◽  
User Authentication ◽  
Remote Access ◽  
Access To Information ◽  
Digital Space ◽  
Cyber Threats ◽  
The Core ◽  
Common Target

Information systems of critical infrastructure provide services on which the core functions of a state and its economy depend as well as welfare of society. Such systems are becoming an increasingly common target for crimes and attacks in cyberspace, as their vulnerabilities can be exploited for malicious activities seeking financial or political gain. One of the main reasons that threatens the security of these systems is the weak control of remote access, otherwise defined as management of a system’s user identity. Management of user identity depends on user authentication, authorization and the assignment of certain rights in the digital space. This paper provides the proposed two-factor (2FA) digital authentication method for remote access to an information system of a critical infrastructure. Results of testing the method’s usability and resilience to cyber threats have shown that the system, in which the method was implemented, is protected from dangerous HTTP requests and publicly available system’s endpoints are protected from threatening inputs that could cause malicious activities on the critical infrastructure. Additionally, the implementation of the authentication API application ensures the rapidity of the method for less than 500 ms for 100 users working in parallel with the system at the same time.

Sign in / Sign up

Export Citation Format

Share Document