Consider the consequences: A powerful approach for reducing ICS cyber risk

Richard Wyman
Additional contact information
Richard Wyman: Professional Control Systems Engineer, USA

Cyber Security: A Peer-Reviewed Journal, 2017, vol. 1, issue 1, 28-43

Abstract: Securing industrial control systems (ICS) or, for that matter, information technology (IT) systems is a never-ending battle. Cybersecurity subject matter experts secure their systems with the latest technology and threat actors develop new techniques to bypass these controls in a constant arms race of attack and defend, attack and defend. This single-minded focus on responding to the latest threat often causes ICS cybersecurity subject matter experts to forget what they are defending, which is controlling and protecting the process. To be more specific, the cyber protections should prevent a threat actor from issuing malicious control commands and/or ensuring that a threat actor does not stop legitimate commands from reaching their objectives. Unauthorised commands and the inability to issue commands have caused several high-profile impacts that resulted in significant damage in physical systems. This paper explores the relationship between cyber and physical systems by introducing a reference model that explains the cascading nature of impacts. While a cyberattack on an ICS originates in the cyber domain the most serious impacts occur in the physical domain. By understanding this concept, cybersecurity subject matter experts can make more targeted defensive measures in the cyber domain and add protections in the physical domain to significantly reduce ICS cyber risk.

Keywords: ICS cybersecurity; cyberattacks; cyber/physical impacts; ICS Cyber Kill Chain; protection layers; risk analysis (search for similar items in EconPapers)
JEL-codes: M15 (search for similar items in EconPapers)
Date: 2017
References: Add references at CitEc
Citations:

Downloads: (external link)
https://hstalks.com/article/2699/download/ (application/pdf)
https://hstalks.com/article/2699/ (text/html)
Requires a paid subscription for full access.

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:aza:csj000:y:2017:v:1:i:1:p:28-43

Access Statistics for this article

More articles in Cyber Security: A Peer-Reviewed Journal from Henry Stewart Publications
Bibliographic data for series maintained by Henry Stewart Talks ().