Cyber security risk assessment for SCADA and DCS networks

Area of Science:

• Cybersecurity
• Industrial Control Systems
• Risk Assessment

Background:

• Critical infrastructures and industrial automation increasingly rely on interconnected cyber-physical control systems.
• This dependence introduces significant and previously unforeseen cybersecurity threats to Supervisory Control and Data Acquisition (SCADA) and Distributed Control Systems (DCS).
• Engineers and managers require accessible information and understanding of these evolving threats.

Purpose of the Study:

• To provide a comprehensive overview of cybersecurity and risk assessment specifically for SCADA and DCS environments.
• To introduce key industry organizations and government bodies involved in industrial cybersecurity.
• To offer a detailed review of the existing literature on the subject.

Main Methods:

• Introduction to major risk assessment concepts and methodologies applied to SCADA systems.
• Discussion of specific methods such as Hierarchical Hazard Method (HHM), Impact-Impact Method (IIM), and Risk Reduction Factor Method (RFRM).
• Overview of Probability Risk Analysis (PRA) techniques including Fault Tree Analysis (FTA), Event Tree Analysis (ETA), and Failure Modes and Effects Analysis (FMEA).

Main Results:

• Successful application of methods like HHM, IIM, and RFRM to complex SCADA systems with interdependencies.
• Highlighting the critical need for quantifiable metrics in risk assessment for industrial control systems.
• Presentation of two recent quantitative methods utilizing compromise graphs and augmented vulnerability trees.

Conclusions:

• The paper provides a foundational understanding of cybersecurity risks and assessment methods for SCADA and DCS.
• It emphasizes the importance of quantifiable metrics and introduces advanced techniques for evaluating attack probability, impact, and countermeasure effectiveness.
• This work aims to equip engineers and managers with the knowledge to navigate and mitigate cybersecurity threats in critical infrastructures.