ARES: Automated Risk Estimation in Smart Sensor Environments

Area of Science:

• Computer Science
• Cybersecurity
• Industrial Automation

Background:

• Industry 4.0 requires integrability, interoperability, composability, and security.
• Current enterprise systems integration addresses the first three, but security risk management is often a separate first step.
• Security risks are significantly influenced by the assets supporting business processes.

Purpose of the Study:

• To propose an automated risk estimation approach (ARES) for smart sensor environments.
• To integrate automated risk estimation with business process model life cycle management.
• To address the security challenges in Industry 4.0 adoption.

Main Methods:

• ARES utilizes standards for platform, vulnerability, weakness, and attack pattern enumeration.
• A well-known vulnerability scoring system is employed within ARES.
• A computer-aided procedure for mapping attack patterns to platforms is proposed.

Main Results:

• ARES integrates automated risk estimation into the business process model life cycle.
• Demonstrated applicability using a microSCADA controller and a Business Process Cataloging and Classification System prototype.
• Evaluation results indicate the effectiveness of the proposed approach, with some limitations identified.

Conclusions:

• ARES provides an automated method for risk estimation in smart sensor environments, crucial for Industry 4.0.
• The integration of ARES with business process management enhances security considerations throughout the life cycle.
• The proposed approach and mapping procedure offer a valuable contribution to securing industrial cyber-physical systems.