Cyber Risk Propagation and Optimal Selection of Cybersecurity Controls for Complex Cyberphysical Systems

Area of Science:

• Cybersecurity
• Systems Engineering
• Risk Management

Background:

• The integration of information technology and operational technology creates complex Cyber-Physical Systems (CPSs).
• Increased connectivity in CPSs elevates cyber risks, which are difficult to analyze due to system complexity.
• Current cybersecurity control selection is often manual, lacking automated decision support for efficient risk treatment.

Purpose of the Study:

• To propose a method for analyzing risk propagation and aggregation in complex CPSs.
• To develop an automated method for selecting optimal cybersecurity controls to minimize residual risk and cost.
• To demonstrate the proposed methods using the navigational systems of Cyber-Enabled Ships (C-ES).

Main Methods:

• Analyzing risk propagation and aggregation in CPSs using constituent risk assessments.
• Employing evolutionary programming for automated selection of cybersecurity controls.
• Applying the methods to autonomous and remotely controlled Cyber-Enabled Ships (C-ES).

Main Results:

• Identified vulnerable components in C-ES navigational systems.
• Generated optimal sets of cybersecurity controls tailored to specific system vulnerabilities.
• Demonstrated minimization of both residual cyber risk and implementation costs.

Conclusions:

• The proposed methods effectively analyze cyber risk in complex CPSs.
• Automated selection of cybersecurity controls significantly reduces residual risk and associated costs.
• The approach is applicable to critical systems like autonomous and remotely controlled ships.