A Novel Model for Vulnerability Analysis through Enhanced Directed Graphs and Quantitative Metrics

Abstract

The rapid evolution of industrial components, the paradigm of Industry 4.0, and the new connectivity features introduced by 5G technology all increase the likelihood of cybersecurity incidents. Such incidents are caused by the vulnerabilities present in these components. Designing a secure system is critical, but it is also complex, costly, and an extra factor to manage during the lifespan of the component. This paper presents a model to analyze the known vulnerabilities of industrial components over time. The proposed Extended Dependency Graph (EDG) model is based on two main elements: a directed graph representation of the internal structure of the component, and a set of quantitative metrics based on the Common Vulnerability Scoring System (CVSS). The EDG model can be applied throughout the entire lifespan of a device to track vulnerabilities, identify new requirements, root causes, and test cases. It also helps prioritize patching activities. The model was validated by application to the OpenPLC project. The results reveal that most of the vulnerabilities associated with OpenPLC were related to memory buffer operations and were concentrated in the libssl library. The model was able to determine new requirements and generate test cases from the analysis.

Charging Stations and Electromobility Development: A Cross-Country Comparative Analysis

“…The secondary data availability is also a limitation of this part of study. The newest and most reliable data related to the numbers of registered electric vehicles are from the end of 2021 [141,142]. There are other questions opened by the provided analyses, related to the energy generation and consumption.…”

A Formal Verification of a Reputation Multi-Factor Authentication Mechanism for Constrained Devices and Low-Power Wide-Area Network Using Temporal Logic

“…The second methodology used was the common vulnerability score system, CVSS (2.2), adopted for prioritizing the severity of the potential impact of vulnerabilities. This tool provides a systematic approach to assessing the severity of vulnerabilities using weights [61] ranging from zero to three (no severity and high severity, respectively) and is commonly used with other methodologies such as common vulnerabilities exposure (CVE) [62][63][64]. Therefore, due to not being a tool that classifies or proposes attack vectors, it is very commonly used in conjunction with other threat modeling methodologies (TMMs) during the threat assessment process in a project.…”

Cybersecurity of Critical Infrastructures: Challenges and Solutions

“…Focusing on Industrial components that are the main parts of critical infrastructures the authors in [ 8 ] propose a model for vulnerability analysis through the their entire life-cycle. The model can Identify the root causes and nature of vulnerabilities for the industrial components.…”