A security risk mitigation framework for cyber physical systems

Abstract

Cyber physical systems (CPSs) are safety‐critical, be it weapon systems, smart medical devices, or grid stations. This makes ensuring security of all the components constituting a CPS unavoidable. The rise in the demand of interconnectedness has made such systems vulnerable to attacks, ie, cyberattacks. Over 170 cases of cyber‐security breaches in CPS were reported over the past two decades. An increase in the number of cyberattack incidents on CPS makes them more exposed and less trustworthy. However, identifying the security requirements of the CPS to pinpoint the relevant risks may help to counteract the potential attacks. Literature reveals that the most targeted security requirements of CPS are authentication, integrity, and availability. However, little attention has been paid on certain crucial security attributes such as data freshness and nonrepudiation. One major reason of security breaches in CPS is the lack of custom or generalized countermeasures. Therefore, we propose a security risk mitigation framework for a CPS focused on constraints, ie, authentication, data integrity, data freshness, nonrepudiation, and confidentiality. Furthermore, we evaluate the proposed work using a case study of a safety critical system. The results show a decrease in the severity of the identified security risks, ie, man‐in‐the‐middle attack, spoofing, and data tempering.

Safety and security risks management process for cyber‐physical systems: A case study

“…Those techniques were either focused on the identification, assessment, controlling or treating the risks individually. The individual topics (phases of risk management process) covered in literature are risk assessment, 46 risk mitigation, 43 modeling of risk assessment, 47 the recommendations to conduct risk management on smart grid, 47 social infrastructure-related risk management, 48 security risk management of CPS, 49 cybercrime-related risk management, 50 risk mitigation framework for automotive application, 51 cybersecurity risk analysis with remote monitoring the state of object, 52 continuous risk management process for IIOT, 53 the concept of safety risk management and illustrations, 54 and vehiclerelated security risk assessment in transportation. 55 Here, we summarize the key features that lack in the existing risk management techniques for security-safety risks.…”

Security risks in cyber physical systems—A systematic mapping study

“…In terms of security and safety risk assessment of CPS, we observe that many of the standard‐based techniques used the International Organization for Standardization (ISO) standard as a basis for calculating risk values. However, we also observe that some techniques employed a standard, that is, European Norms (EN) and International Electrotechnical Commission (IEC) that was specifically developed for the peculiarities of application domains, that is, railway (EN50128–IEC 61508), 5 avionics (DO‐178B/C), 89 and medical equipment development (ISO 14971) 90…”

“…Since trust, system reliability, and resilience against security threats in CPS are mainly based on data confidentiality, integrity, authenticity, and system's authorized access, 104 some papers have considered them along with availability, fault‐tolerance, and self‐healing to be a crucial factor being integrated in CPS 5 . In our selected set of papers, the most frequently covered security requirements are integrity (in 184 papers), confidentiality (170 papers), and authentication (165), while the most studied dependability attributes consisted of availability (177 papers), reliability (157 papers), and trust (108 papers).…”

“…Successful applications of such systems include communications systems, home appliances, automotive electronics, games, drones, weapons, and aircraft control systems, to name a few. On the other hand, most of the applications of CPS can be found in safety‐critical systems such as medical devices, autonomous vehicles, and other devices involving an environment where safety is of paramount importance 5 . While having a great impact on our society, CPS is said to revolutionize our industry as they have been driving the biggest shift in business and technology since World War II 4…”

“…Despite the awareness of the importance of security requirements and risks in the analysis of CPS, little effort has been spent on consolidating our knowledge on the subject. An overview of the possible risk management techniques that could be integrated into the development and maintenance of CPS contributing to improving its security level is still lacking 5 . Yet understanding of the landscape of the proposed approaches to risk handling in security requirements engineering is beneficial for both practitioners and researchers in the field.…”