Cyber security management model for critical infrastructure

Abstract

Cyber security is the most critical aspect nowadays of our technologically based lives. Government institutions, banking sectors, public and private services, nuclear power plants, power grid operators, water suppliers or waste water treatment companies use information technologies in their day-to-day operations. Everything that uses technologies are based on communication and information systems and that means that it depends on cyber security. The public and private sector each year spend millions of dollars on technologies, security software and hardware devices that will increase the cyber security inside their companies, but they are still vulnerable. The main problem of this situation is that cyber security is still usually treated as a technical aspect or technology which can be easily implemented inside the organization and this implementation will guarantee cyber security. This attitude must change, because cyber security nowadays is something more than just the technology. This article presents the taxonomy of the critical infrastructure attacks, analyzes attack vectors and attack methods used to damage critical infrastructure as well as the most common cyber security mistakes which organizations make in the cyber security field when trying to make themselves safer from vulnerabilities. The main aim of this article is to provide theoretical aspects of the cyber security management model which can be used to ensure security of critical infrastructure in an organization or company. The cyber security management model that is presented in this article is analyzed from management perspectives and is not concerned with technological aspects and products that are used to protect critical infrastructure from cyber security attacks and vulnerabilities.

Cyber effect and security management aspects in critical energy infrastructures

“…While not being able to develop a precise degree of accuracy or to classify the framework for "best application", it is, however, possible to highlight the best solutions to the issues in CEI. To develop an effective cybersecurity model, the structure that will be taken into consideration will be the one described by Limba & Pleta (Limba et al 2017 IRD.2020.2.2(3) legal regulation, meaning that there are legal proceedings and requirements about cybersecurity, good governance, which means that the main aims of cybersecurity need to be understood (including the fact that some risks could never be excluded) (Limba et al 2017). However, the most important dimensions taken into the analysis will be risk management, security culture, as the organization is "as vulnerable as the people working there", technology management and incident management (Limba et al 2017).…”

“…For what concerns the risk management, it is described as the ability to properly identify risks ad ensuring that they are being taken care of by specialists (Limba et al 2017). The document that provided the most adequate guidelines for a hypothetical CEI framework is the NERC Implementation Guidance for CIP-008-6.…”

“…Lastly, for technology management, the most interesting approach was offered by the Security PHA Review for Consequence-Based Cybersecurity, as it offered the knowledge about each component that is controlled by IT can be vulnerable (Limba et al 2017). As mentioned in the previous analysis, the scenario-based approach is the best one that can thoroughly analyze every single component of an ICS system.…”

Emerging Cyber Security Threats in Organization

“…By making your team aware of their responsibilities and the consequences of mistakes and negative behavior you can create a culture of accountability. This also has the more positive effect of highlighting any issues that exist before they develop into full problems which can then be dealt with training or increased monitoring [11].…”

Cybersecurity in the Era of Digital Transformation: The case of Greece

“…Cybersecurity is a very important aspect of the digital development that every country around the globe aims to achieve [1]. In order to offer new online applications and remote services to citizens, these must be secured and robust to several attacks.…”