Cybersecurity Resilience Maturity Assessment Tool for Critical National Information Infrastructure

Abstract

Cybersecurity resilience maturity assessment of critical national information infrastructure (CNII) is an important process in ensuring that organisations’ capability for resilience are measured and gaps determined vis-à-vis targeted resilience for the purpose of improvements. However, existing solutions do not provide an automated quantitative tool to enable organisation conduct the assessment of their cybersecurity resilience posture at defined regular intervals. This paper presents the cybersecurity resilience maturity assessment tool (CRMAT). The CRMAT is built on the cybersecurity resilience maturity assessment framework and the cybersecurity resilience maturity assessment model (CRMAM). While the CRMAF and CRMAM provide requirements and computational algorithms for the tool respectively. The agile methodology of the software development life cycle (SDLC) was adopted with the MVC (model-view-controller) architectural pattern to implement the software. The software tool has two interfaces, namely; admin interface that enables the setup of the cybersecurity controls and other parameters that will form the basis for the assessment and a report generation interface for all the cybersecurity controls. CRMAT was demonstrated on 31 CNIII organisations and result showed its capability to successfully and accurately compute the CNII resilience index (CNIIRI) and the indexes of other cybersecurity controls indicated in the CRMAF. Comparative analysis of the results showed that 5 (16.13%) of the organisations are in Q4, 9 (29.03%) are in Q3 while 13 (41.94%) and 4 (12.90%) are in Q2 and Q1 respectively. The implication is that the organisations in Q4 has optimised resilience while those in Q1 have the weakest cybersecurity resilience.

Cyber Resilience Enabled by Endogenous Security and Safety: Vision, Techniques, and Strategies

“…重要技术文件 [12] 。NIST 将网络弹性定义为：拥有网 恢复机制 [15] 。但是，对于未知网络攻击，因缺少先 验知识可能无法感知相关异常，致使难以保障关键 业务系统承载平台的安全性和关键业务系统的可信 性，更无法达成"使命确保"的核心目标 [16] 。虽然 现有的网络弹性工程框架设定了"假设资源会失 陷"的原则，给出了面对未知威胁应采取的策略， 指出了存在无法检测未知威胁的可能性 [17] ，但目前 给出的解决思路仅限于被动的失陷影响分析，未能 给出主动的应对方法。 二是网络弹性工程框架缺乏顶层设计。自网络 弹性概念及其工程框架提出以来，实现网络弹性始 终是研究重点。网络弹性工程框架应能抵御攻击， 受到攻击时继续提供基本服务，被攻击后能快速恢 复功能。迄今为止，满足上述要求的网络弹性工程 框架尚未形成。网络弹性工程的框架设计是需要解 决的五大硬核问题之一 [18] ，但研究进展有限 [19] 。网 络弹性度越强，网络可生存能力就越强 [20,21] ，但是 由于没有统领性的网络弹性工程框架，目前无法实 施有效统一的抵抗网络安全威胁策略。 三是网络弹性评估缺乏科学度量方法 [22] 。美 国、欧洲等国家和地区虽高度重视网络弹性评估， 但始终未能解决"数字化产品"安全性能验证度量 这一世界性难题，无法给出安全性能量化验证的技 术指标 [23] 。美国国防部提出了网络弹性存在三大挑 战：系统具备良好网络弹性的判定标准，不同系统 之间网络弹性的比较，系统网络弹性核心能力的评 估。这些挑战性问题悬而未决致使网络弹性工程及 网络弹性法案难以落地。究其原因主要是：存在评 估复杂性与重大核心能力指标选取关系问题 [24] ；评 构，在非相似余度构造 [28,29] 上导入基于策略裁决的动 态反馈控制和运行环境结构加密等新机制 [30,31] ，具有 拟态伪装迷雾、熵不减与不确定效应 [27] 、广义功能…”