Development of a concept for building a critical infrastructure facilities security system

Abstract

To effectively protect critical infrastructure facilities (CIF), it is important to understand the focus of cybersecurity efforts. The concept of building security systems based on a variety of models describing various CIF functioning aspects is presented. The development of the concept is presented as a sequence of solving the following tasks. The basic concepts related to cyberattacks on CIF were determined, which make it possible to outline the boundaries of the problem and determine the level of formalization of the modeling processes. The proposed threat model takes into account possible synergistic/emergent features of the integration of modern target threats and their hybridity. A unified threat base that does not depend on CIF was formed. The concept of modeling the CIF security system was developed based on models of various classes and levels. A method to determine attacker's capabilities was developed. A concept for assessing the CIF security was developed, which allows forming a unified threat base, assessing the signs of their synergy and hybridity, identifying critical CIF points, determining compliance with regulatory requirements and the state of the security system. The mathematical tool and a variety of basic models of the concept can be used for all CIFs, which makes it possible to unify preventive measures and increase the security level. It is proposed to use post-quantum cryptography algorithms on crypto-code structures to provide security services. The proposed mechanisms provide the required stability (230–235 group operations), the rate of cryptographic transformation is comparable to block-symmetric ciphers (BSC) and reliability (Perr 10–9–10–12)

Development of a method for assessing the security of cyber-physical systems based on the Lotka–Volterra model

“…This approach takes into account characteristics and signs of modern threats, minimizes funds to support information security systems (ISS), considering business continuity. To account for the computing resources of attackers, the approach proposed in [26] is used. Simulation of models: "predatorprey" taking into account the computing capabilities and focus of targeted cyberattacks, "predator-prey" taking into account the possible competition of attackers in relation to the "prey", "predator-prey" taking into account relationships between "prey species" and "predator species", "predator-prey" taking into account relationships between "prey species" and "predator species" using a Java Script software package presented on the web resource [27].…”

“…1. Threats are aimed at the corresponding security services, which are represented by the 3rd platform in the threat classifier [26].…”

“…where S is the system security level, F(B) and F(A) are the shares of resources of the parties to the cyber conflict, t is the integration variable that determines the level of available resources of the "predator" and "prey", μ and σ are the values that determine the mathematical expectation and variance of the statistical distribution of the resources available to the parties. The assessment of the maximum capabilities of the parties to a cyber conflict is based on the cost estimates of implementing and preventing the threat, as well as on the assessment of the benefits of implementing and preventing the threat [26].…”

“…where { } , , , , hybrid C I A Au Af synerg W is the cardinality of the set of hybrid threats (i. e., their number), and { } , , , , hybrid C I A Au Af synerg W is the set of hybrid threats, which, according to the accepted assumption, are defined as a set of threats to all security services simultaneously. The calculation of individual components is given in [26].…”

“…To assess the impact of modern threats on protection means, we use the expression in [26], then the coefficient β is represented as:…”