Handling of advanced persistent threats and complex incidents in healthcare, transportation and energy ICT infrastructures

Abstract

In recent years, the use of information technologies in Critical Infrastructures is gradually increasing. Although this brings benefits, it also increases the possibility of security attacks. Despite the availability of various advanced incident handling techniques and tools, there is still no easy, structured, standardized and trusted way to manage and forecast interrelated cybersecurity incidents. This paper introduces CyberSANE, a novel dynamic and collaborative, warning and response system, which supports security officers and operators to recognize, identify, dynamically analyse, forecast, treat and respond to security threats and risks and and it guides them to handle effectively cyber incidents. The components of CyberSANE are described along with a description of the CyberSANE data flow. The main novelty of the CyberSANE system is the fact that it enables the combination of active incident handling approaches with reactive approaches to support incidents of compound, highly dependent Critical Information Infrastructures. The benefits and added value of using CyberSANE is described with the aid of a set of cyber-attack scenarios.

The Development and Issues of Energy-ICT: A Review of Literature with Economic and Managerial Viewpoints

“…Energy-ICT is an integrated physical-information network. The integration of energy and ICT also inevitably exposes itself to cybersecurity threats (see [6] and [71][72][73][74][75][76][77][78][79][80][81][82][83][84][85][86]). Venkatachary et al [71] remind us that ICT connects multiple sectors as well as that of energy; however, the interdependence of these sectors generates security gaps.…”

“…Papastergiou et al [77] warn that energy-ICT faces persistent threats and complex incidents. In order to deal with these persistent threats and complex incidents, dynamic, collaborative, warning, and response system components are required.…”

Machine Learning-Enabled IoT Security: Open Issues and Challenges Under Advanced Persistent Threats

“…This information is used to assist in completing the Initial Compromise phase. Target network's infrastructure information includes the models of network switches, routers, and the communication protocols used in the network [117]. Attackers use covert attack methods based on this information to ensure their security and construct a reasonable attack path to bypass the network administrators and IDS.…”

Cyber Security Resilience in Business Informatics: An Exploratory Paper

“…Their security analysis involves many individual components and that can make security processes costly, time consuming and even unimplementable [2]. Secondly, the uncertainties associated with the vulnerabilities, combined with the unpredictability of cyber incidents, challenges our ability to understand and manage them [3].…”