Threat awareness for critical infrastructures resilience

Abstract

Abstract-Utility networks are part of every nation's critical infrastructure, and their protection is now seen as a high priority objective. In this paper, we propose a threat awareness architecture for critical infrastructures, which we believe will raise security awareness and increase resilience in utility networks. We first describe an investigation of trends and threats that may impose security risks in utility networks. This was performed on the basis of a viewpoint approach that is capable of identifying technical and non-technical issues (e.g., behaviour of humans). The result of our analysis indicated that utility networks are affected strongly by technological trends, but that humans comprise an important threat to them. This provided evidence and confirmed that the protection of utility networks is a multi-variable problem, and thus, requires the examination of information stemming from various viewpoints of a network. In order to accomplish our objective, we propose a systematic threat awareness architecture in the context of a resilience strategy, which ultimately aims at providing and maintaining an acceptable level of security and safety in critical infrastructures. As a proof of concept, we demonstrate partially via a case study the application of the proposed threat awareness architecture, where we examine the potential impact of attacks in the context of social engineering in a European utility company.

Design and Engineering of Resilience for Networked Computer Systems

“…They classify the taxonomy of operational cyber security risks into four main groups: (a) actions of people is considered with actions taken or not taken by individuals in a given situation; (b) systems and technology failures refers to technology assets and specifically in their problematic, abnormal or unexpected functioning; (c) failed internal processes refers to needed or expected performance of internal processes and associations with problematic failures; and (d) external events refers to external events that might affect an organization's control. Therefore, to consider how a system's risk is affected when various type of changes apply to a system, it is required to examine the system under organization, technology, and individual (OTI) viewpoints (Gouglidis, Green, et al, 2016). The organization viewpoint is concerned with the groups of people who work together in an organized way for a shared purpose as well as any type of policies, processes, and procedures in the organization.…”

“…As part of our attempt to understand some of the human and organizational factors involved in resilience, we conducted ethnographic observations and interviews in various utility and information organizations in different parts of Europe (Gouglidis, Green, et al, 2016). In our analysis of the ethnographic data and in trying to understand the components of individual and organizational resilience, we were interested in unpacking people's ideas about risk and how these might relate to other notions such as trust or organizational resilience.…”

A Survey on Threat Situation Awareness Systems: Framework, Techniques, and Insights

“…These attackers also have intelligence with regard to their resources, executing adaptive attacks [146] that wisely manage their resource limits and at the same time opportunistically seek to compromise an entire system. Kaloudi and Li [81] investigated the AI-powered cyber attacks and mapped them onto a proposed framework with new threats including the classification of several aspects trusted relationship [23] valid account [147] Fake event [105] spear-phishing [53] Execution exploit execution [53] code execution [125] Privilege Escalation unauthorized write [174] Hijack/DoS [174] Elevation of privileges [167] Root access [91] User privileges [174] Root privileges [174] Defense Evasion Backdoor [147] Authentication bypass [91] unauthorized access [174] Persistence Extended privileges [60] Credential Access Phishing [153] Defacement [147] credential leak [152] Password brute force [147] Discovery…”