Department of Information Security and Communication Technology, Norwegian University of Science and Technology, N-2815 Gjøvik, Norway.
Sensors (Basel). 2021 Mar 1;21(5):1691. doi: 10.3390/s21051691.
The increasingly witnessed integration of information technology with operational technology leads to the formation of Cyber-Physical Systems (CPSs) that intertwine physical and cyber components and connect to each other to form systems-of-systems. This interconnection enables the offering of functionality beyond the combined offering of each individual component, but at the same time increases the cyber risk of the overall system, as such risk propagates between and aggregates at component systems. The complexity of the resulting systems-of-systems in many cases leads to difficulty in analyzing cyber risk. Additionally, the selection of cybersecurity controls that will effectively and efficiently treat the cyber risk is commonly performed manually, or at best with limited automated decision support. In this work, we propose a method for analyzing risk propagation and aggregation in complex CPSs utilizing the results of risk assessments of their individual constituents. Additionally, we propose a method employing evolutionary programming for automating the selection of an optimal set of cybersecurity controls out of a list of available controls, that will minimize the residual risk and the cost associated with the implementation of these measures. We illustrate the workings of the proposed methods by applying them to the navigational systems of two variants of the Cyber-Enabled Ship (C-ES), namely the autonomous ship and the remotely controlled ship. The results are sets of cybersecurity controls applied to those components of the overall system that have been identified in previous studies as the most vulnerable ones; such controls minimize the residual risk, while also minimizing the cost of implementation.
信息技术与运营技术的日益融合导致了网络物理系统（CPSs）的形成，这些系统交织着物理和网络组件，并相互连接形成系统的系统。这种互联使系统能够提供超越每个单独组件组合提供的功能，但同时也增加了整个系统的网络风险，因为这种风险在组件系统之间传播和聚合。在许多情况下，由此产生的系统的复杂性导致分析网络风险变得困难。此外，选择将有效和高效地处理网络风险的网络安全控制通常是手动执行的，或者最多只能使用有限的自动化决策支持。在这项工作中，我们提出了一种利用其各个组成部分的风险评估结果来分析复杂 CPS 中的风险传播和聚合的方法。此外，我们还提出了一种利用进化编程的方法，用于从可用的控制列表中自动选择一组最佳的网络安全控制，以最小化剩余风险和与这些措施的实施相关的成本。我们通过将这些方法应用于两种网络增强型船舶（C-ES）变体的导航系统来演示所提出方法的工作原理，即自主船舶和远程控制船舶。结果是应用于整体系统中那些在前一研究中被确定为最脆弱的组件的网络安全控制；这些控制措施将残余风险降至最低，同时也将实施成本降至最低。
