A safety/security risk analysis approach of industrial control systems: a cyber bowtie - combining new version of attack tree with bowtie analysis - Archive ouverte HAL Accéder directement au contenu
Article Dans Une Revue Computers and Security Année : 2017

A safety/security risk analysis approach of industrial control systems: a cyber bowtie - combining new version of attack tree with bowtie analysis

Résumé

The introduction of connected systems and digital technology in process industries creates new cyber-security vulnerabilities that can be exploited by sophisticated threats and lead to undesirable safety accidents. Thus, identifying these vulnerabilities during risk analysis becomes an important part for effective industrial risk evaluation. However, nowadays, safety and security are analyzed separately when they should not be. This is because a security threat can lead to the same dangerous phenomenon as a safety incident. In this paper, a new method that considers safety and security together during industrial risk analysis is proposed. This approach combines bowtie analysis, commonly used for safety analysis, with a new extended version of attack tree analysis, introduced for security analysis of industrial control systems. The combined use of bowtie and attack tree provides an exhaustive representation of risk scenarios in terms of safety and security. We then propose an approach for evaluating the risk level based on two-term likelihood parts, one for safety and one for security. The application of this approach is demonstrated using the case study of a risk scenario in a chemical facility.
Fichier principal
Vignette du fichier
2017-194_post-print.pdf (775.95 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)
Loading...

Dates et versions

hal-01609076 , version 1 (28-08-2018)

Identifiants

Citer

H Abdo, M. Kaouk, J-M. Flaus, F. Masse. A safety/security risk analysis approach of industrial control systems: a cyber bowtie - combining new version of attack tree with bowtie analysis. Computers and Security, 2017, 72, pp.175-195. ⟨10.1016/j.cose.2017.09.004⟩. ⟨hal-01609076⟩
480 Consultations
1868 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More