IDEAS home Printed from https://ideas.repec.org/a/eee/reensy/v213y2021ics0951832021002234.html
   My bibliography  Save this article

Outage and asset damage triggered by malicious manipulation of the control system in process plants

Author

Listed:
  • Iaiani, Matteo
  • Tugnoli, Alessandro
  • Macini, Paolo
  • Cozzani, Valerio

Abstract

Intentional acts consisting in remote (cyber) or physical manipulations of the BPCS (Basic Process Control System) and the SIS (Safety Instrumented System) of a process plant may result in severe consequences for the affected industrial facilities. Interruption of productivity, with or without asset damages, generally results in huge economic losses and, at times, in damages to reputation, people and the environment. Despite the existence of several international standards aimed at the assessment and management of cybersecurity of IT (Information Technology) and OT (Operational Technology) systems of a facility, only few contributions are present in the literature addressing the concrete connection between malicious manipulations of the BPCS and SIS systems and the impacts on the physical process system that can be initiated. In this panorama, the present work fills this gap by developing a systematic qualitative methodology supporting the identification of possible security events affecting the operability and/or system integrity of a process plant, of the malicious manipulations by which they may be initiated, and of the existing safeguards in place. The results can be used within the standard procedure for cyber risk management of the IT-OT system (e.g. ISA/IEC 62443), to support the identification of protection requirements and countermeasures. The methodology is complementary to current safety and security assessments and is intended for application to front-end design phase as well as to the security review of operating plants. The methodology was applied to a case study (an offshore Oil&Gas compression plant) to demonstrate the potential of the methodology and the results obtained.

Suggested Citation

  • Iaiani, Matteo & Tugnoli, Alessandro & Macini, Paolo & Cozzani, Valerio, 2021. "Outage and asset damage triggered by malicious manipulation of the control system in process plants," Reliability Engineering and System Safety, Elsevier, vol. 213(C).
    • Handle: RePEc:eee:reensy:v:213:y:2021:i:c:s0951832021002234
    DOI: 10.1016/j.ress.2021.107685
    as

    Download full text from publisher

    File URL: http://www.sciencedirect.com/science/article/pii/S0951832021002234
    Download Restriction: Full text for ScienceDirect subscribers only
    File URL: https://libkey.io/10.1016/j.ress.2021.107685?utm_source=ideas
    LibKey link: if access is restricted and if your library uses this service, LibKey will redirect you to where you can use your library subscription to access this item
    ---><---

    As the access to this document is restricted, you may want to search for a different version of it.

    References listed on IDEAS

    as
    1. Bier, Vicki & Gutfraind, Alexander, 2019. "Risk analysis beyond vulnerability and resilience – characterizing the defensibility of critical systems," European Journal of Operational Research, Elsevier, vol. 276(2), pages 626-636.
    2. IAIANI, Matteo & TUGNOLI, Alessandro & BONVICINI, Sarah & COZZANI, Valerio, 2021. "Analysis of Cybersecurity-related Incidents in the Process Industry," Reliability Engineering and System Safety, Elsevier, vol. 209(C).
    3. Palmer, C. & Chung, P.W.H., 2009. "An automated system for batch hazard and operability studies," Reliability Engineering and System Safety, Elsevier, vol. 94(6), pages 1095-1106.
    4. Matteini, Anita & Argenti, Francesca & Salzano, Ernesto & Cozzani, Valerio, 2019. "A comparative analysis of security risk assessment methodologies for the chemical industry," Reliability Engineering and System Safety, Elsevier, vol. 191(C).
    5. Hausken, Kjell & Levitin, Gregory, 2009. "Minmax defense strategy for complex multi-state systems," Reliability Engineering and System Safety, Elsevier, vol. 94(2), pages 577-587.
    6. Kriaa, Siwar & Pietre-Cambacedes, Ludovic & Bouissou, Marc & Halgand, Yoran, 2015. "A survey of approaches combining safety and security for industrial control systems," Reliability Engineering and System Safety, Elsevier, vol. 139(C), pages 156-178.
    7. Kjell Hausken, 2017. "Security Investment, Hacking, and Information Sharing between Firms and between Hackers," Games, MDPI, vol. 8(2), pages 1-23, May.
    8. Hausken, Kjell, 2021. "The precautionary principle as multi-period games where players have different thresholds for acceptable uncertainty," Reliability Engineering and System Safety, Elsevier, vol. 206(C).
    9. Frank H. Koch & Denys Yemshanov & Daniel W. McKenney & William D. Smith, 2009. "Evaluating Critical Uncertainty Thresholds in a Spatial Model of Forest Pest Invasion Risk," Risk Analysis, John Wiley & Sons, vol. 29(9), pages 1227-1241, September.
    10. Bostick, T.P. & Connelly, E.B. & Lambert, J.H. & Linkov, I., 2018. "Resilience science, policy and investment for civil infrastructure," Reliability Engineering and System Safety, Elsevier, vol. 175(C), pages 19-23.
    Full references (including those not matched with items on IDEAS)

    Citations

    Citations are extracted by the CitEc Project, subscribe to its RSS feed for this item.
    as


    Cited by:

    1. Tang, Daogui & Fang, Yi-Ping & Zio, Enrico, 2023. "Vulnerability analysis of demand-response with renewable energy integration in smart grids to cyber attacks and online detection methods," Reliability Engineering and System Safety, Elsevier, vol. 235(C).
    2. Lilli, Giordano & Sanavia, Matteo & Oboe, Roberto & Vianello, Chiara & Manzolaro, Mattia & De Ruvo, Pasquale Luca & Andrighetto, Alberto, 2024. "A semi-quantitative risk assessment of remote handling operations on the SPES Front-End based on HAZOP-LOPA," Reliability Engineering and System Safety, Elsevier, vol. 241(C).

    Most related items

    These are the items that most often cite the same works as this one and are cited by the same works as this one.
    1. Rana Alabdan, 2020. "Phishing Attacks Survey: Types, Vectors, and Technical Approaches," Future Internet, MDPI, vol. 12(10), pages 1-37, September.
    2. Lin, Chen & Xiao, Hui & Peng, Rui & Xiang, Yisha, 2021. "Optimal defense-attack strategies between M defenders and N attackers: A method based on cumulative prospect theory," Reliability Engineering and System Safety, Elsevier, vol. 210(C).
    3. Chen, Chao & Yang, Ming & Reniers, Genserik, 2021. "A dynamic stochastic methodology for quantifying HAZMAT storage resilience," Reliability Engineering and System Safety, Elsevier, vol. 215(C).
    4. Li, Qing & Li, Mingchu & Tian, Yuan & Gan, Jianyuan, 2023. "A risk-averse tri-level stochastic model for locating and recovering facilities against attacks in an uncertain environment," Reliability Engineering and System Safety, Elsevier, vol. 229(C).
    5. Wei Wang & Francesco Di Maio & Enrico Zio, 2019. "Adversarial Risk Analysis to Allocate Optimal Defense Resources for Protecting Cyber–Physical Systems from Cyber Attacks," Risk Analysis, John Wiley & Sons, vol. 39(12), pages 2766-2785, December.
    6. Iaiani, Matteo & Sorichetti, Riccardo & Tugnoli, Alessandro & Cozzani, Valerio, 2024. "Modelling standoff distances to prevent escalation in shooting attacks to tanks storing hazardous materials," Reliability Engineering and System Safety, Elsevier, vol. 241(C).
    7. Chen, Shun & Zhao, Xudong & Chen, Zhilong & Hou, Benwei & Wu, Yipeng, 2022. "A game-theoretic method to optimize allocation of defensive resource to protect urban water treatment plants against physical attacks," International Journal of Critical Infrastructure Protection, Elsevier, vol. 36(C).
    8. Zhang, Chi & Ramirez-Marquez, José Emmanuel & Wang, Jianhui, 2015. "Critical infrastructure protection using secrecy – A discrete simultaneous game," European Journal of Operational Research, Elsevier, vol. 242(1), pages 212-221.
    9. Xiansheng Chen & Ruisong Quan, 2021. "A spatiotemporal analysis of urban resilience to the COVID-19 pandemic in the Yangtze River Delta," Natural Hazards: Journal of the International Society for the Prevention and Mitigation of Natural Hazards, Springer;International Society for the Prevention and Mitigation of Natural Hazards, vol. 106(1), pages 829-854, March.
    10. Bose, Gautam & Konrad, Kai A., 2020. "Devil take the hindmost: Deflecting attacks to other defenders," Reliability Engineering and System Safety, Elsevier, vol. 204(C).
    11. Suyuan Luo & Tsan‐Ming Choi, 2022. "E‐commerce supply chains with considerations of cyber‐security: Should governments play a role?," Production and Operations Management, Production and Operations Management Society, vol. 31(5), pages 2107-2126, May.
    12. Levitin, Gregory & Hausken, Kjell, 2009. "Intelligence and impact contests in systems with redundancy, false targets, and partial protection," Reliability Engineering and System Safety, Elsevier, vol. 94(12), pages 1927-1941.
    13. Witold Torbacki, 2021. "A Hybrid MCDM Model Combining DANP and PROMETHEE II Methods for the Assessment of Cybersecurity in Industry 4.0," Sustainability, MDPI, vol. 13(16), pages 1-35, August.
    14. Siwar Kriaa & Marc Bouissou & Youssef Laarouchi, 2019. "A new safety and security risk analysis framework for industrial control systems," Journal of Risk and Reliability, , vol. 233(2), pages 151-174, April.
    15. Wang, Wei & Cammi, Antonio & Di Maio, Francesco & Lorenzi, Stefano & Zio, Enrico, 2018. "A Monte Carlo-based exploration framework for identifying components vulnerable to cyber threats in nuclear power plants," Reliability Engineering and System Safety, Elsevier, vol. 175(C), pages 24-37.
    16. Xiaoge Zhang & Sankaran Mahadevan & Kai Goebel, 2019. "Network Reconfiguration for Increasing Transportation System Resilience Under Extreme Events," Risk Analysis, John Wiley & Sons, vol. 39(9), pages 2054-2075, September.
    17. Mark C. Quigley & Januka Attanayake & Andrew King & Fabian Prideaux, 2020. "A multi-hazards earth science perspective on the COVID-19 pandemic: the potential for concurrent and cascading crises," Environment Systems and Decisions, Springer, vol. 40(2), pages 199-215, June.
    18. Guizhou Wang & Jonathan W. Welburn & Kjell Hausken, 2020. "A Two-Period Game Theoretic Model of Zero-Day Attacks with Stockpiling," Games, MDPI, vol. 11(4), pages 1-26, December.
    19. Maureen S. Golan & Laura H. Jernegan & Igor Linkov, 2020. "Trends and applications of resilience analytics in supply chain modeling: systematic literature review in the context of the COVID-19 pandemic," Environment Systems and Decisions, Springer, vol. 40(2), pages 222-243, June.
    20. Kim, Hee Eun & Son, Han Seong & Kim, Jonghyun & Kang, Hyun Gook, 2017. "Systematic development of scenarios caused by cyber-attack-induced human errors in nuclear power plants," Reliability Engineering and System Safety, Elsevier, vol. 167(C), pages 290-301.

    Corrections

    All material on this site has been provided by the respective publishers and authors. You can help correct errors and omissions. When requesting a correction, please mention this item's handle: RePEc:eee:reensy:v:213:y:2021:i:c:s0951832021002234. See general information about how to correct material in RePEc.

    If you have authored this item and are not yet registered with RePEc, we encourage you to do it here. This allows to link your profile to this item. It also allows you to accept potential citations to this item that we are uncertain about.

    If CitEc recognized a bibliographic reference but did not link an item in RePEc to it, you can help with this form .

    If you know of missing items citing this one, you can help us creating those links by adding the relevant references in the same way as above, for each refering item. If you are a registered author of this item, you may also want to check the "citations" tab in your RePEc Author Service profile, as there may be some citations waiting for confirmation.

    For technical questions regarding this item, or to correct its authors, title, abstract, bibliographic or download information, contact: Catherine Liu (email available below). General contact details of provider: https://www.journals.elsevier.com/reliability-engineering-and-system-safety .

    Please note that corrections may take a couple of weeks to filter through the various RePEc services.

    IDEAS is a RePEc service. RePEc uses bibliographic data supplied by the respective publishers.