IDEAS home Printed from https://ideas.repec.org/a/spr/binfse/v65y2023i6d10.1007_s12599-023-00811-0.html
   My bibliography  Save this article

Model-Based Cybersecurity Analysis

Author

Listed:
  • Yuning Jiang

    (Nanyang Technological University
    University of Skövde)

  • Manfred A. Jeusfeld

    (University of Skövde)

  • Jianguo Ding

    (Blekinge Institute of Technology)

  • Elin Sandahl

    (Norgald AB)

Abstract

Critical infrastructure (CIs) such as power grids link a plethora of physical components from many different vendors to the software systems that control them. These systems are constantly threatened by sophisticated cyber attacks. The need to improve the cybersecurity of such CIs, through holistic system modeling and vulnerability analysis, cannot be overstated. This is challenging since a CI incorporates complex data from multiple interconnected physical and computation systems. Meanwhile, exploiting vulnerabilities in different information technology (IT) and operational technology (OT) systems leads to various cascading effects due to interconnections between systems. The paper investigates the use of a comprehensive taxonomy to model such interconnections and the implied dependencies within complex CIs, bridging the knowledge gap between IT security and OT security. The complexity of CI dependence analysis is harnessed by partitioning complicated dependencies into cyber and cyber-physical functional dependencies. These defined functional dependencies further support cascade modeling for vulnerability severity assessment and identification of critical components in a complex system. On top of the proposed taxonomy, the paper further suggests power-grid reference models that enhance the reproducibility and applicability of the proposed method. The methodology followed was design science research (DSR) to support the designing and validation of the proposed artifacts. More specifically, the structural, functional adequacy, compatibility, and coverage characteristics of the proposed artifacts are evaluated through a three-fold validation (two case studies and expert interviews). The first study uses two instantiated power-grid models extracted from existing architectures and frameworks like the IEC 62351 series. The second study involves a real-world municipal power grid.

Suggested Citation

  • Yuning Jiang & Manfred A. Jeusfeld & Jianguo Ding & Elin Sandahl, 2023. "Model-Based Cybersecurity Analysis," Business & Information Systems Engineering: The International Journal of WIRTSCHAFTSINFORMATIK, Springer;Gesellschaft für Informatik e.V. (GI), vol. 65(6), pages 643-676, December.
  • Handle: RePEc:spr:binfse:v:65:y:2023:i:6:d:10.1007_s12599-023-00811-0
    DOI: 10.1007/s12599-023-00811-0
    as

    Download full text from publisher

    File URL: http://link.springer.com/10.1007/s12599-023-00811-0
    File Function: Abstract
    Download Restriction: Access to the full text of the articles in this series is restricted.

    File URL: https://libkey.io/10.1007/s12599-023-00811-0?utm_source=ideas
    LibKey link: if access is restricted and if your library uses this service, LibKey will redirect you to where you can use your library subscription to access this item
    ---><---

    As the access to this document is restricted, you may want to search for a different version of it.

    References listed on IDEAS

    as
    1. Ouyang, Min, 2014. "Review on modeling and simulation of interdependent critical infrastructure systems," Reliability Engineering and System Safety, Elsevier, vol. 121(C), pages 43-60.
    2. Astrid Duque-Ramos & Martin Boeker & Ludger Jansen & Stefan Schulz & Miguela Iniesta & Jesualdo Tomás Fernández-Breis, 2014. "Evaluating the Good Ontology Design Guideline (GoodOD) with the Ontology Quality Requirements and Evaluation Method and Metrics (OQuaRE)," PLOS ONE, Public Library of Science, vol. 9(8), pages 1-14, August.
    3. M.M. Lankhorst & H.A. Proper & H. Jonkers, 2010. "The Anatomy of the ArchiMate Language," International Journal of Information System Modeling and Design (IJISMD), IGI Global, vol. 1(1), pages 1-32, January.
    4. Robert Cloutier & Gerrit Muller & Dinesh Verma & Roshanak Nilchiani & Eirik Hole & Mary Bone, 2010. "The Concept of Reference Architectures," Systems Engineering, John Wiley & Sons, vol. 13(1), pages 14-27, March.
    5. Mathias Uslar & Sebastian Rohjans & Christian Neureiter & Filip Pröstl Andrén & Jorge Velasquez & Cornelius Steinbrink & Venizelos Efthymiou & Gianluigi Migliavacca & Seppo Horsmanheimo & Helfried Bru, 2019. "Applying the Smart Grid Architecture Model for Designing and Validating System-of-Systems in the Power and Energy Domain: A European Perspective," Energies, MDPI, vol. 12(2), pages 1-40, January.
    6. Robert C Nickerson & Upkar Varshney & Jan Muntermann, 2013. "A method for taxonomy development and its application in information systems," European Journal of Information Systems, Taylor & Francis Journals, vol. 22(3), pages 336-359, May.
    7. Wang, Chaonan & Xing, Liudong & Levitin, Gregory, 2012. "Competing failure analysis in phased-mission systems with functional dependence in one of phases," Reliability Engineering and System Safety, Elsevier, vol. 108(C), pages 90-99.
    8. Jarke, M. & Gallesdorfer, R. & Jeusfeld, M.A. & Staudt, M. & Eherer, S., 1995. "ConceptBase - A deductive object base for meta data management," Other publications TiSEM 2e611450-249c-439f-b2d3-b, Tilburg University, School of Economics and Management.
    Full references (including those not matched with items on IDEAS)

    Most related items

    These are the items that most often cite the same works as this one and are cited by the same works as this one.
    1. Masato Yamazaki & Atsushi Koike & Yoshinori Sone, 2018. "A Heuristic Approach to the Estimation of Key Parameters for a Monthly, Recursive, Dynamic CGE Model," Economics of Disasters and Climate Change, Springer, vol. 2(3), pages 283-301, October.
    2. Thorsten Schoormann & Julia Schweihoff & Ilka Jussen & Frederik Möller, 2023. "Classification tools for business models: Status quo, comparison, and agenda," Electronic Markets, Springer;IIM University of St. Gallen, vol. 33(1), pages 1-36, December.
    3. Sellevåg, Stig Rune, 2021. "Changes in inoperability for interdependent industry sectors in Norway from 2012 to 2017," International Journal of Critical Infrastructure Protection, Elsevier, vol. 32(C).
    4. Maggie Wang, Yazhu & Matook, Sabine & Dennis, Alan R., 2024. "Unintended consequences of humanoid service robots: A case study of public service organizations," Journal of Business Research, Elsevier, vol. 174(C).
    5. Sascha Julian Oks & Max Jalowski & Michael Lechner & Stefan Mirschberger & Marion Merklein & Birgit Vogel-Heuser & Kathrin M. Möslein, 2024. "Cyber-Physical Systems in the Context of Industry 4.0: A Review, Categorization and Outlook," Information Systems Frontiers, Springer, vol. 26(5), pages 1731-1772, October.
    6. Trucco, Paolo & Petrenj, Boris, 2023. "Characterisation of resilience metrics in full-scale applications to interdependent infrastructure systems," Reliability Engineering and System Safety, Elsevier, vol. 235(C).
    7. Wang, Chaonan & Xing, Liudong & Levitin, Gregory, 2013. "Reliability analysis of multi-trigger binary systems subject to competing failures," Reliability Engineering and System Safety, Elsevier, vol. 111(C), pages 9-17.
    8. Oster, Matthew R. & Amburg, Ilya & Chatterjee, Samrat & Eisenberg, Daniel A. & Thomas, Dennis G. & Pan, Feng & Ganguly, Auroop R., 2024. "A tri-level optimization model for interdependent infrastructure network resilience against compound hazard events," International Journal of Critical Infrastructure Protection, Elsevier, vol. 47(C).
    9. Peng, Rui & Wu, Di & Xiao, Hui & Xing, Liudong & Gao, Kaiye, 2019. "Redundancy versus protection for a non-reparable phased-mission system subject to external impacts," Reliability Engineering and System Safety, Elsevier, vol. 191(C).
    10. Dikshit, Saransh & Dobson, Ian & Alipour, Alice, 2024. "Cascading structural failures of towers in an electric power transmission line due to straight line winds," Reliability Engineering and System Safety, Elsevier, vol. 250(C).
    11. Melina Panzner & Sebastian Enzberg & Maurice Meyer & Roman Dumitrescu, 2024. "Characterization of Usage Data with the Help of Data Classifications," Journal of the Knowledge Economy, Springer;Portland International Center for Management of Engineering and Technology (PICMET), vol. 15(1), pages 88-109, March.
    12. España, Sergio & Thorsteinsdottir, Gudrun & Ramautar, Vijanti & Pastor, Óscar, 2023. "Investigating the links between ethical, social and environmental accounting and strategic management practices through enterprise modelling: technical report," OSF Preprints xv529, Center for Open Science.
    13. Mazur, Christoph & Hoegerle, Yannick & Brucoli, Maria & van Dam, Koen & Guo, Miao & Markides, Christos N. & Shah, Nilay, 2019. "A holistic resilience framework development for rural power systems in emerging economies," Applied Energy, Elsevier, vol. 235(C), pages 219-232.
    14. Johnson, Caroline A. & Flage, Roger & Guikema, Seth D., 2021. "Feasibility study of PRA for critical infrastructure risk analysis," Reliability Engineering and System Safety, Elsevier, vol. 212(C).
    15. Zou, Qiling & Chen, Suren, 2019. "Enhancing resilience of interdependent traffic-electric power system," Reliability Engineering and System Safety, Elsevier, vol. 191(C).
    16. Shihab Uddin & Qing Lu & Hung Nguyen, 2021. "Truck Impact on Buried Water Pipes in Interdependent Water and Road Infrastructures," Sustainability, MDPI, vol. 13(20), pages 1-16, October.
    17. Hausken, Kjell, 2024. "Fifty Years of Operations Research in Defense," European Journal of Operational Research, Elsevier, vol. 318(2), pages 355-368.
    18. Moglen, Rachel L. & Barth, Julius & Gupta, Shagun & Kawai, Eiji & Klise, Katherine & Leibowicz, Benjamin D., 2023. "A nexus approach to infrastructure resilience planning under uncertainty," Reliability Engineering and System Safety, Elsevier, vol. 230(C).
    19. Hindolo George-Williams & Geng Feng & Frank PA Coolen & Michael Beer & Edoardo Patelli, 2019. "Extending the survival signature paradigm to complex systems with non-repairable dependent failures," Journal of Risk and Reliability, , vol. 233(4), pages 505-519, August.
    20. Mohamad Darayi & Kash Barker & Joost R. Santos, 2017. "Component Importance Measures for Multi-Industry Vulnerability of a Freight Transportation Network," Networks and Spatial Economics, Springer, vol. 17(4), pages 1111-1136, December.

    Corrections

    All material on this site has been provided by the respective publishers and authors. You can help correct errors and omissions. When requesting a correction, please mention this item's handle: RePEc:spr:binfse:v:65:y:2023:i:6:d:10.1007_s12599-023-00811-0. See general information about how to correct material in RePEc.

    If you have authored this item and are not yet registered with RePEc, we encourage you to do it here. This allows to link your profile to this item. It also allows you to accept potential citations to this item that we are uncertain about.

    If CitEc recognized a bibliographic reference but did not link an item in RePEc to it, you can help with this form .

    If you know of missing items citing this one, you can help us creating those links by adding the relevant references in the same way as above, for each refering item. If you are a registered author of this item, you may also want to check the "citations" tab in your RePEc Author Service profile, as there may be some citations waiting for confirmation.

    For technical questions regarding this item, or to correct its authors, title, abstract, bibliographic or download information, contact: Sonal Shukla or Springer Nature Abstracting and Indexing (email available below). General contact details of provider: http://www.springer.com .

    Please note that corrections may take a couple of weeks to filter through the various RePEc services.

    IDEAS is a RePEc service. RePEc uses bibliographic data supplied by the respective publishers.