IDEAS home Printed from https://ideas.repec.org/a/spr/binfse/v65y2023i6d10.1007_s12599-023-00811-0.html
   My bibliography  Save this article

Model-Based Cybersecurity Analysis

Author

Listed:
  • Yuning Jiang

    (Nanyang Technological University
    University of Skövde)

  • Manfred A. Jeusfeld

    (University of Skövde)

  • Jianguo Ding

    (Blekinge Institute of Technology)

  • Elin Sandahl

    (Norgald AB)

Abstract

Critical infrastructure (CIs) such as power grids link a plethora of physical components from many different vendors to the software systems that control them. These systems are constantly threatened by sophisticated cyber attacks. The need to improve the cybersecurity of such CIs, through holistic system modeling and vulnerability analysis, cannot be overstated. This is challenging since a CI incorporates complex data from multiple interconnected physical and computation systems. Meanwhile, exploiting vulnerabilities in different information technology (IT) and operational technology (OT) systems leads to various cascading effects due to interconnections between systems. The paper investigates the use of a comprehensive taxonomy to model such interconnections and the implied dependencies within complex CIs, bridging the knowledge gap between IT security and OT security. The complexity of CI dependence analysis is harnessed by partitioning complicated dependencies into cyber and cyber-physical functional dependencies. These defined functional dependencies further support cascade modeling for vulnerability severity assessment and identification of critical components in a complex system. On top of the proposed taxonomy, the paper further suggests power-grid reference models that enhance the reproducibility and applicability of the proposed method. The methodology followed was design science research (DSR) to support the designing and validation of the proposed artifacts. More specifically, the structural, functional adequacy, compatibility, and coverage characteristics of the proposed artifacts are evaluated through a three-fold validation (two case studies and expert interviews). The first study uses two instantiated power-grid models extracted from existing architectures and frameworks like the IEC 62351 series. The second study involves a real-world municipal power grid.

Suggested Citation

  • Yuning Jiang & Manfred A. Jeusfeld & Jianguo Ding & Elin Sandahl, 2023. "Model-Based Cybersecurity Analysis," Business & Information Systems Engineering: The International Journal of WIRTSCHAFTSINFORMATIK, Springer;Gesellschaft für Informatik e.V. (GI), vol. 65(6), pages 643-676, December.
  • Handle: RePEc:spr:binfse:v:65:y:2023:i:6:d:10.1007_s12599-023-00811-0
    DOI: 10.1007/s12599-023-00811-0
    as

    Download full text from publisher

    File URL: http://link.springer.com/10.1007/s12599-023-00811-0
    File Function: Abstract
    Download Restriction: Access to the full text of the articles in this series is restricted.

    File URL: https://libkey.io/10.1007/s12599-023-00811-0?utm_source=ideas
    LibKey link: if access is restricted and if your library uses this service, LibKey will redirect you to where you can use your library subscription to access this item
    ---><---

    As the access to this document is restricted, you may want to search for a different version of it.

    References listed on IDEAS

    as
    1. Robert Cloutier & Gerrit Muller & Dinesh Verma & Roshanak Nilchiani & Eirik Hole & Mary Bone, 2010. "The Concept of Reference Architectures," Systems Engineering, John Wiley & Sons, vol. 13(1), pages 14-27, March.
    2. Mathias Uslar & Sebastian Rohjans & Christian Neureiter & Filip Pröstl Andrén & Jorge Velasquez & Cornelius Steinbrink & Venizelos Efthymiou & Gianluigi Migliavacca & Seppo Horsmanheimo & Helfried Bru, 2019. "Applying the Smart Grid Architecture Model for Designing and Validating System-of-Systems in the Power and Energy Domain: A European Perspective," Energies, MDPI, vol. 12(2), pages 1-40, January.
    3. M.M. Lankhorst & H.A. Proper & H. Jonkers, 2010. "The Anatomy of the ArchiMate Language," International Journal of Information System Modeling and Design (IJISMD), IGI Global, vol. 1(1), pages 1-32, January.
    4. Robert C Nickerson & Upkar Varshney & Jan Muntermann, 2013. "A method for taxonomy development and its application in information systems," European Journal of Information Systems, Taylor & Francis Journals, vol. 22(3), pages 336-359, May.
    5. Wang, Chaonan & Xing, Liudong & Levitin, Gregory, 2012. "Competing failure analysis in phased-mission systems with functional dependence in one of phases," Reliability Engineering and System Safety, Elsevier, vol. 108(C), pages 90-99.
    6. Ouyang, Min, 2014. "Review on modeling and simulation of interdependent critical infrastructure systems," Reliability Engineering and System Safety, Elsevier, vol. 121(C), pages 43-60.
    7. Astrid Duque-Ramos & Martin Boeker & Ludger Jansen & Stefan Schulz & Miguela Iniesta & Jesualdo Tomás Fernández-Breis, 2014. "Evaluating the Good Ontology Design Guideline (GoodOD) with the Ontology Quality Requirements and Evaluation Method and Metrics (OQuaRE)," PLOS ONE, Public Library of Science, vol. 9(8), pages 1-14, August.
    8. Jarke, M. & Gallesdorfer, R. & Jeusfeld, M.A. & Staudt, M. & Eherer, S., 1995. "ConceptBase - A deductive object base for meta data management," Other publications TiSEM 2e611450-249c-439f-b2d3-b, Tilburg University, School of Economics and Management.
    Full references (including those not matched with items on IDEAS)

    Most related items

    These are the items that most often cite the same works as this one and are cited by the same works as this one.
    1. Masato Yamazaki & Atsushi Koike & Yoshinori Sone, 2018. "A Heuristic Approach to the Estimation of Key Parameters for a Monthly, Recursive, Dynamic CGE Model," Economics of Disasters and Climate Change, Springer, vol. 2(3), pages 283-301, October.
    2. Thorsten Schoormann & Julia Schweihoff & Ilka Jussen & Frederik Möller, 2023. "Classification tools for business models: Status quo, comparison, and agenda," Electronic Markets, Springer;IIM University of St. Gallen, vol. 33(1), pages 1-36, December.
    3. Maggie Wang, Yazhu & Matook, Sabine & Dennis, Alan R., 2024. "Unintended consequences of humanoid service robots: A case study of public service organizations," Journal of Business Research, Elsevier, vol. 174(C).
    4. Peng, Rui & Wu, Di & Xiao, Hui & Xing, Liudong & Gao, Kaiye, 2019. "Redundancy versus protection for a non-reparable phased-mission system subject to external impacts," Reliability Engineering and System Safety, Elsevier, vol. 191(C).
    5. Melina Panzner & Sebastian Enzberg & Maurice Meyer & Roman Dumitrescu, 2024. "Characterization of Usage Data with the Help of Data Classifications," Journal of the Knowledge Economy, Springer;Portland International Center for Management of Engineering and Technology (PICMET), vol. 15(1), pages 88-109, March.
    6. España, Sergio & Thorsteinsdottir, Gudrun & Ramautar, Vijanti & Pastor, Óscar, 2023. "Investigating the links between ethical, social and environmental accounting and strategic management practices through enterprise modelling: technical report," OSF Preprints xv529, Center for Open Science.
    7. Johnson, Caroline A. & Flage, Roger & Guikema, Seth D., 2021. "Feasibility study of PRA for critical infrastructure risk analysis," Reliability Engineering and System Safety, Elsevier, vol. 212(C).
    8. Zou, Qiling & Chen, Suren, 2019. "Enhancing resilience of interdependent traffic-electric power system," Reliability Engineering and System Safety, Elsevier, vol. 191(C).
    9. Hindolo George-Williams & Geng Feng & Frank PA Coolen & Michael Beer & Edoardo Patelli, 2019. "Extending the survival signature paradigm to complex systems with non-repairable dependent failures," Journal of Risk and Reliability, , vol. 233(4), pages 505-519, August.
    10. Mohamad Darayi & Kash Barker & Joost R. Santos, 2017. "Component Importance Measures for Multi-Industry Vulnerability of a Freight Transportation Network," Networks and Spatial Economics, Springer, vol. 17(4), pages 1111-1136, December.
    11. Dylan Sanderson & Sabarethinam Kameshwar & Nathanael Rosenheim & Daniel Cox, 2021. "Deaggregation of multi-hazard damages, losses, risks, and connectivity: an application to the joint seismic-tsunami hazard at Seaside, Oregon," Natural Hazards: Journal of the International Society for the Prevention and Mitigation of Natural Hazards, Springer;International Society for the Prevention and Mitigation of Natural Hazards, vol. 109(2), pages 1821-1847, November.
    12. Hong, Liu & Ye, Bowen & Yan, Han & Zhang, Hui & Ouyang, Min & (Sean) He, Xiaozheng, 2019. "Spatiotemporal vulnerability analysis of railway systems with heterogeneous train flows," Transportation Research Part A: Policy and Practice, Elsevier, vol. 130(C), pages 725-744.
    13. Monsalve, Mauricio & de la Llera, Juan Carlos, 2019. "Data-driven estimation of interdependencies and restoration of infrastructure systems," Reliability Engineering and System Safety, Elsevier, vol. 181(C), pages 167-180.
    14. Heracleous, Constantinos & Kolios, Panayiotis & Panayiotou, Christos G. & Ellinas, Georgios & Polycarpou, Marios M., 2017. "Hybrid systems modeling for critical infrastructures interdependency analysis," Reliability Engineering and System Safety, Elsevier, vol. 165(C), pages 89-101.
    15. Liu, Huan & Tatano, Hirokazu & Pflug, Georg & Hochrainer-Stigler, Stefan, 2021. "Post-disaster recovery in industrial sectors: A Markov process analysis of multiple lifeline disruptions," Reliability Engineering and System Safety, Elsevier, vol. 206(C).
    16. Jochen Wulf & Juerg Meierhofer, 2023. "Towards a Taxonomy of Large Language Model based Business Model Transformations," Papers 2311.05288, arXiv.org.
    17. George-Williams, Hindolo & Patelli, Edoardo, 2017. "Efficient availability assessment of reconfigurable multi-state systems with interdependencies," Reliability Engineering and System Safety, Elsevier, vol. 165(C), pages 431-444.
    18. Thompson, James R. & Frezza, Damon & Necioglu, Burhan & Cohen, Michael L. & Hoffman, Kenneth & Rosfjord, Kristine, 2019. "Interdependent Critical Infrastructure Model (ICIM): An agent-based model of power and water infrastructure," International Journal of Critical Infrastructure Protection, Elsevier, vol. 24(C), pages 144-165.
    19. Alexander Grünewald & Tan Gürpinar & Carina Culotta & Alicia Guderian, 2024. "Archetypes of blockchain-based business models in enterprise networks," Information Systems and e-Business Management, Springer, vol. 22(4), pages 633-665, December.
    20. Dubaniowski, Mateusz Iwo & Heinimann, Hans Rudolf, 2021. "Framework for modeling interdependencies between households, businesses, and infrastructure system, and their response to disruptions—application," Reliability Engineering and System Safety, Elsevier, vol. 212(C).

    Corrections

    All material on this site has been provided by the respective publishers and authors. You can help correct errors and omissions. When requesting a correction, please mention this item's handle: RePEc:spr:binfse:v:65:y:2023:i:6:d:10.1007_s12599-023-00811-0. See general information about how to correct material in RePEc.

    If you have authored this item and are not yet registered with RePEc, we encourage you to do it here. This allows to link your profile to this item. It also allows you to accept potential citations to this item that we are uncertain about.

    If CitEc recognized a bibliographic reference but did not link an item in RePEc to it, you can help with this form .

    If you know of missing items citing this one, you can help us creating those links by adding the relevant references in the same way as above, for each refering item. If you are a registered author of this item, you may also want to check the "citations" tab in your RePEc Author Service profile, as there may be some citations waiting for confirmation.

    For technical questions regarding this item, or to correct its authors, title, abstract, bibliographic or download information, contact: Sonal Shukla or Springer Nature Abstracting and Indexing (email available below). General contact details of provider: http://www.springer.com .

    Please note that corrections may take a couple of weeks to filter through the various RePEc services.

    IDEAS is a RePEc service. RePEc uses bibliographic data supplied by the respective publishers.