IDEAS home Printed from https://ideas.repec.org/a/wly/riskan/v29y2009i2p223-248.html
   My bibliography  Save this article

A Comprehensive Network Security Risk Model for Process Control Networks

Author

Listed:
  • Matthew H. Henry
  • Yacov Y. Haimes

Abstract

The risk of cyber attacks on process control networks (PCN) is receiving significant attention due to the potentially catastrophic extent to which PCN failures can damage the infrastructures and commodity flows that they support. Risk management addresses the coupled problems of (1) reducing the likelihood that cyber attacks would succeed in disrupting PCN operation and (2) reducing the severity of consequences in the event of PCN failure or manipulation. The Network Security Risk Model (NSRM) developed in this article provides a means of evaluating the efficacy of candidate risk management policies by modeling the baseline risk and assessing expectations of risk after the implementation of candidate measures. Where existing risk models fall short of providing adequate insight into the efficacy of candidate risk management policies due to shortcomings in their structure or formulation, the NSRM provides model structure and an associated modeling methodology that captures the relevant dynamics of cyber attacks on PCN for risk analysis. This article develops the NSRM in detail in the context of an illustrative example.

Suggested Citation

  • Matthew H. Henry & Yacov Y. Haimes, 2009. "A Comprehensive Network Security Risk Model for Process Control Networks," Risk Analysis, John Wiley & Sons, vol. 29(2), pages 223-248, February.
    • Handle: RePEc:wly:riskan:v:29:y:2009:i:2:p:223-248
    DOI: 10.1111/j.1539-6924.2008.01151.x
    as

    Download full text from publisher

    File URL: https://doi.org/10.1111/j.1539-6924.2008.01151.x
    Download Restriction: no
    File URL: https://libkey.io/10.1111/j.1539-6924.2008.01151.x?utm_source=ideas
    LibKey link: if access is restricted and if your library uses this service, LibKey will redirect you to where you can use your library subscription to access this item
    ---><---

    References listed on IDEAS

    as
    1. Dimitri P. Bertsekas & John N. Tsitsiklis, 1991. "An Analysis of Stochastic Shortest Path Problems," Mathematics of Operations Research, INFORMS, vol. 16(3), pages 580-595, August.
    2. Stanley Kaplan & B. John Garrick, 1981. "On The Quantitative Definition of Risk," Risk Analysis, John Wiley & Sons, vol. 1(1), pages 11-27, March.
    3. Yacov Y. Haimes & Stan Kaplan & James H. Lambert, 2002. "Risk Filtering, Ranking, and Management Framework Using Hierarchical Holographic Modeling," Risk Analysis, John Wiley & Sons, vol. 22(2), pages 383-397, April.
    4. Yacov Y. Haimes, 1991. "Total Risk Management," Risk Analysis, John Wiley & Sons, vol. 11(2), pages 169-171, June.
    Full references (including those not matched with items on IDEAS)

    Citations

    Citations are extracted by the CitEc Project, subscribe to its RSS feed for this item.
    as


    Cited by:

    1. Henry, Matthew H. & Layer, Ryan M. & Zaret, David R., 2010. "Coupled Petri nets for computer network risk analysis," International Journal of Critical Infrastructure Protection, Elsevier, vol. 3(2), pages 67-75.
    2. J. S. Busby & B. Green & D. Hutchison, 2017. "Analysis of Affordance, Time, and Adaptation in the Assessment of Industrial Control System Cybersecurity Risk," Risk Analysis, John Wiley & Sons, vol. 37(7), pages 1298-1314, July.
    3. Qianxiang Zhu & Yuanqing Qin & Chunjie Zhou & Weiwei Gao, 2018. "Extended multilevel flow model-based dynamic risk assessment for cybersecurity protection in industrial production systems," International Journal of Distributed Sensor Networks, , vol. 14(6), pages 15501477187, June.
    4. Alexander A. Ganin & Phuoc Quach & Mahesh Panwar & Zachary A. Collier & Jeffrey M. Keisler & Dayton Marchese & Igor Linkov, 2020. "Multicriteria Decision Framework for Cybersecurity Risk Assessment and Management," Risk Analysis, John Wiley & Sons, vol. 40(1), pages 183-199, January.
    5. Natalie M. Scala & Allison C. Reilly & Paul L. Goethals & Michel Cukier, 2019. "Risk and the Five Hard Problems of Cybersecurity," Risk Analysis, John Wiley & Sons, vol. 39(10), pages 2119-2126, October.
    6. Andrea Chaves & A. Terry Bahill, 2014. "Comparison of Risk Analysis Approaches and a Case Study of the Risk of Incorporating Solar Photovoltaic Systems into a Commercial Electric Power Grid," Systems Engineering, John Wiley & Sons, vol. 17(1), pages 89-111, March.
    7. Luca Allodi & Fabio Massacci, 2017. "Security Events and Vulnerability Data for Cybersecurity Risk Estimation," Risk Analysis, John Wiley & Sons, vol. 37(8), pages 1606-1627, August.

    Most related items

    These are the items that most often cite the same works as this one and are cited by the same works as this one.
    1. Yacov Y. Haimes & Alfred Anderegg, 2015. "Sequential Pareto‐Optimal Decisions Made During Emergent Complex Systems of Systems: An Application to the FAA NextGen," Systems Engineering, John Wiley & Sons, vol. 18(1), pages 28-44, January.
    2. Jalal Ali & Joost R. Santos, 2015. "Modeling the Ripple Effects of IT‐Based Incidents on Interdependent Economic Systems," Systems Engineering, John Wiley & Sons, vol. 18(2), pages 146-161, March.
    3. Maria Leung & James H. Lambert & Alexander Mosenthal, 2004. "A Risk‐Based Approach to Setting Priorities in Protecting Bridges Against Terrorist Attacks," Risk Analysis, John Wiley & Sons, vol. 24(4), pages 963-984, August.
    4. M. F. Leung & J. R. Santos & Y. Y. Haimes, 2003. "Risk Modeling, Assessment, and Management of Lahar Flow Threat," Risk Analysis, John Wiley & Sons, vol. 23(6), pages 1323-1335, December.
    5. Joost R. Santos & Lucia Castro Herrera & Krista Danielle S. Yu & Sheree Ann T. Pagsuyoin & Raymond R. Tan, 2014. "State of the Art in Risk Analysis of Workforce Criticality Influencing Disaster Preparedness for Interdependent Systems," Risk Analysis, John Wiley & Sons, vol. 34(6), pages 1056-1068, June.
    6. Sean S. Baggott & Joost R. Santos, 2020. "A Risk Analysis Framework for Cyber Security and Critical Infrastructure Protection of the U.S. Electric Power Grid," Risk Analysis, John Wiley & Sons, vol. 40(9), pages 1744-1761, September.
    7. James H. Lambert & Rachel K. Jennings & Nilesh N. Joshi, 2006. "Integration of risk identification with business process models," Systems Engineering, John Wiley & Sons, vol. 9(3), pages 187-198, September.
    8. Yacov Y. Haimes, 2012. "Systems‐Based Guiding Principles for Risk Modeling, Planning, Assessment, Management, and Communication," Risk Analysis, John Wiley & Sons, vol. 32(9), pages 1451-1467, September.
    9. James H. Lambert & Benjamin L. Schulte & Priya Sarda, 2005. "Tracking the complexity of interactions between risk incidents and engineering systems," Systems Engineering, John Wiley & Sons, vol. 8(3), pages 262-277, September.
    10. Yacov Y. Haimes, 2006. "On the Definition of Vulnerabilities in Measuring Risks to Infrastructures," Risk Analysis, John Wiley & Sons, vol. 26(2), pages 293-296, April.
    11. Hong Sun & Fangquan Yang & Peiwen Zhang & Yunxiang Zhao, 2023. "Flight Training Risk Identification and Assessment Based on the HHM-RFRM Model," Sustainability, MDPI, vol. 15(2), pages 1-20, January.
    12. Ioanna Ioannou & Jaime E. Cadena & Willy Aspinall & David Lange & Daniel Honfi & Tiziana Rossetto, 2022. "Prioritization of hazards for risk and resilience management through elicitation of expert judgement," Natural Hazards: Journal of the International Society for the Prevention and Mitigation of Natural Hazards, Springer;International Society for the Prevention and Mitigation of Natural Hazards, vol. 112(3), pages 2773-2795, July.
    13. Barry M. Horowitz & Yacov Y. Haimes, 2003. "Risk‐based methodology for scenario tracking, intelligence gathering, and analysis for countering terrorism," Systems Engineering, John Wiley & Sons, vol. 6(3), pages 152-169.
    14. Kenneth G. Crowther & Yacov Y. Haimes, 2005. "Application of the inoperability input—output model (IIM) for systemic risk assessment and management of interdependent infrastructures," Systems Engineering, John Wiley & Sons, vol. 8(4), pages 323-341.
    15. Sivakumar, Senthilkumar, 2022. "A novel Integrated Risk Management Method for Airport operations," Journal of Air Transport Management, Elsevier, vol. 105(C).
    16. Barry Charles Ezell, 2007. "Infrastructure Vulnerability Assessment Model (I‐VAM)," Risk Analysis, John Wiley & Sons, vol. 27(3), pages 571-583, June.
    17. Michael J. Pennock & Yacov Y. Haimes, 2002. "Principles and guidelines for project risk management," Systems Engineering, John Wiley & Sons, vol. 5(2), pages 89-108.
    18. Joost R. Santos & Sheree T. Pagsuyoin & Lucia C. Herrera & Raymond R. Tan & Krista D. Yu, 2014. "Analysis of drought risk management strategies using dynamic inoperability input–output modeling and event tree analysis," Environment Systems and Decisions, Springer, vol. 34(4), pages 492-506, December.
    19. James H. Lambert & Jeffrey M. Keisler & William E. Wheeler & Zachary A. Collier & Igor Linkov, 2013. "Multiscale approach to the security of hardware supply chains for energy systems," Environment Systems and Decisions, Springer, vol. 33(3), pages 326-334, September.
    20. Yacov Y. Haimes & Kenneth Crowther & Barry M. Horowitz, 2008. "Homeland security preparedness: Balancing protection with resilience in emergent systems," Systems Engineering, John Wiley & Sons, vol. 11(4), pages 287-308, December.

    More about this item

    Statistics

    Access and download statistics

    Corrections

    All material on this site has been provided by the respective publishers and authors. You can help correct errors and omissions. When requesting a correction, please mention this item's handle: RePEc:wly:riskan:v:29:y:2009:i:2:p:223-248. See general information about how to correct material in RePEc.

    If you have authored this item and are not yet registered with RePEc, we encourage you to do it here. This allows to link your profile to this item. It also allows you to accept potential citations to this item that we are uncertain about.

    If CitEc recognized a bibliographic reference but did not link an item in RePEc to it, you can help with this form .

    If you know of missing items citing this one, you can help us creating those links by adding the relevant references in the same way as above, for each refering item. If you are a registered author of this item, you may also want to check the "citations" tab in your RePEc Author Service profile, as there may be some citations waiting for confirmation.

    For technical questions regarding this item, or to correct its authors, title, abstract, bibliographic or download information, contact: Wiley Content Delivery (email available below). General contact details of provider: https://doi.org/10.1111/(ISSN)1539-6924 .

    Please note that corrections may take a couple of weeks to filter through the various RePEc services.

    IDEAS is a RePEc service. RePEc uses bibliographic data supplied by the respective publishers.