Abstract:The threat to Industrial Control Systems (ICS) from cyber attacks is widely acknowledged by governments and literature. Operators of ICS are looking to address these threats in an effective and cost-sensitive manner that does not expose their operations to additional risks through invasive testing. Whilst existing standards and guidelines offer comprehensive advice for reviewing the security of ICS infrastructure, resource and time limitations can lead to incomplete assessments or undesirably long countermeasure implementation schedules.In this paper we consider the problem of undertaking efficient cyber security risk assessments and implementing mitigations in large, established ICS operations for which a full security review cannot be implemented on a constrained timescale. The contribution is the Industrial Control System Cyber Defence Triage Process (ICS-CDTP). ICS-CDTP determines areas of priority where the impact of attacks is greatest, and where initial investment reduces the organisation's overall exposure swiftly. ICS-CDTP is designed to be a precursor to a wider, holistic review across the operation following established security management approaches. ICS-CDTP is a novel combination of the Diamond Model of Intrusion Analysis, the Mandiant Attack Lifecycle, and the CARVER Matrix, allowing for an effective triage of attack vectors and likely targets for a capable antagonist. ICS-CDTP identifies and focuses on key ICS processes and their exposure to cyber threats with the view to maintain critical operations. The article defines ICS-CDTP and exemplifies its application using a fictitious water treatment facility, and explains its evaluation as part of a large-scale serious game exercise.

Security Incident Response Criteria: A Practitioner's Perspective

Security Incident Recognition and Reporting (SIRR): An Industrial Perspective

Rethinking Security Incident Response: The Integration of Agile Principles

How Good is Your Data? Investigating the Quality of Data Generated During Security Incident Response Investigations

Review of human decision-making during computer security incident analysis

Research on Security Incident Taxonomy in Computer Incident Response Service

Alignment of Cybersecurity Incident Prioritisation with Incident Response Management Maturity Capabilities

System Security Assurance: A Systematic Literature Review

Integrated Safety and Security Risk Assessment Methods: A Survey of Key Characteristics and Applications

After the Breach: Incident Response within Enterprises

Intrusion Response Systems: Past, Present and Future

Security Requirements Engineering in the Wild: A Survey of Common Practices

Contemporary Threats Countermeasuresi

Understanding Indicators of Compromise against Cyber-Attacks in Industrial Control Systems: A Security Perspective

The industrial control system cyber defence triage process

Information Security Risks Assessment: A Case Study

A Security Posture Assessment of Industrial Control Systems Based on Evidential Reasoning and Belief Rule Base

CRSTIP - An Assessment Scheme for Security Assessment Processes

Security in IS and social engineering -- an overview and state of the art

Security Assurance Cases -- State of the Art of an Emerging Approach