Dynamic Vulnerability Criticality Calculator for Industrial Control Systems

Pavlos Cheimonidis,Kontantinos Rantos

2024-03-20

Abstract:The convergence of information and communication technologies has introduced new and advanced capabilities to Industrial Control Systems. However, concurrently, it has heightened their vulnerability to cyber attacks. Consequently, the imperative for new security methods has emerged as a critical need for these organizations to effectively identify and mitigate potential threats. This paper introduces an innovative approach by proposing a dynamic vulnerability criticality calculator. Our methodology encompasses the analysis of environmental topology and the effectiveness of deployed security mechanisms, coupled with the utilization of the Common Vulnerability Scoring System framework to adjust detected vulnerabilities based on the specific environment. Moreover, it evaluates the quantity of vulnerabilities and their interdependencies within each asset. Additionally, our approach integrates these factors into a comprehensive Fuzzy Cognitive Map model, incorporating attack paths to holistically assess the overall vulnerability score. To validate the efficacy of our proposed method, we present a relative case study alongside several modified scenarios, demonstrating its effectiveness in practical applications.

Cryptography and Security

What problem does this paper attempt to address?

This paper proposes a new approach to address the network security issues in Industrial Control Systems (ICS), called Dynamic Vulnerability Criticality Calculator. With the integration of information and communication technology, the network security threats in ICS are increasing, thus necessitating new security measures to effectively identify and mitigate potential threats. The paper introduces an innovative method that analyzes the environmental topology and deployed security mechanisms, combines it with the Common Vulnerability Scoring System framework, dynamically adjusts the detected vulnerabilities, and considers the interdependencies of vulnerabilities between assets. This approach integrates these factors into a fuzzy cognitive map model to provide a comprehensive assessment of the overall vulnerability score. The paper validates the effectiveness of this method through case studies and modified scenarios, aiming to provide real-time dynamic risk assessment tools for ICS to enhance security.