Abstract:Objective: The aim of this study was to apply work domain analysis for cybersecurity assessment and design of supervisory control and data acquisition (SCADA) systems. Background: Adoption of information and communication technology in cyberphysical systems (CPSs) for critical infrastructures enables automated and distributed control but introduces cybersecurity risk. Many CPSs employ SCADA industrial control systems that have become the target of cyberattacks, which inflict physical damage without use of force. Given that absolute security is not feasible for complex systems, cyberintrusions that introduce unanticipated events will occur; a proper response will in turn require human adaptive ability. Therefore, analysis techniques that can support security assessment and human factors engineering are invaluable for defending CPSs. Method: We conducted work domain analysis using the abstraction hierarchy (AH) to model a generic SCADA implementation to identify the functional structures and means-ends relations. We then adopted a case study approach examining the Stuxnet cyberattack by developing and integrating AHs for the uranium enrichment process, SCADA implementation, and malware to investigate the interactions between the three aspects of cybersecurity in CPSs. Results: The AHs for modeling a generic SCADA implementation and studying the Stuxnet cyberattack are useful for mapping attack vectors, identifying deficiencies in security processes and features, and evaluating proposed security solutions with respect to system objectives. Conclusion: Work domain analysis is an effective analytical method for studying cybersecurity of CPSs for critical infrastructures in a psychologically relevant manner. Application: Work domain analysis should be applied to assess cybersecurity risk and inform engineering and user interface design.

A Cross-Layer Security Analysis for Process-Aware Information Systems

Cross‐layer Security Design for Encrypted CPS Based on Modified Security Signalling Game

A Business Process-based Method on Security Requirement Analysis of Information Systems

Inference Attack and Privacy Security of Data-driven Industrial Process Monitoring Systems

An Automatic Approach To Aid Process Integration Within A Secure Software Processes Family

System Security Assurance: A Systematic Literature Review

Security in IS and social engineering -- an overview and state of the art

Security Oriented Analysis and Design Framework for Cyber - Physical - Social Enterprise

Security in Process: Detecting Attacks in Industrial Process Data

A process framework for information security management

Physical Layer Security in the Age of Artificial Intelligence and Edge Computing

Examining Cybersecurity of Cyberphysical Systems for Critical Infrastructures Through Work Domain Analysis

A Framework for Data-Driven Physical Security and Insider Threat Detection

Detection and analysis of cybersecurity challenges for processing systems

RESOLUTION OF SAFETY RELEVANT SECURITY THREATS IN THE SYSTEM ARCHITECTURE DESIGN PHASE ON THE EXAMPLE OF AUTOMOTIVE INDUSTRY

Security Situation Awareness System Based on Artificial Intelligence

Towards AI-enabled Cyber Threat Assessment in the Health Sector

An integrated system theoretic process analysis with multilevel flow modeling for the identification of cyber‐physical hazards in a process industry

Balancing Confidentiality and Transparency for Blockchain-based Process-Aware Information Systems

On Process Awareness in Detecting Multi-stage Cyberattacks in Smart Grids

Protection Motivation Theory in Information Systems Security Research