Dependency based risk analysis in Cyber-Physical Systems

Abstract

The term ”cyber-physical systems” was introduced by Helen Gill at the National Science Foundation around 2006. Cyber-Physical Systems (CPSs) are systems that integrate computation, communication, and controlling capabilities of Information and Communication Technology (ICT), with the traditional infrastructures. This integration aims to facilitate the monitoring and controlling of objects in the physical world as one of the essential requirements of different Critical Infrastructures (CIs), such as manufacturing, healthcare, transportation, and the energy sector [1]. CPSs can be seen as the forerunners of ‘smart’ solutions, such as smart grids, and smart cities. By moving towards Industry 4.0, the integration between Information Technology (IT) and Operational Technology (OT) has significantly increased and exacerbated the complexity of CPSs. This hinders the comprehensive understanding of interactions in CPSs and causes many interdependencies. An interdependency in a CPS, which mainly refers to the relationship between the IT and OT parts, implies that a failure in the IT part might impact the functionality of the OT and vice versa. While we are witnessing the growing number of cyber attacks that target IT systems on a daily basis and, as the border between OT and IT is disappearing, CPSs are turning into attractive targets for cyber attacks. Adversaries can take advantage of complex interdependencies in such systems to infiltrate the OT part, affect the operational part of CPSs, and impose safety risks. Indeed, the security of CPSs highly demands a paradigm shift in conventional security methods in particular risk assessment methods. To enhance the security of CPSs and protect them against emerging cyber attacks, an end-to-end mechanism is needed to analyze interactions within the system components to reveal the hidden dependencies as the potential infiltration points across the systems that might be leveraged by adversaries. To this end, this PhD research aims to contribute to improving the security of cyber-physical systems by concentrating on the concept of interdependency and providing a risk assessment method. Interdependency analysis in CPSs is a multifaceted objective that encompasses identification, modeling, and feature extraction in such a way as to support the process of security risk assessment in cyber-physical systems from a unified IT and OT perspective. The results of this PhD research have been published in three journal articles and three articles in conference proceedings, included in the second part of the thesis.