Consider the Consequences: A Risk Assessment Approach for Industrial Control Systems

The development of information and communication technologies extended the application digitalized industrial control systems (ICSs) to critical infrastructure. With this circumstance, emerging sophisticated cyberattacks by adversaries, including nation-backed terrorists, target ICSs due their strategic value that infrastructure can cause severe consequences equipment, people, environment on ICSs. Therefore, owners should provide high assurance those involved, such as neighboring residents governments, facility is adequately protected against cyberattacks. risk assessment identifies, estimates, prioritizes risks vital assurance. This study proposes a framework for evaluating quantifying likelihood cyber exploitation quantification inspired research Bayesian attack graphs (BAGs), allowing probability evaluation considers causal relationship between multistage attacks. For cyberattack quantification, we propose methodology evaluate how far an impact will spread thus many functions be influenced when ICS exploited. conducted experts identifying listing functional dependencies essential function goals among they are already familiar with do not require in-depth cybersecurity knowledge. Through experiments, demonstrated apply our assess plant protection system, which safety-grade digital system used in nuclear power plants. result shows multidimensionally assessed than previous literature, discovering components were considered important have connectivity.