Cyber security risk assessment for SCADA and DCS networks
Abstract
The growing dependence of critical infrastructures and industrial automation on interconnected physical and cyber-based control systems has resulted in a growing and previously unforeseen cyber security threat to supervisory control and data acquisition (SCADA) and distributed control systems (DCSs). It is critical that engineers and managers understand these issues and know how to locate the information they need. This paper provides a broad overview of cyber security and risk assessment for SCADA and DCS, introduces the main industry organizations and government groups working in this area, and gives a comprehensive review of the literature to date. Major concepts related to the risk assessment methods are introduced with references cited for more detail. Included are risk assessment methods such as HHM, IIM, and RFRM which have been applied successfully to SCADA systems with many interdependencies and have highlighted the need for quantifiable metrics. Presented in broad terms is probability risk analysis (PRA) which includes methods such as FTA, ETA, and FEMA. The paper concludes with a general discussion of two recent methods (one based on compromise graphs and one on augmented vulnerability trees) that quantitatively determine the probability of an attack, the impact of the attack, and the reduction in risk associated with a particular countermeasure.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
ICS integrity is critical to OT security and the priority is to detect various security events and incidents, such as failure of devices and services exhausting resources early.
“ICS integrity is critical to OT security and the priority is to detect various security events and incidents, such as failure of devices and services exhausting resources early [100].”
From Industrial IoT, Cyber Threats, and Standards Landscape: Evaluation and Roadmap (2021) · cites this paper as [100]
Risk assessment methods in general and in the context of SCADA systems specifically are hard to categorise.
“Risk assessment methods in general and in the context of SCADA systems specifically are hard to categorise as we con-clude based on our analysis and in agreement with Morgan (2013) and Ralston et al. (2007).”
From A review of cyber security risk assessment methods for SCADA systems (2016) · cites this paper as Ralston et al., 2007
Ralston et al. (2007) contains an extensive overview of risk assessment methodologies, but only two methods are examined in detail.
“An extensive overview of risk assessment meth-odologies is contained in Ralston et al. (2007), but only two methods are examined in detail.”
From A review of cyber security risk assessment methods for SCADA systems (2016) · cites this paper as Ralston et al., 2007
Risk assessment methods as applied to SCADA systems are difficult to categorise.
“As pointed out in Morgan (2013) and Ralston et al. (2007), risk assessment methods as applied to SCADA systems are dif-ficult to categorise.”
From A review of cyber security risk assessment methods for SCADA systems (2016) · cites this paper as Ralston et al., 2007
Among probabilistic tree-based methods for SCADA systems, inductive and deductive methods are distinguished.
“In Cheminod et al. (2013), Patel et al. (2008), Ralston et al. (2007), Taylor et al. (2002), among proba-bilistic tree-based methods for SCADA systems inductive and deductive methods are distinguished.”
From A review of cyber security risk assessment methods for SCADA systems (2016) · cites this paper as Ralston et al., 2007
In 2007, Ralston et al. mentioned that a natural extension to PRA involves the use of fuzzy concepts, though this approach has not been published for use in SCADA system security risk assessment.
“In 2007, in Ralston et al. (2007) it was mentioned that a “natural extension to PRA involves the use of fuzzy concepts, though this approach has not been published for use in SCADA system security risk assessment.””
From A review of cyber security risk assessment methods for SCADA systems (2016) · cites this paper as Ralston et al. (2007)
Cites
On the quantitative definition of risk
Kaplan, S., & Garrick, B. J. (1981) · Risk Analysis · doi:10.1111/j.1539-6924.1981.tb01350.x · Cited by 3,103 · see citing works
Attack trees : Modeling security threats
Schneier, B. (1999) · Medical Entomology and Zoology · Cited by 635 · see citing works
Risk Modeling, Assessment, And Management
Haimes, Y. Y. (1999) · IEEE Transactions on Systems Man and Cybernetics Part C (Applications and Reviews) · doi:10.1109/tsmcc.1999.760577 · Cited by 627 · see citing works
Probabilistic Risk Assessment and Management for Engineers and Scientists
Kumamoto, H., & Henley, E. J. (1996) · CERN Document Server (European Organization for Nuclear Research) · Cited by 618 · see citing works
Security issues in SCADA networks
Igure, V. M., Laughter, S. A., & Williams, R. D. (2006) · Computers & Security · doi:10.1016/j.cose.2006.03.001 · Cited by 566 · see citing works
Modeling and simulating critical infrastructures and their interdependencies
Rinaldi, S. M. (2004) · Proceedings of the ... Annual Hawaii International Conference on System Sciences/Proceedings of the Annual Hawaii International Conference on System Sciences · doi:10.1109/hicss.2004.1265180 · Cited by 431 · see citing works
Introduction to the OCTAVE Approach
Alberts, C., Dorofee, A., Stevens, J. F., & Woody, C. (2003) · doi:10.21236/ada634134 · Cited by 262 · see citing works
Attack Modeling for Information Security and Survivability
Moore, A. P., Ellison, R. J., & Linger, R. C. (2001) · doi:10.1184/r1/6572063.v1 · Cited by 259 · see citing works
Making the Nation Safer: The Role of Science and Technology in Countering Terrorism
Cohen, E. A. (2002) · Foreign Affairs · doi:10.2307/20033374 · Cited by 227 · see citing works
Attack Modeling for Information Security and Survivability
Moore, A. P., Ellison, R. J., & Linger, R. C. (2001) · doi:10.21236/ada387544 · Cited by 226 · see citing works
Risk Filtering, Ranking, and Management Framework Using Hierarchical Holographic Modeling
Haimes, Y. Y., Kaplan, S., & Lambert, J. H. (2002) · Risk Analysis · doi:10.1111/0272-4332.00020 · Cited by 216 · see citing works
Hierarchical Holographic Modeling
Haimes, Y. Y. (1981) · IEEE Transactions on Systems Man and Cybernetics · doi:10.1109/tsmc.1981.4308759 · Cited by 186 · see citing works
Risk Assessment Methodology for Underground Construction Projects
Choi, H., Cho, H.-N., & Seo, J. (2004) · Journal of Construction Engineering and Management · doi:10.1061/(asce)0733-9364(2004)130:2(258 · Cited by 179 · see citing works
A methodology for architecture-level reliability risk analysis
Yacoub, S., & Ammar, H. H. (2002) · IEEE Transactions on Software Engineering · doi:10.1109/tse.2002.1010058 · Cited by 159 · see citing works
Modeling and quantification of security attributes of software systems
Madan, B. B., Goševa-Popstojanova, K., Vaidyanathan, K., & Trivedi, K. S. (2003) · International Conference on Dependable Systems & Networks/Proceedings · doi:10.1109/dsn.2002.1028941 · Cited by 157 · see citing works
Simulating cyber attacks, defences, and consequences
Cohen, F. (1999) · Computers & Security · doi:10.1016/s0167-4048(99)80115-1 · Cited by 111 · see citing works
Model-based risk assessment to improve enterprise security
Aagedal, J. Ø., den Braber, F., Dimitrakos, T., Gran, B. A., Raptis, D., & Stølen, K. (2003) · IEEE International Enterprise Distributed Object Computing Conference (EDOC) · doi:10.1109/edoc.2002.1137696 · Cited by 107 · see citing works
Stouffer, K. A., Falco, J., Kent, K., Grance, T., & Ross, R. (2006) · Cited by 106 · see citing works
Quantitative Cyber Risk Reduction Estimation Methodology for a Small SCADA Control System
McQueen, M. A., Boyer, W. F., Flynn, M. A., & Beitel, G. A. (2006) · Proceedings of the 39th Annual Hawaii International Conference on System Sciences (HICSS'06) · doi:10.1109/hicss.2006.405 · Cited by 104 · see citing works
SCADA systems: vulnerabilities and remediation
Fernandez, J. D., & Fernandez, A. E. (2005) · Journal of computing sciences in colleges · Cited by 103 · see citing works
Seeds of Disaster, Roots of Response
(2006) · Cambridge University Press eBooks · doi:10.1017/cbo9780511509735 · Cited by 99 · see citing works
The National Infrastructure Protection Plan
Krotman, A., Ballo, J., & Warwick, M. (2009) · Public administration and public policy · doi:10.1201/9781420071825-c29 · Cited by 98 · see citing works
Proceedings International Conference on Dependable Systems and Networks
(2002) · International Conference on Dependable Systems & Networks/Proceedings · doi:10.1109/dsn.2002.1028880 · Cited by 97 · see citing works
Managing vulnerabilities of information systems to security incidents
Farahmand, F., Navathe, S. B., Enslow, P. H., & Sharp, G. P. (2003) · International Conference on Electronic Commerce · doi:10.1145/948005.948050 · Cited by 94 · see citing works
Crowther, K. G., & Haimes, Y. Y. (2005) · Systems Engineering · doi:10.1002/sys.20037 · Cited by 84 · see citing works
Industrial Cybersecurity for Power System and Scada Networks
Creery, A., & Byres, E. J. (2006) · IEEE IAS Petroleum and Chemical Industry Conference (PCIC) · doi:10.1109/pcicon.2005.1524567 · Cited by 83 · see citing works
Supervisory Control and Data Acquisition (SCADA) Systems
Baker, G. H., & Berg, A. (2002) · JMU Scholoraly Commons (James Madison University) · Cited by 72 · see citing works
Risk analysis modelling with the use of fuzzy logic
de Ru, W. G., & Eloff, J. H. P. (1996) · Computers & Security · doi:10.1016/0167-4048(96)00008-9 · Cited by 66 · see citing works
Proceedings of the 5th international conference on Electronic commerce
Sadeh, N., Dively, M. J. H., Kauffman, R. J., Labrou, Y., Shehory, O. M., Telang, R., & Cranor, L. F. (2003) · Cited by 66 · see citing works
IT security for industrial control systems
Falco, J., Stouffer, K. A., Wavering, A. J., & Proctor, F. (2002) · doi:10.6028/nist.ir.6859 · Cited by 49 · see citing works
Risks of Terrorism to Information Technology and to Critical Interdependent Infrastructures
Chittester, C. G., & Haimes, Y. Y. (2004) · Journal of Homeland Security and Emergency Management · doi:10.2202/1547-7355.1075 · Cited by 47 · see citing works
Haimes, Y. Y., & Chittester, C. G. (2005) · Journal of Homeland Security and Emergency Management · doi:10.2202/1547-7355.1117 · Cited by 46 · see citing works
Security of Critical Control Systems Sparks Concern
Geer, D. (2006) · Computer · doi:10.1109/mc.2006.32 · Cited by 43 · see citing works
A classification scheme for risk assessment methods.
Stamp, J. E., & Campbell, P. (2004) · doi:10.2172/925643 · Cited by 42 · see citing works
Trends in Process Control Systems Security
Miller, A. (2005) · IEEE Security & Privacy · doi:10.1109/msp.2005.136 · Cited by 41 · see citing works
System threats and vulnerabilities [power system protection
Kropp, T. (2006) · IEEE Power and Energy Magazine · doi:10.1109/mpae.2006.1597995 · Cited by 40 · see citing works
Assessing the performance of interdependent infrastructures and optimizing investments
Nozick, L. K., Turnquist, M. A., Jones, D. A., Davis, J. R., & Lawton, C. R. (2004) · Hawaii International Conference on System Sciences (HICSS) · doi:10.1109/hicss.2004.1265181 · Cited by 35 · see citing works
A methodology for architectural-level risk assessment using dynamic metrics
Yacoub, S., Ammar, H. H., & Robinson, T. (2002) · doi:10.1109/issre.2000.885873 · Cited by 30 · see citing works
Assessing the performance of interdependent infrastructures and optimising investments
Nozick, L. K., Turnquist, M. A., Jones, D. A., Davis, J. R., & Lawton, C. R. (2005) · International Journal of Critical Infrastructures · doi:10.1504/ijcis.2005.006116 · Cited by 29 · see citing works
Framework for SCADA Security Policy
Kilman, D., & Stamp, J. E. (2005) · Cited by 27 · see citing works
Summary of Control System Security Standards Activities in the Energy Sector
Carlson, R. E., Dagle, J. E., & Shamsuddin, S. (2005) · Cited by 25 · see citing works
Security in SCADA systems: how to handle the growing menace to process automation
Brown, T. (2005) · Computing & Control Engineering Journal · doi:10.1049/cce:20050306 · Cited by 23 · see citing works
RISK ASSESSMENT OF FISHING VESSELS USING FUZZY SET APPROACH
PILLAY, A., & Wang, J. (2002) · International Journal of Reliability Quality and Safety Engineering · doi:10.1142/s0218539302000743 · Cited by 23 · see citing works
ASSESSING AND MANAGING RISK OF TERRORISM TO VIRGINIA'S INTERDEPENDENT TRANSPORTATION SYSTEMS
Crowther, K. G., Dicdican, R. Y., Leung, M., Lian, C., Williams, G. M., Haimes, Y. Y., Lambert, J. H., Horowitz, B., & Santos, J. R. (2004) · Cited by 18 · see citing works
Wyss, G. D., Duran, F. A., & Dandini, V. J. (2004) · SIMULATION · doi:10.1177/0037549704042033 · Cited by 9 · see citing works
Security enhancement for SCADA communication protocols using augmented vulnerability trees.
Patel, S. C., Graham, J. H., & Ralston, P. A. S. (2006) · Computer Applications in Industry and Engineering · Cited by 7 · see citing works
Self-citationRisk analysis in electronic commerce development using fuzzy set
Wat, F. K. T., & Ngai, E. W. T. (2002) · doi:10.1109/nafips.2001.944707 · Cited by 6 · see citing works
A Comparison of Cross-Sector Cyber Security Standards
Evans, R. P. (2005) · doi:10.2172/911585 · Cited by 6 · see citing works
Common Control System Vulnerability
Nelson, T. D. (2005) · doi:10.2172/911570 · Cited by 5 · see citing works
Dilemmas and boundaries of digital rights management
Schultz, E. (2006) · Computers & Security · doi:10.1016/j.cose.2005.12.002 · Cited by 4 · see citing works
Control Systems Cyber Security
Weiss, J., & Singer, B. (2005) · Dialnet (Universidad de la Rioja) · Cited by 3 · see citing works
Stouffer, K. A., Falco, J., & Proctor, F. M. (2004) · Cited by 3 · see citing works
Walker, R. (2002) · IEEE International Conference on Management of Innovation and Technology (ICMIT) · doi:10.1109/icmit.2000.917371 · Cited by 3 · see citing works
Process Control System Security Technical Risk Assessment: Analysis of Problem Domain
Kertzner, P. (2005) · Cited by 3 · see citing works
Flagged first, then by citations
8 of the 62 references couldn’t be matched to a known paper.
Cited by
Sorted by citations
Attacks against process control systems: risk assessment, detection, and response
Cárdenas, A. A., Amin, S., Lin, Z.-S., Huang, Y.-L., Huang, C.-Y., & Sastry, S. (2011) · Proceedings of the 6th ACM Symposium on Information, Computer and Communications Security · doi:10.1145/1966913.1966959 · Cited by 699 · see citing works
A review of cyber security risk assessment methods for SCADA systems
Cherdantseva, Y., Burnap, P., Blyth, A., Eden, P., Jones, K., Soulsby, H., & Stoddart, K. (2016) · Computers & Security · doi:10.1016/j.cose.2015.09.009 · Cited by 606 · see citing works
Vikhram, G. Y. R., Elavarasan, R. M., Premkumar, M., & Mihet‐Popa, L. (2020) · IEEE Access · doi:10.1109/access.2020.3016826 · Cited by 396 · see citing works
Review of security issues in industrial networks
Cheminod, M., Durante, L., & Valenzano, A. (2013) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2012.2198666 · Cited by 349 · see citing works
A survey of cyber security management in industrial control systems
Knowles, W., Prince, D., Hutchison, D., Disso, J. F. P., & Jones, K. (2015) · International Journal of Critical Infrastructure Protection · doi:10.1016/j.ijcip.2015.02.002 · Cited by 344 · see citing works
A review of attack graph and attack tree visual syntax in cyber security
Lallie, H. S., Debattista, K., & Bal, J. (2020) · Computer Science Review · doi:10.1016/j.cosrev.2019.100219 · Cited by 228 · see citing works
Review of cybersecurity issues in industrial critical infrastructure: manufacturing in perspective
Ani, U., He, H., & Tiwari, A. (2016) · Journal of Cyber Security Technology · doi:10.1080/23742917.2016.1252211 · Cited by 225 · see citing works
Quantified security is a weak hypothesis: a critical survey of results and assumptions
Verendel, V. (2009) · Proceedings of the 2009 workshop on New security paradigms workshop · doi:10.1145/1719030.1719036 · Cited by 180 · see citing works
Industrial IoT, Cyber Threats, and Standards Landscape: Evaluation and Roadmap
Dhirani, L. L., Armstrong, E., & Newe, T. (2021) · Sensors · doi:10.3390/s21113901 · Cited by 172 · see citing works
“ICS integrity is critical to OT security and the priority is to detect various security events and incidents, such as failure of devices and services exhausting resources early [100].”
BackgroundAssessing and augmenting SCADA cyber security: A survey of techniques
Nazir, S., Patel, S., & Patel, D. (2017) · Computers & Security · doi:10.1016/j.cose.2017.06.010 · Cited by 167 · see citing works
“A survey of available tools for SCADA risk assessment is provided by Ralston et al. [92].”
MethodDevelopment capabilities for smart products
Tomiyama, T., Lutters, E., Stark, R., & Abramovici, M. (2019) · CIRP Annals · doi:10.1016/j.cirp.2019.05.010 · Cited by 168 · see citing works
Kandasamy, K., Srinivas, S., Achuthan, K., & Rangan, V. P. (2020) · EURASIP Journal on Information Security · doi:10.1186/s13635-020-00111-0 · Cited by 160 · see citing works
Cybersecurity for digital manufacturing
Wu, D., Ren, A., Zhang, W., Fan, F., Liu, P., Fu, X., & Terpenny, J. P. (2018) · Journal of Manufacturing Systems · doi:10.1016/j.jmsy.2018.03.006 · Cited by 160 · see citing works
A Survey on Cyber Security Threats in IoT-Enabled Maritime Industry
Ashraf, I., Park, Y., Hur, S., Kim, S. W., Alroobaea, R., Zikria, Y. B., & Nosheen, S. (2022) · IEEE Transactions on Intelligent Transportation Systems · doi:10.1109/tits.2022.3164678 · Cited by 152 · see citing works
Paridari, K., O’Mahony, N., Mady, A. E., Chabukswar, R., Boubekeur, M., & Sandberg, H. (2017) · Proceedings of the IEEE · doi:10.1109/jproc.2017.2725482 · Cited by 143 · see citing works
IIoT cybersecurity risk modeling for SCADA systems
Falco, G., Caldera, C., & Shrobe, H. (2018) · IEEE Internet of Things Journal · doi:10.1109/jiot.2018.2822842 · Cited by 137 · see citing works
Zhang, Q., Zhou, C., Xiong, N. N., Qin, Y., Li, X., & Huang, S. (2015) · IEEE Transactions on Systems Man and Cybernetics Systems · doi:10.1109/tsmc.2015.2503399 · Cited by 137 · see citing works
Cyber–physical interactions in power systems: A review of models, methods, and applications
Shi, L., Dai, Q., & Ni, Y. (2018) · Electric Power Systems Research · doi:10.1016/j.epsr.2018.07.015 · Cited by 134 · see citing works
Cyber security risk assessment for seaports: A case study of a container port
Güneş, B., Kayışoğlu, G., & Bolat, P. (2021) · Computers & Security · doi:10.1016/j.cose.2021.102196 · Cited by 129 · see citing works
Distributed Resilient Secondary Control of DC Microgrids Against Unbounded Attacks
Zuo, S., Altun, T., Lewis, F. L., & Davoudi, A. A. (2020) · IEEE Transactions on Smart Grid · doi:10.1109/tsg.2020.2992118 · Cited by 123 · see citing works
A Master Attack Methodology for an AI-Based Automated Attack Planner for Smart Cities
Falco, G. J., Viswanathan, A., Caldera, C., & Shrobe, H. E. (2018) · IEEE Access · doi:10.1109/access.2018.2867556 · Cited by 121 · see citing works
Simulation for cybersecurity: state of the art and future directions
Kavak, H., Padilla, J. J., Vernon-Bido, D., Diallo, S. Y., Gore, R. J., & Shetty, S. S. (2021) · Journal of Cybersecurity · doi:10.1093/cybsec/tyab005 · Cited by 118 · see citing works
An Internet-wide view of ICS devices
Mirian, A., Ma, Z., Adrian, D., Tischer, M., Chuenchujit, T., Yardley, T., Berthier, R., Mason, J., Durumeric, Z., Halderman, J. A., et al. (2016) · Conference on Privacy, Security and Trust · doi:10.1109/pst.2016.7906943 · Cited by 115 · see citing works
Cybersecurity risk analysis model using fault tree analysis and fuzzy decision theory
de Gusmão, A. P. H., Silva, M. M., Poleto, T., Silva, L. C. E., & Costa, A. P. C. S. (2018) · International Journal of Information Management · doi:10.1016/j.ijinfomgt.2018.08.008 · Cited by 109 · see citing works
Human factor security: evaluating the cybersecurity capacity of the industrial workforce
Ani, U., He, H., & Tiwari, A. (2018) · Journal of Systems and Information Technology · doi:10.1108/jsit-02-2018-0028 · Cited by 108 · see citing works
Distributed event-triggered consensus of multi-agent systems under periodic DoS jamming attacks
Cheng, Z., Yue, D., Hu, S., Ge, H. L., & Chen, L. (2019) · Neurocomputing · doi:10.1016/j.neucom.2019.03.089 · Cited by 96 · see citing works
Cybersecurity Hazards and Financial System Vulnerability: A Synthesis of Literature
Uddin, M. H., Ali, M. H., & Hassan, M. K. (2020) · Risk Management · doi:10.1057/s41283-020-00063-2 · Cited by 141 · see citing works
Applications in Security and Evasions in Machine Learning: A Survey
Sagar, R. V., Jhaveri, R. H., & Borrego, C. (2020) · Electronics · doi:10.3390/electronics9010097 · Cited by 90 · see citing works
Port cybersecurity and threat: A structural model for prevention and policy development
Senarak, C. (2020) · The Asian Journal of Shipping and Logistics · doi:10.1016/j.ajsl.2020.05.001 · Cited by 85 · see citing works
Zhang, Y., Wang, L., Xiang, Y., & Ten, C. (2016) · IEEE Transactions on Power Systems · doi:10.1109/tpwrs.2015.2510626 · Cited by 84 · see citing works
Key management issue in SCADA networks: A review
Rezai, A., Keshavarzi, P., & Moravej, Z. (2016) · Engineering Science and Technology an International Journal · doi:10.1016/j.jestch.2016.08.011 · Cited by 80 · see citing works
Cyber Resilience and Incident Response in Smart Cities: A Systematic Literature Review
Ahmadi‐Assalemi, G., Al‐Khateeb, H., Epiphaniou, G., & Maple, C. R. (2020) · Smart Cities · doi:10.3390/smartcities3030046 · Cited by 78 · see citing works
Restraint under conditions of uncertainty: Why the United States tolerates cyberattacks
Kaminska, M. (2021) · Journal of Cybersecurity · doi:10.1093/cybsec/tyab008 · Cited by 77 · see citing works
Unsupervised Learning Approach for Anomaly Detection in Industrial Control Systems
Choi, W.-H., & Kim, J. (2024) · Applied System Innovation · doi:10.3390/asi7020018 · Cited by 74 · see citing works
Does digital transformation matter for operational risk exposure?
Uddin, M. H., Mollah, S., Islam, N., & Ali, M. H. (2023) · Technological Forecasting and Social Change · doi:10.1016/j.techfore.2023.122919 · Cited by 73 · see citing works
Lallie, H. S., Debattista, K., & Bal, J. (2017) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2017.2771238 · Cited by 73 · see citing works
Alqudhaibi, A., Albarrak, M., Aloseel, A., Jagtap, S., & Salonitis, K. (2023) · Sensors · doi:10.3390/s23094539 · Cited by 72 · see citing works
A Survey of Cyber-Physical Power System Modeling Methods for Future Energy Systems
Abdelmalak, M. M., Venkataramanan, V., & Macwan, R. (2022) · IEEE Access · doi:10.1109/access.2022.3206830 · Cited by 71 · see citing works
Cybersecurity Challenges for Manufacturing Systems 4.0: Assessment of the Business Impact Level
Corallo, A., Lazoi, M., Lezzi, M., & Pontrandolfo, P. (2021) · IEEE Transactions on Engineering Management · doi:10.1109/tem.2021.3084687 · Cited by 69 · see citing works
Dynamic Risk Assessment in Cybersecurity: A Systematic Literature Review
Cheimonidis, P., & Rantos, K. (2023) · Future Internet · doi:10.3390/fi15100324 · Cited by 66 · see citing works
SoK: Cyber Insurance – Technical Challenges and a System Security Roadmap
Dambra, S., Bilge, L., & Balzarotti, D. (2020) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp40000.2020.00019 · Cited by 65 · see citing works
Security, Privacy and Safety Risk Assessment for Virtual Reality Learning Environment Applications
Gulhane, A., Vyas, A., Mitra, R., Oruche, R., Hoefer, G., Valluripally, S., Calyam, P., & Hoque, K. A. (2019) · IEEE Consumer Communications and Networking Conference · doi:10.1109/ccnc.2019.8651847 · Cited by 63 · see citing works
Moustafa, N., Misra, G., & Slay, J. (2018) · IEEE Transactions on Sustainable Computing · doi:10.1109/tsusc.2018.2808430 · Cited by 63 · see citing works
Yan, L., Huang, G.-Q., Wang, C.-Z., & Li, Y.-C. (2019) · EURASIP Journal on Wireless Communications and Networking · doi:10.1186/s13638-019-1506-1 · Cited by 61 · see citing works
An event buffer flooding attack in DNP3 controlled SCADA systems
Jin, D., Nicol, D. M., & Yan, G. (2011) · Proceedings of the 2011 Winter Simulation Conference (WSC) · doi:10.1109/wsc.2011.6147969 · Cited by 56 · see citing works
Cyber risk and insurance for transportation infrastructure
Tonn, G. L., Kesan, J. P., Zhang, L., & Czajkowski, J. R. (2019) · Transport Policy · doi:10.1016/j.tranpol.2019.04.019 · Cited by 54 · see citing works
Kim, K. H., Kim, K., & Kim, H. K. (2022) · ETRI Journal · doi:10.4218/etrij.2021-0181 · Cited by 53 · see citing works
Islam, M. A., & Arju, M. A. A. S. (2023) · doi:10.63125/rg8mt373 · Cited by 51 · see citing works
Smart Grid DNP3 Vulnerability Analysis and Experimentation
Darwish, I., Igbe, O., Celebi, O., Saadawi, T., & Soryal, J. (2015) · IEEE International Conference on Cyber Security and Cloud Computing (CSCloud) · doi:10.1109/cscloud.2015.86 · Cited by 51 · see citing works
Cyber security risk management in the SCADA critical infrastructure environment
Henrie, M. (2013) · Engineering Management Journal · doi:10.1080/10429247.2013.11431973 · Cited by 50 · see citing works
Formal Vulnerability Analysis of a Security System for Remote Fieldbus Access
Cheminod, M., Pironti, A., & Sisto, R. (2011) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2010.2099233 · Cited by 46 · see citing works
Secure SCADA communication by using a modified key management scheme
Rezai, A., Keshavarzi, P., & Moravej, Z. (2013) · ISA Transactions · doi:10.1016/j.isatra.2013.02.005 · Cited by 45 · see citing works
Application of Functional Analysis on a SCADA System of a Thermal Power Plant
Lakhoua, M. N. (2009) · Advances in Electrical and Computer Engineering · doi:10.4316/aece.2009.02014 · Cited by 44 · see citing works
Towards quantifying the impacts of cyber attacks in the competitive electricity market environment
Negrete-Pincetic, M., Yoshida, F., & Gross, G. (2009) · doi:10.1109/ptc.2009.5282237 · Cited by 43 · see citing works
Wang, H., Lau, N. K. C., & Gerdes, R. (2018) · Human Factors The Journal of the Human Factors and Ergonomics Society · doi:10.1177/0018720818769250 · Cited by 41 · see citing works
Albalawi, F., Durand, H., & Christofides, P. D. (2017) · Computers & Chemical Engineering · doi:10.1016/j.compchemeng.2017.10.006 · Cited by 41 · see citing works
Uncovering Vulnerable Industrial Control Systems from the Internet Core
Nawrocki, M., Schmidt, T. C., & Wählisch, M. (2020) · IEEE/IFIP Network Operations and Management Symposium (NOMS) · doi:10.1109/noms47738.2020.9110256 · Cited by 41 · see citing works
Processing and packaging automation systems: a review
Mahalik, N. P. (2009) · Sensing and Instrumentation for Food Quality and Safety · doi:10.1007/s11694-009-9076-2 · Cited by 38 · see citing works
Threats, Countermeasures and Attribution of Cyber Attacks on Critical Infrastructures
Maglaras, L. A., Ferrag, M. A., Derhab, A., Mukherjee, M., Janicke, H., & Rallis, S. (2018) · ICST Transactions on Security and Safety · doi:10.4108/eai.15-10-2018.155856 · Cited by 38 · see citing works
Association Analysis-Based Cybersecurity Risk Assessment for Industrial Control Systems
Qin, Y., Yuan, P., Huang, K., Zhou, C., & Tian, Y. (2020) · IEEE Systems Journal · doi:10.1109/jsyst.2020.3010977 · Cited by 38 · see citing works
Robustness of Optimal Investment Decisions in Mixed Insurance/Investment Cyber Risk Management
Mazzoccoli, A., & Naldi, M. (2019) · Risk Analysis · doi:10.1111/risa.13416 · Cited by 36 · see citing works
Senarak, C. (2021) · The Asian Journal of Shipping and Logistics · doi:10.1016/j.ajsl.2021.10.002 · Cited by 36 · see citing works
A Novel Risk Assessment Methodology for SCADA Maritime Logistics Environments
Kalogeraki, E.-M., Papastergiou, S., Mouratidis, H., & Polemi, N. (2018) · Applied Sciences · doi:10.3390/app8091477 · Cited by 36 · see citing works
Cybersecurity risk assessment of VDR
Söner, Ö., Kayışoğlu, G., Bolat, P., & Tam, K. (2023) · Journal of Navigation · doi:10.1017/s0373463322000595 · Cited by 35 · see citing works
Anomaly detection in SCADA systems : a network based approach
Barbosa, R. R. R. (2014) · doi:10.3990/1.9789036536455 · Cited by 35 · see citing works
A new cyber security risk evaluation method for oil and gas SCADA based on factor state space
Yang, L., Cao, X., & Li, J. (2015) · Chaos Solitons & Fractals · doi:10.1016/j.chaos.2015.10.030 · Cited by 34 · see citing works
Security risks in cyber physical systems—A systematic mapping study
Zahid, M., Inayat, I., Daneva, M., & Mehmood, Z. (2021) · Journal of Software Evolution and Process · doi:10.1002/smr.2346 · Cited by 33 · see citing works
Detecting Chains of Vulnerabilities in Industrial Networks
Cheminod, M., Bertolotti, I. C., Durante, L., Maggi, P., Pozza, D., Sisto, R., & Valenzano, A. (2009) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2009.2018627 · Cited by 32 · see citing works
Understanding the Methods behind Cyber Terrorism
Dawson, M. E., Omar, M., & Abramson, J. (2014) · Advances in information quality and management · doi:10.4018/978-1-4666-5888-2.ch147 · Cited by 32 · see citing works
Resource Allocation in Networking and Computing Systems: A Security and Dependability Perspective
Khan, M. I., & Nencioni, G. (2023) · IEEE Access · doi:10.1109/access.2023.3306534 · Cited by 32 · see citing works
Toward Authenticating the Master in the Modbus Protocol
Liao, G., Chen, Y.-J., Lu, W.-C., & Cheng, T.-C. (2008) · IEEE Transactions on Power Delivery · doi:10.1109/tpwrd.2008.2002942 · Cited by 32 · see citing works
Tubis, A. A., Werbińska-Wojciechowska, S., Góralczyk, M., Wroblewski, A. C., & Ziętek, B. (2020) · Sensors · doi:10.3390/s20247210 · Cited by 31 · see citing works
Dehmer, M., Meyer-Nieberg, S., Mihelcic, G., Pickl, S., & Zsifkovits, M. (2015) · EURO Journal on Decision Processes · doi:10.1007/s40070-015-0046-0 · Cited by 31 · see citing works
GRAPH NEURAL NETWORK MODELS FOR PREDICTING CYBER ATTACK PATTERNS IN CRITICAL INFRASTRUCTURE SYSTEMS
Biswas, S., USA, Dhanekula, A., & CloudData Technologies, B. A. (2024) · doi:10.63125/pmnqxk63 · Cited by 30 · see citing works
Khalil, Y. F. (2016) · Process Safety and Environmental Protection · doi:10.1016/j.psep.2016.05.001 · Cited by 30 · see citing works
Characteristic insights on industrial cyber security and popular defense mechanisms
Wan, M., Li, J., Liu, Y., Zhao, J., & Wang, J. (2021) · China Communications · doi:10.23919/jcc.2021.01.012 · Cited by 28 · see citing works
Detection and analysis of cybersecurity challenges for processing systems
Liu, L., Sajid, Z., Kravaris, C., & Khan, F. I. (2024) · Process Safety and Environmental Protection · doi:10.1016/j.psep.2024.03.088 · Cited by 28 · see citing works
Bibliometric analysis of cybercrime and cybersecurity risks literature
Nobanee, H., Alodat, A. Y., Bajodah, R., Al-Ali, M., & Darmaki, A. A. (2023) · Journal of Financial Crime · doi:10.1108/jfc-11-2022-0287 · Cited by 27 · see citing works
Assessment of SCADA System Vulnerabilities
Yadav, G., & Paul, K. (2019) · IEEE International Conference on Emerging Technologies and Factory Automation (ETFA) · doi:10.1109/etfa.2019.8869541 · Cited by 27 · see citing works
Alhakami, W. (2023) · Processes · doi:10.3390/pr11051366 · Cited by 25 · see citing works
Cyber security, building automation, and the intelligent building
Fisk, D. (2012) · Intelligent Buildings International · doi:10.1080/17508975.2012.695277 · Cited by 25 · see citing works
Busby, J. S., Green, B., & Hutchison, D. (2017) · Risk Analysis · doi:10.1111/risa.12681 · Cited by 25 · see citing works
Zuo, S., Wang, Y., Rajabinezhad, M., & Zhang, Y. (2023) · IEEE Transactions on Control of Network Systems · doi:10.1109/tcns.2023.3338772 · Cited by 24 · see citing works
Park, J. W., & Lee, S. J. (2020) · Annals of Nuclear Energy · doi:10.1016/j.anucene.2020.107432 · Cited by 23 · see citing works
Shahzad, A., Lee, M., Kim, H., Woo, S.-M., & Xiong, N. N. (2015) · Symmetry · doi:10.3390/sym7041945 · Cited by 23 · see citing works
A Fuzzy AHP Approach for Security Risk Assessment in SCADA Networks
Marković-Petrović, J. D., Stojanović, M. D., & Rakas, S. V. B. (2019) · Advances in Electrical and Computer Engineering · doi:10.4316/aece.2019.03008 · Cited by 23 · see citing works
Lee, C., Yim, H. B., & Seong, P. H. (2017) · Annals of Nuclear Energy · doi:10.1016/j.anucene.2017.11.002 · Cited by 22 · see citing works
Cyber-security risk assessment framework for critical infrastructures
Baig, Z. A., & Zeadally, S. (2018) · Intelligent Automation & Soft Computing · doi:10.31209/2018.100000049 · Cited by 22 · see citing works
Kelli, V., Grammatikis, P. I. R., Λάγκας, Θ., Markakis, E., & Sarigiannidis, P. G. (2022) · IEEE International Conference on Cyber Security and Resilience (CSR) · doi:10.1109/csr54599.2022.9850291 · Cited by 22 · see citing works
Privacy preserving federated learning for full heterogeneity
Chen, K., Zhang, X., Zhou, X., Mi, B., Xiao, Y., Zhou, L., Wu, Z., Wu, L., & Wang, X. (2023) · ISA Transactions · doi:10.1016/j.isatra.2023.04.020 · Cited by 22 · see citing works
Computational Intelligence Algorithms Analysis for Smart Grid Cyber Security
Wang, Y., Ruan, D., Xu, J., Wen, M., & Deng, L. (2010) · Lecture notes in computer science · doi:10.1007/978-3-642-13498-2_11 · Cited by 22 · see citing works
Advance hybrid key management architecture for SCADA network security
Rezai, A., Keshavarzi, P., & Moravej, Z. (2016) · Security and Communication Networks · doi:10.1002/sec.1612 · Cited by 22 · see citing works
Malware propagation effects on SCADA system and smart power grid
Akhtar, T., Gupta, B. B., & Yamaguchi, S. (2018) · International Conference on Consumer Electronics · doi:10.1109/icce.2018.8326281 · Cited by 22 · see citing works
Role of Cyber Security in Today's Scenario
Khari, M., Shrivastava, G., Gupta, S., & Gupta, R. (2017) · Advances in information security, privacy, and ethics book series · doi:10.4018/978-1-5225-2154-9.ch013 · Cited by 21 · see citing works
Probabilistic safety assessment-based importance analysis of cyber-attacks on nuclear power plants
Park, J. W., & Lee, S. J. (2018) · Nuclear Engineering and Technology · doi:10.1016/j.net.2018.09.009 · Cited by 21 · see citing works
Chen, Q., Abercrombie, R. K., & Sheldon, F. T. (2015) · Journal of Artificial Intelligence and Soft Computing Research · doi:10.1515/jaiscr-2015-0029 · Cited by 21 · see citing works
Vulnerabilities of Control Systems in Internet of Things Applications
Radisavljević-Gajić, V., Park, S., & Chasaki, D. (2017) · IEEE Internet of Things Journal · doi:10.1109/jiot.2017.2787962 · Cited by 21 · see citing works
Backdoor attacks against distributed swarm learning
Chen, K., Zhang, H., Feng, X., Zhang, X., Mi, B., & Jin, Z. (2023) · ISA Transactions · doi:10.1016/j.isatra.2023.03.034 · Cited by 20 · see citing works
A Novel Security Risk Analysis Using the AHP Method in Smart Railway Systems
Avcı, İ., & Koca, M. (2024) · Applied Sciences · doi:10.3390/app14104243 · Cited by 20 · see citing works
Survey of cyber risk analysis techniques for use in the nuclear industry
Eggers, S. L., & Blanc, K. L. L. (2021) · Progress in Nuclear Energy · doi:10.1016/j.pnucene.2021.103908 · Cited by 20 · see citing works
- Authors
- Ralston, P. A. S., Graham, J. H., & Hieb, J. L.
- Affiliations
- University of Louisville (US)
- Corresponding author
- Ralston, P.A.S.
- ORCID
- Ralston, P.A.S.
- Venue
- ISA Transactions
- Publisher
- Elsevier BV
- Published
- 2007-10
- Volume
- 46
- Issue
- 4
- Pages
- 583-594
- ISSN
- 0019-0578 (ISSN-L)
- OpenAlex
- W2050588495
- Cited by
- 267
- References
- 62
- Citations by year
- 2026: 5 · 2025: 8 · 2024: 18 · 2023: 15 · 2022: 10 · 2021: 18 · 2020: 26 · 2019: 34 · 2018: 27 · 2017: 18 · 2016: 17 · 2015: 13 · 2014: 11 · 2013: 8 · 2012: 12
- FWCI
- 12.61
- Type
- journal article
- Language
- en
- Open access
- closed
- Locations
- ISA Transactions (publishedVersion)
- PubMed (publishedVersion)
- Funders
- U.S. Department of Homeland Security
- Furman University
- Topics
- Physical Sciences › Engineering › Control and Systems Engineering › Smart Grid Security and Resilience
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Social Sciences › Decision Sciences › Statistics, Probability and Uncertainty › Risk and Safety Analysis
- Keywords
- cybersecurity risk assessment, SCADA systems, distributed control systems, industrial control systems, critical infrastructure, risk assessment methodology, HAZOP, fault tree analysis, event tree analysis, failure mode and effects analysis, attack probability
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
