Cited by 278Smart Grid Security and ResilienceInformation and Cyber SecurityRisk and Safety Analysis

The DOI matches its Crossref record; 54 of the 62 references it cites were found in a registry or an index.

Cyber security risk assessment for SCADA and DCS networks

Ralston, P.A.S., Graham, J.H., Hieb, J.L.·2007·ISA Transactions

Abstract

The growing dependence of critical infrastructures and industrial automation on interconnected physical and cyber-based control systems has resulted in a growing and previously unforeseen cyber security threat to supervisory control and data acquisition (SCADA) and distributed control systems (DCSs). It is critical that engineers and managers understand these issues and know how to locate the information they need. This paper provides a broad overview of cyber security and risk assessment for SCADA and DCS, introduces the main industry organizations and government groups working in this area, and gives a comprehensive review of the literature to date. Major concepts related to the risk assessment methods are introduced with references cited for more detail. Included are risk assessment methods such as HHM, IIM, and RFRM which have been applied successfully to SCADA systems with many interdependencies and have highlighted the need for quantifiable metrics. Presented in broad terms is probability risk analysis (PRA) which includes methods such as FTA, ETA, and FEMA. The paper concludes with a general discussion of two recent methods (one based on compromise graphs and one on augmented vulnerability trees) that quantitatively determine the probability of an attack, the impact of the attack, and the reduction in risk associated with a particular countermeasure.

Overview

Integrity signals

Registry

Crossref · 10.1016/j.isatra.2007.04.003

Cites

54 of 54 references verified0 citation errors · 0 not checkable

Statistics

Recomputing p-values needs the paper’s full text.

Verification

Claims the paper makes

This paper’s full text isn’t openly available, so its claims and self-check weren’t run. The registry and citation checks still apply.

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

Citations

Cites

Flagged first, then by citations

Show all 62 references

8 of the 62 references couldn’t be matched to a known paper.

Research works printed but not linked: 16

  1. Smith, 2003, Connection to public communications increases danger of cyber-attacks, Pipeline and Gas Journal, 230, 20
  2. Watts D. Security & vulnerability in electric power systems. In: 35th North American Power Symposium. 2003. p. 559–66
  3. Oman P, Schweitzer E, Roberts J. Safeguarding IEDs, substations, and SCADA systems against electronic intrusions. In: Proceedings of the 2001 western power delivery automation conference. 2001. p. 9–12
  4. Novak, 2005, Merging SCADA and business processes, Plant Engineering, 59, 35
  5. Asenjo, 2005, Cybersecurity for legacy SCADA systems, Utility Automation and Engineering T&D, 10, 48
  6. 2005, Battling the cyber menace, PEI Power Engineering International, 13, 123
  7. SAAD AY. Securing supervisory control and data acquisition systems: Plant utilities: A special report. Hydrocarbon processing (International Ed.) 2002; 81(7); 55–6
  8. Byres, 2005, Insidious threat to control systems, InTech, 52, 28
  9. Byres, 2006, Uncovering cyber flaws, InTech, 53, 20
  10. Carlson, 2005, DHS to state its case to business, Eweek, 42, 20
  11. 2005, Honeywell reshapes industrial control world, Manufacturing Computer Solutions, 37
  12. Miller, 2005, Risk assessment: The first step, InTech, 52, 68
  13. How to do a Complete Automated Risk Assessment: A Methodology Review. Riskwatch White Paper, http://www.riskwatch.com/news/whitepapers/How_To_Do_A_Complete_Automated_Risk_Assessment_10-02RW.pdf; 2002 [accessed 4.1.2006]
  14. Ezell BC. Thesis/dissertation. University of Virginia: Systems Engineering Department; 1998
  15. Taylor C, Krings A, Alves-Foss J. Risk analysis and probabilistic survivability assessment (RAPSA): An assessment approach for power substation hardening. In: Proc. ACM workshop on scientific aspects of cyber terrorism. 2002. p. 1–9
  16. Schneier, 1999, Attack Trees, Dr. Dobb’s Journal, 24, 21

Cited by

Sorted by citations

Items 201–278 of 278

Metadata

Authors
Ralston, P. A. S., Graham, J. H., & Hieb, J. L.
Affiliations
University of Louisville (US)
Corresponding author
Ralston, P.A.S.
Venue
ISA Transactions
Publisher
Elsevier BV
Published
2007-10
Volume
46
Issue
4
Pages
583-594
ISSN
0019-0578 (ISSN-L)
OpenAlex
W2050588495
Cited by
267
References
62
Citations by year
2026: 5 · 2025: 8 · 2024: 18 · 2023: 15 · 2022: 10 · 2021: 18 · 2020: 26 · 2019: 34 · 2018: 27 · 2017: 18 · 2016: 17 · 2015: 13 · 2014: 11 · 2013: 8 · 2012: 12
FWCI
12.61
Type
journal article
Language
en
Open access
closed
Locations
  • ISA Transactions (publishedVersion)
  • PubMed (publishedVersion)
Funders
  • U.S. Department of Homeland Security
  • Furman University
Topics
  • Physical Sciences › Engineering › Control and Systems Engineering › Smart Grid Security and Resilience
  • Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
  • Physical Sciences › Engineering › Safety, Risk, Reliability and Quality › Risk and Safety Analysis
Keywords
cybersecurity risk assessment, SCADA systems, distributed control systems, industrial control systems, critical infrastructure, risk assessment methodology, HAZOP, fault tree analysis, event tree analysis, failure mode and effects analysis, attack probability

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review