The DOI matches its Crossref record; 54 of the 62 references it cites were found in a registry or an index.
Cyber security risk assessment for SCADA and DCS networks
Abstract
The growing dependence of critical infrastructures and industrial automation on interconnected physical and cyber-based control systems has resulted in a growing and previously unforeseen cyber security threat to supervisory control and data acquisition (SCADA) and distributed control systems (DCSs). It is critical that engineers and managers understand these issues and know how to locate the information they need. This paper provides a broad overview of cyber security and risk assessment for SCADA and DCS, introduces the main industry organizations and government groups working in this area, and gives a comprehensive review of the literature to date. Major concepts related to the risk assessment methods are introduced with references cited for more detail. Included are risk assessment methods such as HHM, IIM, and RFRM which have been applied successfully to SCADA systems with many interdependencies and have highlighted the need for quantifiable metrics. Presented in broad terms is probability risk analysis (PRA) which includes methods such as FTA, ETA, and FEMA. The paper concludes with a general discussion of two recent methods (one based on compromise graphs and one on augmented vulnerability trees) that quantitatively determine the probability of an attack, the impact of the attack, and the reduction in risk associated with a particular countermeasure.
Overview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“ICS integrity is critical to OT security and the priority is to detect various security events and incidents, such as failure of devices and services exhausting resources early [100].”
From Industrial IoT, Cyber Threats, and Standards Landscape: Evaluation and Roadmap (2021) · cites this paper as [100]
In the citing paper
“Risk assessment methods in general and in the context of SCADA systems specifically are hard to categorise as we con-clude based on our analysis and in agreement with Morgan (2013) and Ralston et al. (2007).”
From A review of cyber security risk assessment methods for SCADA systems (2016) · cites this paper as Ralston et al., 2007
In the citing paper
“An extensive overview of risk assessment meth-odologies is contained in Ralston et al. (2007), but only two methods are examined in detail.”
From A review of cyber security risk assessment methods for SCADA systems (2016) · cites this paper as Ralston et al., 2007
In the citing paper
“As pointed out in Morgan (2013) and Ralston et al. (2007), risk assessment methods as applied to SCADA systems are dif-ficult to categorise.”
From A review of cyber security risk assessment methods for SCADA systems (2016) · cites this paper as Ralston et al., 2007
In the citing paper
“In Cheminod et al. (2013), Patel et al. (2008), Ralston et al. (2007), Taylor et al. (2002), among proba-bilistic tree-based methods for SCADA systems inductive and deductive methods are distinguished.”
From A review of cyber security risk assessment methods for SCADA systems (2016) · cites this paper as Ralston et al., 2007
In the citing paper
“In 2007, in Ralston et al. (2007) it was mentioned that a “natural extension to PRA involves the use of fuzzy concepts, though this approach has not been published for use in SCADA system security risk assessment.””
From A review of cyber security risk assessment methods for SCADA systems (2016) · cites this paper as Ralston et al. (2007)
Citations
Cites
On the quantitative definition of risk
Kaplan, S., & Garrick, B. J. (1981) · Risk Analysis · doi:10.1111/j.1539-6924.1981.tb01350.x · Cited by 3,103
Attack trees : Modeling security threats
Schneier, B. (1999) · Medical Entomology and Zoology · Cited by 635
Risk Modeling, Assessment, And Management
Haimes, Y. Y. (1999) · IEEE Transactions on Systems Man and Cybernetics Part C (Applications and Reviews) · doi:10.1109/tsmcc.1999.760577 · Cited by 627
Probabilistic Risk Assessment and Management for Engineers and Scientists
Kumamoto, H., & Henley, E. J. (1996) · CERN Document Server (European Organization for Nuclear Research) · Cited by 618
Security issues in SCADA networks
Igure, V. M., Laughter, S. A., & Williams, R. D. (2006) · Computers & Security · doi:10.1016/j.cose.2006.03.001 · Cited by 566
Modeling and simulating critical infrastructures and their interdependencies
Rinaldi, S. M. (2004) · Proceedings of the ... Annual Hawaii International Conference on System Sciences/Proceedings of the Annual Hawaii International Conference on System Sciences · doi:10.1109/hicss.2004.1265180 · Cited by 431
Introduction to the OCTAVE Approach
Alberts, C., Dorofee, A., Stevens, J. F., & Woody, C. (2003) · doi:10.21236/ada634134 · Cited by 262
Attack Modeling for Information Security and Survivability
Moore, A. P., Ellison, R. J., & Linger, R. C. (2001) · doi:10.1184/r1/6572063.v1 · Cited by 259
Making the Nation Safer: The Role of Science and Technology in Countering Terrorism
Cohen, E. A. (2002) · Foreign Affairs · doi:10.2307/20033374 · Cited by 227
Attack Modeling for Information Security and Survivability
Moore, A. P., Ellison, R. J., & Linger, R. C. (2001) · doi:10.21236/ada387544 · Cited by 226
Flagged first, then by citations
8 of the 62 references couldn’t be matched to a known paper.
Research works printed but not linked: 16
- Smith, 2003, Connection to public communications increases danger of cyber-attacks, Pipeline and Gas Journal, 230, 20
- Watts D. Security & vulnerability in electric power systems. In: 35th North American Power Symposium. 2003. p. 559–66
- Oman P, Schweitzer E, Roberts J. Safeguarding IEDs, substations, and SCADA systems against electronic intrusions. In: Proceedings of the 2001 western power delivery automation conference. 2001. p. 9–12
- Novak, 2005, Merging SCADA and business processes, Plant Engineering, 59, 35
- Asenjo, 2005, Cybersecurity for legacy SCADA systems, Utility Automation and Engineering T&D, 10, 48
- 2005, Battling the cyber menace, PEI Power Engineering International, 13, 123
- SAAD AY. Securing supervisory control and data acquisition systems: Plant utilities: A special report. Hydrocarbon processing (International Ed.) 2002; 81(7); 55–6
- Byres, 2005, Insidious threat to control systems, InTech, 52, 28
- Byres, 2006, Uncovering cyber flaws, InTech, 53, 20
- Carlson, 2005, DHS to state its case to business, Eweek, 42, 20
- 2005, Honeywell reshapes industrial control world, Manufacturing Computer Solutions, 37
- Miller, 2005, Risk assessment: The first step, InTech, 52, 68
- How to do a Complete Automated Risk Assessment: A Methodology Review. Riskwatch White Paper, http://www.riskwatch.com/news/whitepapers/How_To_Do_A_Complete_Automated_Risk_Assessment_10-02RW.pdf; 2002 [accessed 4.1.2006]
- Ezell BC. Thesis/dissertation. University of Virginia: Systems Engineering Department; 1998
- Taylor C, Krings A, Alves-Foss J. Risk analysis and probabilistic survivability assessment (RAPSA): An assessment approach for power substation hardening. In: Proc. ACM workshop on scientific aspects of cyber terrorism. 2002. p. 1–9
- Schneier, 1999, Attack Trees, Dr. Dobb’s Journal, 24, 21
Cited by
Sorted by citations
Attacks against process control systems: risk assessment, detection, and response
Cárdenas, A. A., Amin, S., Lin, Z.-S., Huang, Y.-L., Huang, C.-Y., & Sastry, S. (2011) · Proceedings of the 6th ACM Symposium on Information, Computer and Communications Security · doi:10.1145/1966913.1966959 · Cited by 699
A review of cyber security risk assessment methods for SCADA systems
Cherdantseva, Y., Burnap, P., Blyth, A., Eden, P., Jones, K., Soulsby, H., & Stoddart, K. (2016) · Computers & Security · doi:10.1016/j.cose.2015.09.009 · Cited by 606
Vikhram, G. Y. R., Elavarasan, R. M., Premkumar, M., & Mihet‐Popa, L. (2020) · IEEE Access · doi:10.1109/access.2020.3016826 · Cited by 396
Review of security issues in industrial networks
Cheminod, M., Durante, L., & Valenzano, A. (2013) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2012.2198666 · Cited by 349
A survey of cyber security management in industrial control systems
Knowles, W., Prince, D., Hutchison, D., Disso, J. F. P., & Jones, K. (2015) · International Journal of Critical Infrastructure Protection · doi:10.1016/j.ijcip.2015.02.002 · Cited by 344
Metadata
- Authors
- Ralston, P. A. S., Graham, J. H., & Hieb, J. L.
- Affiliations
- University of Louisville (US)
- Corresponding author
- Ralston, P.A.S.
- ORCID
- Ralston, P.A.S.
- Venue
- ISA Transactions
- Publisher
- Elsevier BV
- Published
- 2007-10
- Volume
- 46
- Issue
- 4
- Pages
- 583-594
- ISSN
- 0019-0578 (ISSN-L)
- OpenAlex
- W2050588495
- Cited by
- 267
- References
- 62
- Citations by year
- 2026: 5 · 2025: 8 · 2024: 18 · 2023: 15 · 2022: 10 · 2021: 18 · 2020: 26 · 2019: 34 · 2018: 27 · 2017: 18 · 2016: 17 · 2015: 13 · 2014: 11 · 2013: 8 · 2012: 12
- FWCI
- 12.61
- Type
- journal article
- Language
- en
- Open access
- closed
- Locations
- ISA Transactions (publishedVersion)
- PubMed (publishedVersion)
- Funders
- U.S. Department of Homeland Security
- Furman University
- Topics
- Physical Sciences › Engineering › Control and Systems Engineering › Smart Grid Security and Resilience
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Physical Sciences › Engineering › Safety, Risk, Reliability and Quality › Risk and Safety Analysis
- Keywords
- cybersecurity risk assessment, SCADA systems, distributed control systems, industrial control systems, critical infrastructure, risk assessment methodology, HAZOP, fault tree analysis, event tree analysis, failure mode and effects analysis, attack probability
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
