The DOI matches its Crossref record; 10 of the 11 references it cites were found in a registry or an index.
Quantitative Cyber Risk Reduction Estimation Methodology for a Small SCADA Control System
Open accessAbstract
We propose a new methodology for obtaining a quantitative measurement of the risk reduction achieved when a control system is modified with the intent to improve cyber security defense against external attackers. The proposed methodology employs a directed graph called a compromise graph, where the nodes represent stages of a potential attack and the edges represent the expected time-to-compromise for differing attacker skill levels. Time-to-compromise is modeled as a function of known vulnerabilities and attacker skill level. The methodology was used to calculate risk reduction estimates for a specific SCADA system and for a specific set of control system security remedial actions. Despite an 86% reduction in the total number of vulnerabilities, the estimated time-to-compromise was increased only by about 3 to 30% depending on target and attacker skill level.
Overview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“Among the triad, integrity and availability are highly paramount, while confidentiality is secondary for SCADA systems (Cheminod et al., 2013; McQueen et al., 2006).”
From A review of cyber security risk assessment methods for SCADA systems (2016) · cites this paper as McQueen et al., 2006
In the citing paper
“Only in two papers, namely McQueen et al. (2006) and Patel and Zaveri (2010), it is explicitly mentioned that the method was applied to a real system.”
From A review of cyber security risk assessment methods for SCADA systems (2016) · cites this paper as McQueen et al. (2006)
In the citing paper
“The authors of the methods examined point out that data required for the effective estimation of risk are rarely avail-able (Dondossola et al., 2009; McQueen et al., 2006) and, therefore, research often has to rely on artificial data (Luiijf et al., 2009).”
From A review of cyber security risk assessment methods for SCADA systems (2016) · cites this paper as McQueen et al., 2006
In the citing paper
“There are though several proposals (Henry and Haimes, 2009; LeMay et al., 2011; McQueen et al., 2006; Patel et al., 2008), which we mark with regarding risk evaluation in Table 7, where the comparison of risk metrics is performed between differ-ent security configurations of a system.”
From A review of cyber security risk assessment methods for SCADA systems (2016) · cites this paper as McQueen et al., 2006
Citations
Cites
Automated generation and analysis of attack graphs
Sheyner, O., Haines, J. W., Jha, S., Lippmann, R. P., & Wing, J. M. (2005) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/secpri.2002.1004377 · Cited by 1,303
Modeling and simulating critical infrastructures and their interdependencies
Rinaldi, S. M. (2004) · Proceedings of the ... Annual Hawaii International Conference on System Sciences/Proceedings of the Annual Hawaii International Conference on System Sciences · doi:10.1109/hicss.2004.1265180 · Cited by 431
Advanced Techniques for Modeling Terrorism Risk
Major, J. A. (2002) · The Journal of Risk Finance · doi:10.1108/eb022950 · Cited by 196
Modeling and quantification of security attributes of software systems
Madan, B. B., Goševa-Popstojanova, K., Vaidyanathan, K., & Trivedi, K. S. (2003) · International Conference on Dependable Systems & Networks/Proceedings · doi:10.1109/dsn.2002.1028941 · Cited by 157
Time-to-Compromise Model for Cyber Risk Reduction Estimation
McQueen, M., Boyer, W. F., Flynn, M. A., & Beitel, G. A. (2008) · Springer eBooks · doi:10.1007/978-0-387-36584-8_5 · Cited by 137
Self-citationModels and tools for quantitative assessment of operational security
Daciér, M., Deswarte, Y., & Kaâniche, M. (1996) · IFIP advances in information and communication technology · doi:10.1007/978-1-5041-2919-0_15 · Cited by 119
Quantitative Assessment of Operational Security: Models and Tools *
Daciér, M., & Deswarte, Y. (1996) · Cited by 97
Hacking Exposed Windows 2000: Network Security Secrets and Solutions
Scambray, J., & McClure, S. (2001) · McGraw-Hill Professional eBooks · Cited by 15
Balanced Scorecard Method For Predicting TheProbability Of A Terrorist Attack
Beitel, G. A., Gertman, D. I., & Plum, M. (2004) · WIT transactions on ecology and the environment · doi:10.2495/risk040531 · Cited by 11
Self-citationExpected losses, insurability, and benefits from reducing vulnerability to attacks.
Nozick, L. K., Carlson, R. E., & Turnquist, M. A. (2004) · doi:10.2172/918740 · Cited by 5
Flagged first, then by citations
1 of the 11 references couldn’t be matched to a known paper.
Research works printed but not linked: 3
- byres, 2004, The use of attack trees in assessing vulnerabilities in SCADA systems, IEEE Conf International Infrastructure Survivability Workshop (IISW '04)
- haimes, 2003, Accident precursors, terrorist attacks, and systems engineering, NAE Workshop
- taylor, 2002, Risk Analysis and Probabilistic Survivability Assessment (RAPSA): An assessment approach for power substation hardening, ACM Workshop of Scientific Aspects of Cyber Terrorism
Cited by
Sorted by citations
Items 101–104 of 104
Flaus, J. (2019) · doi:10.1002/9781119644538.refs
Ahmadian, M. M., Rad, B. M., & Ahmadian, M. H. (2025) · International Conference on Protection and Automation of Power Systems (IPAPS) · doi:10.1109/ipaps65933.2025.11092272
Risk assessment and SCADA systems
Kaur, M., & Ramkumar, K. R. (2026) · AIP conference proceedings · doi:10.1063/5.0329174
Metadata
- Authors
- McQueen, M. A., Boyer, W. F., Flynn, M. A., & Beitel, G. A.
- Affiliations
- Idaho National Laboratory (US)
- Venue
- Proceedings of the 39th Annual Hawaii International Conference on System Sciences (HICSS'06)
- Publisher
- IEEE
- Published
- 2006
- Pages
- 226-226
- ISSN
- 1530-1605 (ISSN-L)
- OpenAlex
- W2113310679
- Cited by
- 104
- References
- 11
- Citations by year
- 2026: 1 · 2025: 2 · 2024: 5 · 2023: 5 · 2022: 3 · 2021: 3 · 2020: 5 · 2019: 11 · 2018: 6 · 2017: 6 · 2016: 3 · 2015: 8 · 2014: 7 · 2013: 11 · 2012: 3
- FWCI
- 8.56
- Type
- conference paper
- Language
- en
- Open access
- green
- www.osti.gov
- Locations
- Hawaii International Conference on System Sciences (HICSS) (publishedVersion)
- OSTI OAI (U.S. Department of Energy Office of Scientific and Technical Information) (submittedVersion)
- University of North Texas Digital Library (University of North Texas) (submittedVersion)
- Topics
- Physical Sciences › Engineering › Control and Systems Engineering › Smart Grid Security and Resilience
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Physical Sciences › Engineering › Civil and Structural Engineering › Infrastructure Resilience and Vulnerability Analysis
- Keywords
- cyber risk reduction, SCADA systems, vulnerability remediation, directed graph modeling, quantitative risk assessment, industrial control systems
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
