A digraph model for risk identification and mangement in SCADA systems
Abstract
Supervisory control and data acquisition (SCADA) systems are critical to today's industrial facilities and infrastructures. SCADA systems have evolved into large and complex networks of information systems and are increasingly vulnerable to various types of cyber-security risks. Identifying and managing risks in SCADA systems has become critical in ensuring the safety and reliability of these facilities and infrastructures. Most of the existing research on SCADA risk modeling and management has focused on probability-based or quantitative approaches. While probabilistic approaches have proven to be useful, they also suffer from common problems such as simplifying assumptions, large implementation costs, and inability to completely capture all the important aspects of risk. This paper proposes a digraph model for SCADA systems that allows formal, explicit representation of a SCADA system. A number of risk management methods are presented and discussed for a SCADA system based on the proposed model. The methods are applied to a chemical distillation application as a case study, and shows promising initial results in identifying areas of system vulnerability.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Cyber attacks on CNI and SCADA have occurred over the last several decades.
“Over the last several decades we already saw a range of cyber attacks on CNI and SCADA.”
From A review of cyber security risk assessment methods for SCADA systems (2016) · cites this paper as Guan et al., 2011
PRA methods require continuous revision.
“• Continuous revision is required.”
From A review of cyber security risk assessment methods for SCADA systems (2016) · cites this paper as Guan et al., 2011
PRA methods provide no way to deal with hitherto unknown vulnerabilities, attacks or failure modes.
“• No way is provided to deal with hitherto unknown vulner-abilities, attacks or failure modes.”
From A review of cyber security risk assessment methods for SCADA systems (2016) · cites this paper as Guan et al., 2011
PRA methods suffer from the disadvantage that the estimation of risk is never complete in the mathematical sense.
“However, PRA methods suffer from a range of disadvantages (Guan et al., 2011; Morgan, 2013; Ramana, 2011): • The estimation of risk is never complete in the mathemati-cal sense.”
From A review of cyber security risk assessment methods for SCADA systems (2016) · cites this paper as Guan et al., 2011
Cites
Quantitative Cyber Risk Reduction Estimation Methodology for a Small SCADA Control System
McQueen, M. A., Boyer, W. F., Flynn, M. A., & Beitel, G. A. (2006) · Proceedings of the 39th Annual Hawaii International Conference on System Sciences (HICSS'06) · doi:10.1109/hicss.2006.405 · Cited by 104 · see citing works
Haimes, Y. Y., & Chittester, C. G. (2005) · Journal of Homeland Security and Emergency Management · doi:10.2202/1547-7355.1117 · Cited by 46 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
A review of cyber security risk assessment methods for SCADA systems
Cherdantseva, Y., Burnap, P., Blyth, A., Eden, P., Jones, K., Soulsby, H., & Stoddart, K. (2016) · Computers & Security · doi:10.1016/j.cose.2015.09.009 · Cited by 606 · see citing works
- Authors
- Guan, J., Graham, J. H., & Hieb, J. L.
- Affiliations
- University of Louisville (US)
- ORCID
- Guan, Jian
- Venue
- Proceedings of 2011 IEEE International Conference on Intelligence and Security Informatics
- Publisher
- IEEE
- Published
- 2011-07
- Pages
- 150-155
- OpenAlex
- W2107648568
- Cited by
- 18
- References
- 2
- Citations by year
- 2025: 1 · 2024: 2 · 2023: 1 · 2022: 1 · 2021: 3 · 2020: 2 · 2019: 2 · 2018: 2 · 2017: 1 · 2015: 1 · 2013: 1 · 2012: 1
- FWCI
- 1.07
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- IEEE International Conference on Intelligence and Security Informatics (ISI) (publishedVersion)
- Topics
- Physical Sciences › Engineering › Control and Systems Engineering › Smart Grid Security and Resilience
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Social Sciences › Decision Sciences › Statistics, Probability and Uncertainty › Risk and Safety Analysis
- Keywords
- SCADA systems, cybersecurity risks, risk identification, risk management, directed graph model, industrial control systems, system vulnerabilities
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
