CoChat
Sign Up
Cited by 47Infrastructure Resilience and Vulnerability AnalysisInformation and Cyber SecuritySmart Grid Security and Resilience

A Roadmap for Quantifying the Efficacy of Risk Management of Information Security and Interdependent SCADA Systems

Haimes, Yacov Y., Chittester, Clyde G·2005·Journal of Homeland Security and Emergency Management
DOI 10.2202/1547-7355.1117
Open this paper in CoChat — free account

Abstract

Many sectors of the economy and other critical infrastructures are highly coupled and their interdependencies render them at risk to cyber terrorist attacks. This fact is further exacerbated because they are often remotely controlled and managed through supervisory control and data acquisition (SCADA) systems, which are vulnerable to such cyber intrusion. The myriad sources of risk to SCADA systems identified through hierarchical holographic modeling (HHM)serve as the impetus to the roadmap for quantifying the efficacy of risk management of interdependent SCADA systems presented in this paper. Central to this quantification metric is the deployment of the inoperability input-output model (IIM). This is a Leontief-based model that enables accounting for both the intra-and interconnectedness within each economic sector and infrastructure. At the core of the IIM is the notion of risk of inoperability, which describes a critical infrastructure’s expected level of dysfunction. The input to the system is an initial perturbation triggered by an attack of terrorism, an accidental event, or a natural disaster. The outputs of the system are the resulting risks of inoperability of different infrastructures due to their connections to one another. These outputs are presented in two different metrics: (1) economic inoperability measured in dollars lost for each interdependent sector of the economy, and (2) functional inoperability measured in each sector’s percentage of dysfunctionality. This model addresses the equilibrium state of the system in the event of an attack, provided that the interdependency matrix is known. The national interdependency database provided by the Bureau of Economic Analysis (BEA), US Department of Commerce, constitutes the core database for the IIM interdependency matrix. The national database consists of 483 sectors and the regional of 37 sectors. The metric used for quantifying the efficacy of risk management of interdependent SCADA systems builds on the economic losses generated by the IIM resulting from a cyber attack with and then without risk management, and considering as well the cost of risk management. A scenario of a cyber attack on telecommunications and electric power infrastructures is discussed, using national BEA data. The results are analyzed, followed by a summary and conclusions.

Integrity signals

Registry

Crossref · 10.2202/1547-7355.1117

Cites

Statistics

Recomputing p-values needs the paper’s full text.

Claims the paper makes

We couldn’t retrieve this paper’s full text, so its claims and self-check weren’t run. The registry and citation checks still apply.

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • For predicting catastrophic events such as 9/11, Fukushima and Chernobyl, frequency-based statistical methods on which PRA methods rely have little value.

    “For predicting catastrophic events such as for example 9/11, Fukushima and Chernobyl frequency-based statisti-cal methods on which PRA methods rely have little value (Haimes and Chittester, 2005; Ramana, 2011).”

    From A review of cyber security risk assessment methods for SCADA systems (2016) · cites this paper as Haimes and Chittester, 2005

  • Without taking precautions, major disasters may not be averted in future as attackers get more sophisticated, experienced and malicious.

    “Unfortunately, without taking precau-tions we may not hope for this to happen in future as attackers get more sophisticated, experienced and malicious (Haimes and Chittester, 2005).”

    From A review of cyber security risk assessment methods for SCADA systems (2016) · cites this paper as Haimes and Chittester, 2005

Cites

Still being checked.

Cited by

Sorted by citations

Related

Authors
Haimes, Y. Y., & Chittester, C. G.
Affiliations
  • University of Virginia (US)
  • Carnegie Mellon University (US)
Venue
Journal of Homeland Security and Emergency Management
Publisher
Walter de Gruyter GmbH
Published
2005-06-14
Volume
2
Issue
2
ISSN
1547-7355 (ISSN-L)
DOI
10.2202/1547-7355.1117
OpenAlex
W1979407810
Cited by
46
References
0
Citations by year
2026: 1 · 2024: 1 · 2021: 1 · 2019: 2 · 2018: 3 · 2016: 2 · 2015: 3 · 2014: 2 · 2013: 8 · 2012: 5
FWCI
17.05
Type
journal article
Language
en
Open access
closed
Locations
Journal of Homeland Security and Emergency Management (publishedVersion)
Funders
  • U.S. Department of Homeland Security
  • U.S. Department of Commerce
Topics
  • Physical Sciences › Engineering › Civil and Structural Engineering › Infrastructure Resilience and Vulnerability Analysis
  • Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
  • Physical Sciences › Engineering › Control and Systems Engineering › Smart Grid Security and Resilience
Keywords
SCADA systems, critical infrastructure interdependencies, cyberattack risk, inoperability input-output model, Leontief input-output model, cyberterrorism, telecommunications infrastructure, electricity infrastructure

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review