In times of Industry 4.0 and cyber-physical systems (CPS) providing security is one of the biggest challenges. A cyber attack launched at a CPS poses a huge threat, since a security incident may affect both the cyber and the physical world. Since CPS are very flexible systems, which are capable of adapting to environmental changes, it is important to keep an overview of the resulting costs of providing security. However, research regarding CPS currently focuses more on engineering secure systems and does not satisfactorily provide approaches for evaluating the resulting costs. This paper presents an interaction-based model for evaluating security costs in a CPS. Furthermore, the paper demonstrates in a use case driven study, how this approach could be used to model the resulting costs for guaranteeing security.
This paper is a continuation of @cite_12 where we introduced a high-level process flow based on Six Sigma for identifying, categorizing, analysing and eliminating security risks and measuring the resulting costs. This initial investigation included the evaluation of (i) how security risks of a smart business use case can be eliminated by implementing security controls, and (ii) how the resulting costs could be measured using a monetary cost metric (Euro). Even though the two use cases used IoT-devices and cloud computing the evaluation did not include the costs of security for a CPS. To extend this work the key new contribution of this paper is to present a mathematical expression, which can be used to describe and evaluate security costs of a CPS and which allows the usage of more then one cost metric.
@cite_12
2509307846 2322987107 2792385697 2607627346
Abstract Estimating the possible impacts of security attacks on physical processes can help to rank the critical assets based on their sensitivity to performed attacks and predict their attractiveness from the attacker’s point of view. To address this challenge, this paper proposes a new method for assessing the direct and indirect impacts of attacks on cyber–physical systems (CPSs). The proposed method studies the dynamic behavior of systems in normal situation and under security attacks and evaluates the consequence propagation of attacks. The inputs to the model are control parameters including sensor readings and controller signals. The output of the model is evaluating the consequence propagation of attacks, ranking the important assets of systems based on their sensitivity to conducted attacks, and prioritizing the attacks based on their impacts on the behavior of system. The validation phase of the proposed method is performed by modeling and evaluating the consequence propagation of attacks against a boiling water power plant (BWPP). Industrial systems always prefer to reduce their operational expenses. To support such reductions, they need solutions that are capable of providing stability, fault tolerance, and flexibility. One such solution for industrial systems is cyber physical system (CPS) integration with the Internet of Things (IoT) utilizing cloud computing services. These CPSs can be considered as smart industrial systems, with their most prevalent applications in smart transportation, smart grids, smart medical and eHealthcare systems, and many more. These industrial CPSs mostly utilize supervisory control and data acquisition (SCADA) systems to control and monitor their critical infrastructure (CI). For example, WebSCADA is an application used for smart medical technologies, making improved patient monitoring and more timely decisions possible. The focus of the study presented in this paper is to highlight the security challenges that the industrial SCADA systems face in an IoT-cloud environment. Classical SCADA systems are already lacking in proper security measures; however, with the integration of complex new architectures for the future Internet based on the concepts of IoT, cloud computing, mobile wireless sensor networks, and so on, there are large issues at stakes in the security and deployment of these classical systems. Therefore, the integration of these future Internet concepts needs more research effort. This paper, along with highlighting the security challenges of these CI’s, also provides the existing best practices and recommendations for improving and maintaining security. Finally, this paper briefly describes future research directions to secure these critical CPSs and help the research community in identifying the research gaps in this regard. Evaluating the comprehensive performance of a warehouse-scale computer (WSC) has been a long-standing challenge. Traditional load-testing benchmarks become ineffective because they cannot accurately reproduce the behavior of thousands of distinct jobs co-located on a WSC. We therefore evaluate WSCs using actual job behaviors in live production environments. From our experience of developing multiple generations of WSCs, we identify two major challenges of this approach: 1) the lack of a holistic metric that incorporates thousands of jobs and summarizes the performance, and 2) the high costs and risks of conducting an evaluation in a live environment. To address these challenges, we propose WSMeter, a cost-effective methodology to accurately evaluate a WSC's performance using a live production environment. We first define a new metric which accurately represents a WSC's overall performance, taking a wide variety of unevenly distributed jobs into account. We then propose a model to statistically embrace the performance variance inherent in WSCs, to conduct an evaluation with minimal costs and risks. We present three real-world use cases to prove the effectiveness of WSMeter. In the first two cases, WSMeter accurately discerns 7 and 1 performance improvements from WSC upgrades using only 0.9 and 6.6 of the machines in the WSCs, respectively. We emphasize that naive statistical comparisons incur much higher evaluation costs (> 4 times) and sometimes even fail to distinguish subtle differences. The third case shows that a cloud customer hosting two services on our WSC quantifies the performance benefits of software optimization (+9.3 ) with minimal overheads (2.3 of the service capacity). An approach for integrating Six-Step Model (SSM) with Information Flow Diagrams (IFDs) is proposed. SSM is a model for Cyber-Physical System (CPS) safety and security analysis, which incorporates six hierarchies of CPS, namely, functions, structure, failures, safety countermeasures, cyber-attacks, and security countermeasures. Relationship matrices are used in SSM to identify inter-relationships between these hierarchies and determine the effect of failures and cyber-attacks on CPSs. Although SSM is a useful tool for CPS safety and security modeling, it lacks guidance for identifying failures and attacks, and selecting adequate set of safety and security countermeasures. To address this issue, an approach for integrating SSM with IFDs is proposed and explained using the water treatment system example.