A Configurable Dependency Model of a SCADA System for Goal-Oriented Risk Assessment
A Configurable Dependency Model of a SCADA System for Goal-Oriented Risk Assessment
复制标题
DOI：
10.3390/app12104880
复制
发表时间：
2022-05
期刊：
影响因子：
--
通讯作者：
Yulia Cherdantseva;P. Burnap;S. Nadjm-Tehrani;Kevin Jones
中科院分区：
文献类型：
--
作者：
Yulia Cherdantseva;P. Burnap;S. Nadjm-Tehrani;Kevin Jones
监控和数据采集（SCADA）系统的一个关键目的是能够对各种性质的物理过程进行现场或远程监控和监视。为了使SCADA系统安全可靠地运行，具有不同背景的广泛专家必须密切合作。在高抽象层次上对整个系统有一个总体的看法是至关重要的，这对所有相关的专家来说都是可以访问的，并且有助于测量和评估系统的风险。此外，SCADA系统由大量相互连接的技术和非技术子元素组成，捕获这些子元素之间的依赖关系对于全面和严格的风险评估至关重要。在本文中，我们提出了一个通用的可配置的依赖模型的SCADA系统，捕获复杂的依赖关系，在系统内，并促进目标导向的风险评估。该模型是通过收集和分析36个领域专家对SCADA系统内依赖关系的理解而开发的。我们描述了一种开发依赖模型的方法，提出了一个说明性的例子，其中通用依赖模型被配置为SCADA系统控制水分配，并概述了一个示例性的风险评估过程的基础上。
A key purpose of a Supervisory Control and Data Acquisition (SCADA) system is to enable either an on-site or remote supervisory control and monitoring of physical processes of various natures. In order for a SCADA system to operate safely and securely, a wide range of experts with diverse backgrounds must work in close rapport. It is critical to have an overall view of an entire system at a high level of abstraction which is accessible to all experts involved, and which assists with gauging and assessing risks to the system. Furthermore, a SCADA system is composed of a large number of interconnected technical and non-technical sub-elements, and it is crucial to capture the dependencies between these sub-elements for a comprehensive and rigorous risk assessment. In this paper, we present a generic configurable dependency model of a SCADA system which captures complex dependencies within a system and facilitates goal-oriented risk assessment. The model was developed by collecting and analysing the understanding of the dependencies within a SCADA system from 36 domain experts. We describe a methodology followed for developing the dependency model, present an illustrative example where the generic dependency model is configured for a SCADA system controlling water distribution, and outline an exemplary risk assessment process based on it.