A Framework for Risk-Informed Metrics-Enriched Cybersecurity Playbooks for CNI Resilience

该项目的最终目标是通过及时有效的事件响应来提高英国CNI的弹性。为了实现这一目标，该项目将提供一个框架，用于为关键国家基础设施创建风险信息度量丰富的剧本（FRIMP 4CNI）。我们建议以一种完全不同的方式处理事件响应剧本。首先，本项目中的剧本被集成到受事件影响的核心CNI流程中，显示了制定特定响应如何影响核心流程以及相互依赖的流程。第二，我们的行动手册不仅涉及技术行动，还着眼于技术以外的方面，例如行动反应、与工作人员可用性和成本有关的问题、报告程序、政治和沟通反应。第三，行动手册是风险信息，因为每个行动手册都有一个相关的风险模型;第四，它们丰富了业务驱动的多方面指标，这些指标反映了事件对核心流程造成的变化。第五个特征是我们的剧本是最优的：将优化算法应用于一组替代响应策略，以确定每个案例的最优响应剧本。上述功能的组合使我们的方法独一无二，并使我们的行动手册既可作为行动指南，改善网络安全事件响应，又可作为董事会层面的决策支持工具。该项目有三个主要目标：1。创建一个基于实践的工具支持的可操作框架，用于开发定制的风险信息化指标丰富的网络安全剧本，通过采用和模拟集成剧本格式的事件响应最佳实践，针对增强CNI弹性的挑战量身定制。2.设计、实施和测试软件工具，以支持与流程建模、风险评估和响应策略优化相关的框架方面，并将其整合到全面的CNI剧本设计工具集中。该项目将提供开发最佳风险信息和指标驱动剧本所需的完整技术堆栈。工具支持将提高使用意愿，并促进在实践中更快地采用该框架。3.使用参与大学和行业合作伙伴的现有测试平台评估框架，并通过与行业合作伙伴和具有广泛背景的各个领域专家的焦点小组和研讨会，从网络工程师到ICS运营商，从董事会成员到政策制定者。必须与从业人员一起进行广泛的评估，以确保框架和工具有效、可获得并实现每个利益攸关方群体的预期目的。

The ultimate goal of the project is to improve CNI resilience in the UK by enabling timely and efficient incident response. To achieve this, this project will deliver a Framework for creating Risk-Informed Metrics-enriched Playbooks for Critical National Infrastructure (FRIMP4CNI). We propose to approach incident response playbooks in a fundamentally different way. First, playbooks in this project are integrated into core CNI processes affected by an incident, showing how enacting a particular response affects core processes as well as interdependent processes. Second, our playbooks address more than technical actions, they look at aspects beyond technology, e.g. operational response, issues related to staff availability and costs, reporting process, political and communication response. Third, playbooks are risk-informed because each playbook has an associated risk model; and fourth, they are enriched with business-driven multifaceted metrics which reflect the changes that an incident inflicts on a core process. Fifth feature is that our playbooks are optimal: an optimisation algorithm is applied to a set of alternative response strategies to identify the optimal response playbook for each case. A combination of the features listed above makes our approach unique and allows our playbooks to serve both as an action guide enabling improved cybersecurity incident response and as a decision support tool at the Board level. The project has three key objectives:1. Create an empirically-grounded tool-supported actionable framework for developing bespoke risk-informed metrics-enriched cybersecurity playbooks tailored to the challenges of enhancing resilience in CNI by adopting and modelling incident response best practices in a format of integrated playbooks. 2. Design, implement and test software tools supporting the aspects of the framework related to process modelling, risk assessment and response strategy optimisation, and to integrate them into a comprehensive CNI Playbook Design Toolset. The project will deliver the full technology stack required to develop optimal risk-informed and metric-driven playbooks. Tool-support will increase the intention to use and facilitate faster adoption of the framework in practice. 3. Evaluate the framework using existing testbeds at the participating universities and industry partners, and via focus groups and workshops with industry partners and individual domain experts with a broad range of backgrounds and in varying roles from network engineers to ICS operators to Board members to policy makers. It is essential to conduct extensive evaluation with practitioners to ensure that the framework and tools are effective, accessible and fulfil the intended purposes for each group of stakeholders.