Present the Ability of Risk Approaches to Adapt to Technology Evolution

978-1-5386-7531-1/18/$31.00 ©2018 IEEE

Intelligent System for Risk Identification of Cybersecurity Violations in Energy Facility

Gaskova Daria, Aleksei Massel Laboratory of Information Systems in energetics Melentiev Energy Systems Institute of SB RAS

Irkutsk, Russia [email protected], [email protected]

Abstract—The article describes risk-based approach intended

for analyzing threat and assessing risk of cybersecurity violations in the energy facilities. In the energy sector this approach should consider harm produced by damage or demolition of the object using quantitative and qualitative parameters. It is based on the probability of damage or destruction of the facility resulting in the cascade failure. It can be employed for developing the information-analytical system aimed to monitor cybersecurity violations in the energy sector.

Keywords—cybersecurity; critical infrastacture; risk assessment; intelligent system

I. INTRODUCTION The Russian energy infrastructure is truly significant, as it

combines power plants and energy systems, including energy transporting main lines. The critical infrastructures are currently being explored [1-2]. Because the energy penetrated all life spheres in the modern society, it is believed to be the vital component of national security [3]. It is noteworthy, that energy security (ES) makes an important part of Russia’s national security. The development of Smart Grid conception in Russia exacerbates the problem of cybersecurity in energy. ES threats are traditionally classified into five main groups: economic, social-political, technogenous, natural and managerial-legal [4]. This threat list was supplemented with the cybersecurity threats [2], their implementation possibly provoking serious emergency situations in energy fraught with drastic reduction of energy resources to be provided to consumers.

The rapid spread of the computer environment, development of information technologies and the trend of transition to intellectual energy make the cyber threats most notable tactical threats of ES. As a matter of fact, both systematic preventive measures of cyber threats averting and continuous protection updating are underrated. It can lead to significant long-term deficit of energy supply, which negative impacts depend on cyber threats scale and damage.

Complimented by the reasons above, the authors propose to create an intelligent system capable to identify risk of cybersecurity violations in the energy facility based on a risk- based approach.

II. ENERGY AS AN IMPORTANT CRITICAL INFRASTRUCTURE Critical infrastructure is part of civil infrastructure, which

makes up a combination of physical or virtual systems and

means that are important for the country, as their failure or destruction can trigger disastrous consequences in the fields of defense, economy, and health and nation security [1].

The requirements for ensuring cybersecurity in the energy sector were formed in the foreign countries [5]. Actually in Russia the normative framework for ensuring cybersecurity in critical infrastructures is beginning to be formed. Information protection in the automatic process control system in energy is usually provided on the basis of the Federal Service for Technical and Export Control of Russia order № 31 [6]. This order establishes requirements to ensure protection of information in critical objects from illegal actions, including computer attacks. The development of the normative framework of the information protection in critical infrastructure is that the project stage of the Federal Law “On the Security of the Critical Information Infrastructure of the Russian Federation (RF)”. The draft law establishes the main directions and principles to ensuring security of critical information infrastructure, the government agent powers of the RF in this area, and also the rights, duties and responsibilities of owners, communications, providers and operators and also state information system operators that provide the functioning and interaction of these facilities [7].

Investigations of critical infrastructure and, in particular, identification of critically dangerous facilities are a focus area in many countries and primarily in the United States. The reason for this is that the development level of information technologies and capacity of modern simulation complexes constantly increase [1].

Nowadays the energy sector in Russia occurs at the stage of intellectualization, including both technological equipment (e.g. smart sensors, data transmission networks) and application of modern information technologies, primarily in the electrical energy industry. At the same time, the introduction of information technologies into the energy industry carries many risks and threats [8].

III. CYBERSECURITY According to the standard T-REC-X.1205 - ITU-T [9],

cybersecurity is treated as a set of tools, strategies, principles of security, security guarantees, guidelines, risk management approaches, actions, training, experience, insurance and technologies that can be used to protect the cyber environment, resources, organizations and users.

This work was partially supported by RFBR grants №15-07-01284, №17- 07-01341. The authors are grateful to this organization.

Authorized licensed use limited to: Northcentral University. Downloaded on October 19,2021 at 13:52:31 UTC from IEEE Xplore. Restrictions apply.

Cyber environment is connected with computing devices, personnel, infrastructure, applications, services, telecommunications systems, as well as the totality of transmitted and / or stored information.

Cybersecurity is an attempt to achieve and maintain the security properties from the resources of the organization or user against relevant security threats in the cyber environment.

According to ISO 27032: 2012 [10], cybersecurity is based on: Applications Security, Information Security; Network Security, Internet Security and Critical Information Infrastructure Protection, but – isn’t their synonymous.

The protection of key information systems of critical infrastructures primarily concerns ensuring ES facility.

The main concepts of cybersecurity are the asset, threat, vulnerability and risk. The main definitions of security and their relationships, described in foreign and translated standards [2] share similarities. Security is concerned with the assets protecting from threats classified based on the potential of protected assets abuse, and particular attention is paid to the threats that are associated with malicious or other human actions [11].

The ontology of cybersecurity in the energy sector [12] and the methodology for threats analysis and risk assessment of security violations in energy complexes were developed at the Melentiev Energy Systems Institute SB RAS. The methodology including eight stages is based on expert assessments and methods of qualitative risk analysis [13].

An asset is some entity valuable to a person or organization [11]. A security threat is possible action that can directly or indirectly damage the information security. The damage to security is understood as violation of confidentiality, accessibility or / and integrity of information.

Threats are classified by the nature of the occurrence, deliberateness degree, manifestation of direct threat source, position of threat source, extent of dependence upon activity, degree of impact on the system, resources access methods, current location of information stored and processed in the system. In particular threats are classified by the degree of deliberateness:

Threats caused by human errors or negligence.

Threats of deliberate action.

Cybernetic attack is the threat of deliberate action, initiated by a man.

Vulnerability is the weakness in the information system, security system and internal controls gaps that can be exploited or caused by a threat source [14].

Risk is an event with negative consequences caused by external or internal factors [14]. Risk can be defined as a combination of the accident probability and the scale of the damage it can cause, or as a combination of the event probability and impact [2].

Risk management is the process of in-depth study factors that can lead to realization of possible threats to the assets of

the system. The PDCA (Plan, Do, Check, Act) process model also known as the Deming-Shewhart cycle is common for risk assessment [11].

The widespread interest in the industrial systems security arose not so long ago after a series of specialized computer virus incidents, such as Flame and Stuxnet. At that time it was transpired, that international intelligence agencies, competing corporations or cyber-terrorists can use inadequate attention to the information security of the automatic process control system and their components for their own purposes (for instance, Supervisory Control And Data Acquisition SCADA / Power-Line Communication PLC) [15].

The development of an effective cybersecurity strategy requires a holistic approach to risk analysis. This means that systematic documentation and prioritization of the existing vulnerabilities (threats) of the management system and their possible consequences are required. Therefore, the owners of energy assets can make adequate decisions to anticipate and respond to the existing and potential threats.

IV. RISK-BASED APPROACH Risk-based approach considers harm from damage or

demolition of the object using quantitative and qualitative parameters, as well as further damage or destruction probability of the object components, based on probability of damage or destruction of object leading to cascade failure. The formula of risks consists of three components (1),

R = {T, V, D}, (1)

T – threats, V – vulnerabilities, D – damage by threat realization.

Threats are defined through the probability of events occurrence leading to critical situations (for example, conditional probabilities used in the Bayesian networks). Cyber threats can call subsequent implementation of the other ES threats. It was suggested to apply the Bayesian networks to build cyber threats implementation scenarios using conditional probability.

Assets vulnerabilities are determined by an expert poll using production expert system. The knowledge base of the expert system includes the standards of the five components of cybersecurity.

The damage is traditionally evaluated in monetary terms; however, conventional units are applied at this stage.

It is proposed to develop an intelligent system to support decision-making concerning assurance of energy facility cybersecurity by a specialist involved in information security. This system utilizing the risk-based approach should contribute to identifying critical assets, their vulnerabilities and threats to security violations, determination scenarios for applying threats and measures to protect assets from threats. The system will dwell upon the methodology for analyzing threats and assessing risk of information technology security violations of the energy complexes proposed by A. Massel [16].

Authorized licensed use limited to: Northcentral University. Downloaded on October 19,2021 at 13:52:31 UTC from IEEE Xplore. Restrictions apply.

V. THE INTELLIGENT SYSTEM DEVELOPMENT In current times the structure of intelligent system for risk

identification of cybersecurity violations in energy facilities is designed, and also scientific-research prototype for system describe above is implemented. One consists of three interrelated components: (1) an expert system for recognizing vulnerability and primary threats, (2) the Bayesian network for modeling threat scenarios, and (3) the module for assessing risk of cybersecurity violations, which includes visualization as a risk map.

The intelligent system structure is shown in Figure 1.

Expert system

Bayesian network

Risk evaluation

Expert

List of vulnerabilities

List of threats

Threats scenarios

Damage Threats scenarios

Map of risks

Fig. 1. Structure of intelligent system.

Figure 2 shows the ontology of basic concepts of cyber threats incorporated into an intelligent system.

Fig. 2. The ontology of basic concepts of cyber threats.

Assets are considered in terms of the information infrastructure of critical facility, e.g. assets of automatic process control system are considered at the levels of: operator, automatic control, and executive devices.

Threats and vulnerabilities are first considered at the top level, including general concepts and their most extensive list, and then at a detailed level that provides specific names, technical and software types and species.

The expert system involves three issues: (1) the energy facility asset, (2) vulnerability of information technology system and (3) cybersecurity violation threat of the facility. The expert system is intended for detecting primary vulnerabilities and threats of the facility. It is based on the user that is information security specialist answers to the questions offered by the system in the form of a questionnaire.

The interconnection between assets, vulnerabilities and threats within the system is established by templates. The template has a number of main fields. The vulnerability pattern is exemplified as:

<Vulnerabilities >

< Title >…</ Title >

<Assets >…</Assets >

<Threats>…</Threats> or <List of threats> …</List of threats>

<Control>…</ Control>

</Vulnerabilities >

The most common vulnerabilities and threats described to instance energy facility are searched for, and then their list is formed.

Further the list of threats is delivered to the Bayesian network to determine conditional probabilities and build threats realization scenarios.

The scientific prototype of the production expert system has been recently implemented. Figure 3 illustrates the prototype structure.

JAVA CLIPS

JNI

Swing

Listeners

Core of Expert system

Knowledge base

Inference engine

Rules Templates

Graphical Users Interface

Interaction interface

Fig. 3. Prototype structure.

The graphical user interface (GUI) includes data display, user interface event service; it is accomplished in the high-level Java language using the Swing library. The interaction interface is a Java native interface (JNI) mechanism for running code controlled by the Java virtual machine, which is employed for the GUI to C Language Integrated Production System (CLIPS) interaction. The core of the expert system is produced using software environment for the expert systems development CLIPS, and it is a logical inference mechanism and knowledge base.

Authorized licensed use limited to: Northcentral University. Downloaded on October 19,2021 at 13:52:31 UTC from IEEE Xplore. Restrictions apply.

The Bayesian network will be employed with the same software tools that were used for the expert system prototype for their integration. Threats and their partial communication established in the expert system are transferred to the Bayesian network for the expert work. It is assumed that the threat pattern has tag fields containing lists of threats that usually cause or are the cause of the other threat. An expert checks the existing links and establishes the missing links between the threats, resulting in a threat graph, i.e. scenarios of threat realization. The graph model determines conditional probabilities sated a priori probability of realizing threats acting as an initiating event. The use of the Bayesian network allows analyzing the cyber threats impact on energy security violation threats. Figure 4 illustrates the “unauthorized access” threat scenario.

Fig. 4. Realization of threat “unauthorized access” using the Bayesian

network in the Netica program.

For example, let us define the probability of “unauthorized access” to the automated workstation of the SCADA system manager threat. Suppose that the result of the expert's work with the expert system is a list of threats, such as the possibility to steal password, weak password policy and, as a consequence, the probability of unauthorized access by an attacker. The easy, average and difficult accessibility of stolen password are the three states of the “steal a password” threat. The password policy can also have three states: weak, medium and strong. Depending on the likelihood of described above threats implementing the threat of “unauthorized access” can be either realizable or unrealizable with a certain calculated probability. The attacker’s obtained access can affect the state of the energy facility data transmission. With that energy facility functioning can be disrupted, if information about the pre-crisis state of the system will be significantly detained or lost.

The presented example assumes weak password policy, and that the password on the facility can be easily stolen. Then the fact of the system pre-crisis state is the case. Most probably, an attacker will not disclose his unauthorized access and will delay information on the system state. In this case, the probability of transiting from the pre-crisis to the crisis state is high.

Risk will be assessed by graph traversing for each plausible scenario in the expert view. In order to do that an expert will fill in “damage” fields for each field of final states in the scenario. The module will calculate risk, where the risk is a multiplication of the likelihood of the threat realized for damage from it, and display a ranked list of scenarios.

In addition, the risk assessment module should provide a visualization of threat implementation risk card for a certain asset. A risk map is needed to display risks following threat types and the risk acceptance boundary. Figure 5 displays a risk map. The ranked list of critical assets of the facility is also supposed to be displayed. In these instances, critical assets are the assets, which accounted for the greatest number of threats in the scenarios, and the likelihoods of the threat implementation are over than the limit likelihood assigned by an expert.

Type of threats1

Ty pe

of th

re ats

2

Type of threats3

Ty pe

of th

re ats

2

Ty pe

of th

re ats

2

Critical threats

Type of threats1

Type of threats1

Type of threats3 Type of threats3

Risk acceptability line

Fig. 5. Example of risk map.

VI. CONCLUSION The article reports the energy sector as a critical

infrastructure and important part of national security. Considering, there is a tendency to introduce new information and telecommunication technologies into the energy sector, it is vital to ensure high-quality provision of cybersecurity. A risk-based approach is proposed to allow linking cybersecurity violations vulnerabilities, threats and damages. It is proposed to develop an intelligent system for risk assessment of cybersecurity violations from most feasible cyber threats with risk-based approach and the methodology of threat analysis and risk assessment applied.

REFERENCES [1] A. Kondratev, “The current trends in research of Critical Infrastructure

in foreign countries,” Foreign Military Review, no. 1, 2012, pp. 19-30. [2] L.V. Massel, N.I. Voropai, S.M. Senderov, A.G. Massel, “Cybersecurity

as one of the strategic threats to energy security,” Cybersecurity issues, no. 4 (17), 2016, pp. 2-10.

[3] B.G. Saneev, S.P. Filipov et al, “System researches of energy problems”, Novosibirsk: Nauka, p. 588, 2000.

[4] N.I. Pyatkova, V.I. Rabchuk, S.M. Senderov, M.B. Cheltsov, “Energy security of Russia: problems and solutions,” SB RAS Publishing House Novosibirsk, p. 211, 2011.

Unauthorized access Realizable Unrealizable

99.0 1.0

System state Normal Precrisis Crisis

0 100

0

Steal password Easy Average Difficult

100 0 0

Password policy Weak Medium Strong

100 0 0

Violation of energy facility function Normal function Precrisis function Crisis

14.5 31.5 54.0

Pre-emergency information transfer Successful transfer Information loss Information delay

15.1 29.9 55.0

Authorized licensed use limited to: Northcentral University. Downloaded on October 19,2021 at 13:52:31 UTC from IEEE Xplore. Restrictions apply.

[5] L.V. Massel, A.G. Massel, “Cyber security of Russia’s energy infrastructure as a component of national security,” 6th International Conference on Liberalization and Modernization of Power Systems, 2015, pp. 66-72.

[6] Requirements to ensure the information protection in automatic process control system of production and technological processes in critical facilities, potentially hazardous facilities, and also objects that present an increased danger to human life and the environment, [Online]. Available: http://fstec.ru/prikazy/864-prikaz-fstek-rossii-ot-14-marta- 2014-g-n-31

[7] The Security of the Critical Information Infrastructure of the Russian Federation, [Online]. Available: https://www.consultant.ru/law/hotdocs/48095.html

[8] L.V. Massel, “Modern information technologies in the Smart Grid as a threat to the cybersecurity of Russia's energy systems,” Information technology and security Kiev, no. 1 (3), 2013, pp. 56-65.

[9] T-REC-X.1205 – ITU-T: Overview of cybersecurity, [Online]. Available: https://www.itu.int/rec/T-REC-X.1205-200804-I

[10] ISO standard of Information technology. Security techniques. Guidelines for cybersecurity, ISO/IEC 27032:2012.

[11] V.V. Mohor, A.M. Bogdanov, A.S. Kilevoj, “Information Technology. Methods of security. Сybersecurity manual (ISO/IES 27032:2012),” Three-K Kiev, p. 129, 2013.

[12] T.N. Vorozhtsova, “Development of the ontology of cybersecurity in the energy sector,” International Conference “Cybersecurity-2013” Kiev, 2013, pp. 19-25.

[13] L.V. Massel, A.G. Massel, “The current state of cyber security in Russia's energy systems and the proposed activities for situation improving,” 6th International Conference on Liberalization and Modernization of Power Systems, 2015, pp. 165-170.

[14] V.F. Shanguin, “Protection of information in computer systems and networks,” DMK Moscow, p. 593, 2012.

[15] G.V. Grytsay, A.G. Timorin, “Safety of industrial systems in figures,” Positive Technologies, 2012, [Online]. Available: http://www.ptsecurity.ru/download/SCADA_analytics_russian.pdf

[16] A.G. Massel, “Methodology for threat analysis and risk assessment of information technology security violation of energy complexes,” 20th Baikal Russian Conference, vol. 3, 2015, pp. 186-195.

Authorized licensed use limited to: Northcentral University. Downloaded on October 19,2021 at 13:52:31 UTC from IEEE Xplore. Restrictions apply.