Our Critical Infrastructure (CI) systems are, by definition, critical to the safe and proper functioning of society. Nearly all of these systems utilize industrial Process Control Systems (PCS) to provide clean water, reliable electricity, critical manufacturing, and many other services within our communities - yet most of these PCS incorporate very little cyber-security countermeasures. Cyber-attacks on CI are becoming an attractive target. While many vendor solutions are starting to be deployed at CI sites, these solutions are largely based on network monitoring for intrusion detection. As such, they are not process-aware, nor do they account for inter dependencies among other CI sites in their community. What is proposed is an architecture for coordinating all CI within a community, which defines characteristics to enhance its integration, its resilience to failure and attack, and its ultimate acceptance by CI operators.
Internet of Things (IoT) systems are recently being employed in various types of critical infrastructure, including integrated rescue systems, healthcare, defence, energy and other fields. Recently, the security and safety of IoT systems, in general, has been questioned by a number of studies. Raised concerns do not relate to the IoT technology in principle but to poor engineering practices that are mostly preventable. In critical infrastructure, demand for safety and security is strongly present and justifies a discussion about the general resilience of IoT systems. In this context, resilienc…
The vulnerability of cyber-physical systems to cyber attack is well known, and the requirement to build cyber resilience into these systems has been firmly established. The key challenge this paper addresses is that maturing this discipline requires the development of techniques, tools, and processes for objectively, rigorously, and quantitatively measuring the attributes of cyber resilience. Researchers and program managers need to be able to determine if the implementation of a resilience solution actually increases the resilience of the system. In previous work, a table top exercise was con…
This short paper is presented in observance and promotion of November, the National Month of Critical Infrastructure Security and Resilience (CISR), established by the United States Department of Homeland Security in 2013. The CISR term focuses on essential assets (critical infrastructures) and two ultimate goals of making them secure and resilient. These assets and goals were put together in 2013 in the now well-known Presidential Policy Directive on CISR (PPD-21). This paper presents easy-to-ready material laying down the building blocks of CISR - what it means to you as a regular citizen, p…
Cyber-physical systems (CPS) incorporate the complex and large-scale engineered systems behind critical infrastructure operations, such as water distribution networks, energy delivery systems, healthcare services, manufacturing systems, and transportation networks. Industrial CPS in particular need to simultaneously satisfy requirements of available, secure, safe and reliable system operation against diverse threats, in an adaptive and sustainable way. These adverse events can be of accidental or malicious nature and may include natural disasters, hardware or software faults, cyberattacks, or …
The mass integration and deployment of intelligent technologies within critical commercial, industrial and public environments have a significant impact on business operations and society as a whole. Though integration of these critical intelligent technologies pose serious embedded security challenges for technology manufacturers which are required to be systematically approached, in-line with international security regulations. This paper establish security foundation for such intelligent technologies by deriving embedded security requirements to realise the core security functions laid out …
Assessing Network Operator Actions to Enhance Digital Sovereignty and Strengthen Network Resilience: A Longitudinal Analysis during the Russia-Ukraine Conflict
本文通过对主动 DNS 测量数据的纵向分析，揭示俄乌冲突促使网络运营商主动调整基础设施位置、托管 DNS 服务与冗余分布，以增强网络韧性和数字主权。
Multidimensional Resilience for Electrical Power Systems: Systematic Review, Integrated Index, and Validation under Real-World Cyber-Physical Attack Scenarios
Secure sensor calibration constitutes a foundational step that underpins operational safety in the Industrial Internet of Things. While much attention has been given to IoT security such as the use of TLS to secure sensed data, little thought has been given to securing the calibration infrastructure itself. Currently traceability is achieved via manual verification using paper-based datasheets which is both time consuming and insecure. For instance, when the calibration status of parent devices is revoked as mistakes or mischance is detected, calibrated devices are not updated until the next c…
Cyber Security scares are the main areas of demerits associated with the advent and widespread of internet technology. While the internet has improved life and business processes, the levels of security threats have been increasing proportionally. As such, the web and the related cyber systems have exposed the world to the state of continuous vigilance because of the existential threats of attacks. Criminals are in the constant state of attempting cybersecurity defense of various infrastructures and businesses. Airports are some of the areas where cybersecurity means a lot of things. The reaso…
Enhancing Resilience for IoE: A Perspective of Networking-Level Safeguard
Department of Electrical Engineering（电子工程系）；Institute of Information Science, Academia Sinica（学术院信息科学研究所）；Institute of Artificial Intelligence Innovation（人工智能创新研究所）；Department of Information Management（信息管理系）
Enhancing Software Supply Chain Resilience: Strategy For Mitigating Software Supply Chain Security Risks And Ensuring Security Continuity In Development Lifecycle
This report summarizes the discussions and findings of the 2017 North Atlantic Treaty Organization (NATO) Workshop, IST-153, on Cyber Resilience, held in Munich, Germany, on 23-25 October 2017, at the University of Bundeswehr. Despite continual progress in managing risks in the cyber domain, anticipation and prevention of all possible attacks and malfunctions are not feasible for the current or future systems comprising the cyber infrastructure. Therefore, interest in cyber resilience (as opposed to merely risk-based approaches) is increasing rapidly, in literature and in practice. Unlike conc…
PHOENI2X -- A European Cyber Resilience Framework With Artificial-Intelligence-Assisted Orchestration, Automation and Response Capabilities for Business Continuity and Recovery, Incident Response, and Information Exchange
