Skip to main content

Advertisement

SpringerLink
Log in

A cyber resilience analysis case study of an industrial operational technology environment

  • Published:
Environment Systems and Decisions Aims and scope Submit manuscript

Abstract

Cyber resilience is an active research area offering a novel approach to Cyber Security. The term appeared due to the concerning number of cyber-attacks on critical infrastructure. The National Institute of Standards and Technology (NIST) developed a framework to assist organisations with techniques and approaches to improving cyber resilience. However, there are a sparsity of case studies that speak to the adoption or measurement of these novel approaches within a complex industrial control environment. This paper presents a case study analysis of a manufacturing plant assessment drawing on key themes from the NIST literature. The paper presents how well NIST constructs can be adopted to find cyber-resilient enhancement opportunities and to decide if an evaluation of the results could supply a quantitative baseline measure of an organisation’s overall resilience. Conclusions drawn show that although the framework did partially aid with the analysis process, the frameworks ease of adoption assume an organisation has a conventional cyber security foundation; NIST should make this clear within their guidance. Furthermore, the accompanying evaluation process was not sufficient to quantitatively measure the overall cyber resilience maturity for this case study.

This is a preview of subscription content, log in via an institution to check access.

Access this article

Log in via an institution

Price excludes VAT (USA)
Tax calculation will be finalised during checkout.

Instant access to the full article PDF.

Institutional subscriptions

Fig. 1
Fig. 2
Fig. 3

Similar content being viewed by others

References

  • Björk F, Henkel M, Stirna J, Zdravkovic J (2015) Cyber resilience—fundamentals for a definition. In: Rocha A, Correia A, Costanzo S, Reis L (eds) New contributions in information systems and technologies. Advances in intelligent systems and computing. Springer International Publishing, Cham, pp 3–4

    Google Scholar 

  • Bodeau D, Graubart R, Heinbockel W, Laderman E (2015) Cyber resiliency engineering aid—the updated cyber resiliency engineering framework and guidance on applying cyber resiliency techniques. Mitre Corporation, Bedford, MA

    Google Scholar 

  • Carías JF, Arrizabalaga S, Labaka L, Hernantes J (2021) Cyber resilience self-assessment tool (CR-SAT) for SMEs. IEEE Access 9(1):80741–80762

    Article  Google Scholar 

  • Cherdantsevaa Y et al (2016) A review of cyber security risk assessment methods for SCADA systems. Comput Secur 56(1):1–27

    Article  Google Scholar 

  • Groenendal J, Helsloot I (2021) Cyber resilience during the COVID-19 pandemic crisis: a case study. J Conting Crisis Manag 29(4):439–444

    Article  Google Scholar 

  • Haque MA, Teyou GKD, Shetty S, Krishnappa B (2018) Cyber resilience framework for industrial control systems: concepts, metrics, and insights. IEEE, Miami, pp 25–30

    Google Scholar 

  • Johnson C (2016) Why we cannot (yet) ensure the cyber-security of safety-critical systems. Safety-Critical Systems Club, Brighton, pp 171–182

    Google Scholar 

  • Kott A, Linkov I (2019) Cyber resilience of systems and networks, 1st edn. Springer, Cham

    Book  Google Scholar 

  • Kott A, Linkov I (2021) To improve cyber resilience, Measure it. Computer 54(2):80–85

    Article  Google Scholar 

  • Leversage DJ, Byres EJ (2008) Estimating a system’s mean time-to-compromise. IEEE Secur Priv 1(1):52–60

    Article  Google Scholar 

  • Linkov I, Kott A (2018) Fundamental concepts of cyber resilience: introduction and overview. In: Linkov I, Kott A (eds) Cyber resilience of systems and networks. Springer, Cham, pp 1–25

    Google Scholar 

  • Linkov I et al (2013) Resilience metrics for cyber systems. Environ Syst Decis 33(1):471–476

    Article  Google Scholar 

  • Linkov I et al (2014) Changing the resilience paradigm. Nat Clim Chang 4(1):407–409

    Article  Google Scholar 

  • Maglaras LA et al (2018) Cyber security of critical infrastructures. ICT Express 4(1):42–45

    Article  Google Scholar 

  • Mitre Corp. (2012) Cyber resiliency metrics, measures of effectiveness, and scoring. Mitre Corporation, Bedford, MA

    Google Scholar 

  • MITRE, 2017. Attack matrix for enterprise. [Online] Available at: https://attack.mitre.org [Accessed 15th Jan 2021].

  • National Institute of Standards and Technology (2012) Guide for conducting risk assessments. NIST SP 800–30 Rev, 1st edn. U.S. Department of Commerce, Washington, D.C.

    Google Scholar 

  • National Institute of Standards and Technology (2013) Security and privacy controls for federal information systems and organizations NIST SP 800–53. U.S. Department of Commerce, Washington, D.C.

    Google Scholar 

  • National Institute of Standards and Technology (2014) Framework for improving critical infrastructure cybersecurity (Version 1.0). U.S. Department of Commerce, Washington, D.C.

    Book  Google Scholar 

  • National Institute of Standards and Technology (2018) Framework for improving critical infrastructure cybersecurity (Version 11). U.S. Department of Commerce, Washington, D.C.

    Google Scholar 

  • National Institute of Standards and Technology (2021) Developing cyber resilient systems: a systems security engineering approach. NIST SP 800–160. U.S. Department of Commerce, Washington, D.C.

    Google Scholar 

  • Office of Cybersecurity, Energy Security, and Emergency Response, 2012. Cybersecurity capability maturity model (C2M2). [Online] Available at: https://www.energy.gov/ceser/cybersecurity-capability-maturity-model-c2m2 [Accessed 1 June 2021].

  • Reeder JR and Hall T (2021) Cybersecurity’s pearl harbor moment: lessons learned from the colonial pipeline ransomware attack. The Cyber Defence Review, 1 August, pp. 15–39

  • Simonovich L (2020) Thriving in a digitized environment. [Online] Available at: https://www.securitymagazine.com/articles/93849-leo-simonovich-thriving-in-a-digitized-environment [Accessed 1 October 2021]

  • Singh R, Hutton ST, Donahoo MJ, Sicker D (2021) Toward grading cybersecurity & resilience posture for cyber physical systems. Elsevier, McKinney

    Book  Google Scholar 

  • Williams T (1992) The Purdue enterprise reference architecture, a technical guide for CIM planning and implementation I, 1st edn. Instrument Society of America, Research Triangle

    Google Scholar 

Download references

Acknowledgements

The authors acknowledge the support of the Knowledge Economy Skills Scholarships (KESS) and Thales Ltd. KESS is a pan-Wales higher-level skills initiative led by Bangor University on behalf of the HE sectors in Wales. It is part funded by the Welsh Government’s European Social Fund (ESF) convergence programme for West Wales and the Valleys.

Funding

This work was supported by KESS in collaboration with Thales Ltd. (Grant Number 21439).

Author information

Authors and Affiliations

  1. Cyber Security, University of South Wales, Newport, NP20 2BP, UK

    Kirsty Perrett

  2. Computing and Mathematical Sciences, University of South Wales, Treforest, CF37 1DL, UK

    Ian David Wilson

Authors
  1. Kirsty Perrett
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Ian David Wilson
    View author publications

    You can also search for this author in PubMed Google Scholar

Contributions

Conceptualization: KP and IW; Methodology: KP and IW; Formal analysis and investigation: KP; Writing and preparation of original draft: KP; Writing, reviewing, and editing of the manuscript: IW; Project/funding facilitator: IW; Supervision: IW.

Corresponding author

Correspondence to Ian David Wilson.

Ethics declarations

Conflict of interest

The authors have no financial or proprietary interests in any material discussed in this article.

Rights and permissions

Springer Nature or its licensor (e.g. a society or other partner) holds exclusive rights to this article under a publishing agreement with the author(s) or other rightsholder(s); author self-archiving of the accepted manuscript version of this article is solely governed by the terms of such publishing agreement and applicable law.

Reprints and permissions

About this article

Check for updates. Verify currency and authenticity via CrossMark

Cite this article

Perrett, K., Wilson, I.D. A cyber resilience analysis case study of an industrial operational technology environment. Environ Syst Decis 43, 178–190 (2023). https://doi.org/10.1007/s10669-023-09895-1

Download citation

  • Accepted:

  • Published:

  • Issue Date:

  • DOI: https://doi.org/10.1007/s10669-023-09895-1

Keywords

Search

Navigation