|Title||In quest of benchmarking security risks to cyber-physical systems|
|Publication Type||Journal Articles|
|Year of Publication||2013|
|Authors||Amin, S., G. Schwartz, and A. Hussain|
|Keywords||Benchmark testing, benchmarking security risk assessment, Computer crime, Comupter security, CPS, cyber-physical systems, failure analysis, fault tolerance, fault-tolerant control, game theory, game-theoretic approach, information security tools, interdependent reliability failures, Investments, network security, Reliability, Risk management, security failures, security of data, Supervisory control, technology-based security defenses|
We present a generic yet practical framework for assessing security risks to cyber-physical systems (CPSs). Our framework can be used to benchmark security risks when information is less than perfect, and interdependencies of physical and computational components may result in correlated failures. Such environments are prone to externalities, and can cause huge societal losses. We focus on the risks that arise from interdependent reliability failures (faults) and security failures (attacks). We advocate that a sound assessment of these risks requires explicit modeling of the effects of both technology-based defenses and institutions necessary for supporting them. Thus, we consider technology-based security defenses grounded in information security tools and fault-tolerant control in conjunction with institutional structures. Our game-theoretic approach to estimating security risks facilitates more effective defenses, especially against correlated failures.