I’ve Seen This Before: Sharing Cyber-Physical Incident Knowledge

Alrimawi, Faeq; Pasquale, Liliana; Mehta, Deepak and Nuseibeh, Bashar (2018). I’ve Seen This Before: Sharing Cyber-Physical Incident Knowledge. In: 1st International Workshop on Security Awareness from Design to Deployment (SEAD’18), 27 May 2018, Gothenburg, Sweden..

DOI: https://doi.org/10.1145/3194707.3194714

Abstract

An increasing number of security incidents in cyber-physical systems (CPSs) arise from the exploitation of cyber and physical components of such systems. Knowledge about how such incidents arose is rarely captured and used systematically to enhance security and support future incident investigations. In this paper, we propose an approach to represent and share incidents knowledge. Our approach captures incident patterns – common aspects of incidents occurring in different CPSs. Our approach then allows incident patterns to be instantiated for different systems to assess if and how such patterns can manifest again. To support our approach, we provide two meta-models that represent, respectively, incident patterns and the cyber-physical systems themselves. The incident meta-model captures the characteristics of incidents, such as assets and activities. The system meta-model captures cyber and physical components and their interactions, which may be exploited during an incident. We demonstrate the feasibility of our approach in the application domain of smart buildings, by tailoring the system meta-model to represent components and interactions in this domain.

Viewing alternatives

Metrics

Item Actions

Export

You can export this page using these formats Digital Object Identifier - DOI