Open Access

A Socio-Technical Approach to Mitigating Cybersecurity Risks in Industrial Control Systems: The Vulnerability Analysis Critical Impact Point (VACIP) Methodology

PDF

Dr. Samuel O. Adebayo ¹ ,

⁴ Department of Information Systems, African Institute of Science and Technology, Accra, Ghana

Abstract

Background: Industrial Control Systems (ICSs) face increasingly sophisticated cybersecurity threats. While much research focuses on technological vulnerabilities, this study argues that a complete risk assessment must also integrate human factors, which are often the weakest link. This paper introduces a novel approach that combines both technical and human elements to provide a more holistic view of cybersecurity risk.

Methods: We propose the Vulnerability Analysis Critical Impact Point (VACIP) methodology, a socio-technical framework designed to identify, analyze, and prioritize cybersecurity risks in ICS environments. The methodology integrates technical vulnerability scanning with an evaluation of human factors, including security awareness, training, and policy adherence. A testbed representing a typical industrial network was used to validate the VACIP methodology, simulating various attack vectors and human-related security weaknesses. Data from this validation was used to quantify the effectiveness of the approach in identifying critical impact points.

Results: The testbed validation successfully demonstrated that the VACIP methodology can effectively pinpoint weak links arising from both technological flaws and human vulnerabilities. The results show that by applying the VACIP framework, we can not only quantify the most critical points of impact but also significantly reduce the overall risk posture through targeted, socio-technical mitigation strategies. Our findings indicate that human-related risks, such as poor security governance and employee error, contribute as much to the overall risk as purely technical vulnerabilities.

Conclusions: This study concludes that a comprehensive cybersecurity risk reduction strategy for ICS environments must adopt a socio-technical perspective. The VACIP methodology provides a practical and effective framework for doing so, moving beyond traditional, technology-centric approaches. By prioritizing a blend of technical and human-focused controls, operators can achieve a more realistic and proactive security posture, ultimately safeguarding critical industrial infrastructure.

Keywords

Industrial Control Systems, Cybersecurity, Socio-technical, Vulnerability Analysis

References

Ani UD, Daniel N, Oladipo F, et al. Securing industrial control system environments: themissing piece. J Cyber Secur Technol. 2018;2(3–4):131–163. doi: 10.1080/23742917.2018.1554985

East S, Butts J, Papa M, et al. A taxonomy of attacks on the DNP3 protocol. IFIP Adv InfCommun Technol. 2009;311:67–81.

Bhamare D, Zolanvari M, Erbad A, et al. Cybersecurity for industrial control systems: asurvey. Comput Secur. 2020;89:101677. doi: 10.1016/j.cose.2019.101677

Iaiani M, Tugnoli A, Bonvicini S, et al. Analysis of cybersecurity-related incidents in theprocess industry. Reliab Eng Syst Saf. 2021;209:1–20. doi: 10.1016/j.ress.2021.107485

Wang K, Guo X, Yang D. Research on the effectiveness of cyber security awareness inICS risk assessment frameworks. Electron. 2022;11(10):1–13. doi: 10.3390/electronics11101659

Applied Risk BV. The state of industrial cyber security 2020. Amsterdam, Netherlands:Applied Risk BV; 2020. https://applied-risk.com/resources/the-state-of-industrial-cyber-security-2020

Ani UPD, He HM, Tiwari A. Review of cybersecurity issues in industrial critical infra-structure: manufacturing in perspective. J Cyber Secur Technol. 2017;1(1):32–74. doi:10.1080/23742917.2016.1252211

Craggs B, Rashid A, Hankin C, et al. A reference architecture for IIoT and industrialcontrol systems testbeds. In: 2nd Conference on Living in the Internet of Things. London,United Kingdom. 2018.

Igure VM, Laughter SA, Williams RD. Security issues in SCADA networks. Comput Secur.2006 Oct;25(7):498–506. doi: 10.1016/j.cose.2006.03.001

Byres E, Leversage D, Kube N. Security incidents and trends in SCADA and processindustries. Ind Ethernet B. 2007;39(May):12–20.

Andreeva O, Gordeychik S, Gritsai G, et al. Industrial control systems vulnerabilitiesstatistics. Leningradskoe Shosse, Moscow: Kaspersky Lab; 2016. https://kasperskycontenthub.com/securelist/files/2016/07/KL_REPORT_ICS_Statistic_vulnerabilities.pdf

Bartman T, Carson K. Securing communications for SCADA and critical industrialsystems. In: 69th Annual Conference for Protective Relay Engineers, CPRE 2016; CollegeStation, TX, USA. 2017. IEEE. doi: 10.1109/CPRE.2016.7914914

Cook A, Janicke H, Smith R, et al. The industrial control system cyber defence triageprocess. Comput Secur. 2017;70:467–481. doi: 10.1016/j.cose.2017.07.009

Alcaraz C, Zeadally S. Critical infrastructure protection: requirements and challenges forthe 21st century. Int J Crit Infrastruct Prot. 2015;8:53–66. doi: 10.1016/j.ijcip.2014.12.002

Chowdhury N, Gkioulos V. Key competencies for critical infrastructure cyber-security:a systematic literature review. Inf Comput Secur. 2021;29(5):697–723. doi: 10.1108/ICS-07-2020-0121

Cheminod M, Durante L, Valenzano A. Review of security issues in industrial networks.IEEE Trans Ind Inf. 2013;9(1):277–293. doi: 10.1109/TII.2012.2198666

Stouffer K, Pillitteri V, Lightman S, et al. Guide to industrial control systems (ICS) security- NIST.SP.800-82r2. Gaithersburg (MD): NIST, US Department of Commerce; 2015.p. 1–247.

Cherdantseva Y, A review of cyber security risk assessment methods for SCADAsystems. Comput Secur. 2016;56:1–27. doi: 10.1016/j.cose.2015.09.009

US-FDA. Hazard analysis critical control point (HACCP). U.S. Food & drugs administrationwebsite. 2017. [Online]. [cited 2017 Oct 20]. Available from: https://www.fda.gov/Food/GuidanceRegulation/HACCP/

Ani UPD, Watson JM, Tuptuk N, et al. Socio-technical security modelling: analysis ofstate-of-the-art, application, and maturity in critical industrial infrastructureEnvironments/Domains. London (UK): PETRAS National Centre of Excellence for IoTSystems Cyber Security; 2022. p. 1–56.

Ralston PAS, Graham JH, Hieb JL. Cyber security risk assessment for SCADA and DCSnetworks. ISA Trans. 2007 Oct;46(4):583–594. doi: 10.1016/j.isatra.2007.04.003

Ani UD, Watson JDM, Nurse JRC, et al. A review of critical infrastructure protectionapproaches: improving security through responsiveness to the dynamic modellinglandscape. In: PETRAS/IET Conference Living in the Internet of Things: Cybersecurity ofthe IoT - 2019 system; London, United Kingdom. 2019. IET; p. 1–16.

Melaku HM. Context-based and adaptive cybersecurity risk management framework.Risks. 2023;11(6):101. doi: 10.3390/risks11060101

Goel R, Kumar A, Haddow J. PRISM: a strategic decision framework for cybersecurity riskassessment. Inf Comput Secur. 2020;28(4):591–625. doi: 10.1108/ICS-11-2018-0131

Lee I. Internet of things (IoT) cybersecurity: literature review and iot cyber riskmanagement. Future Internet. 2020;12(9):157. doi: 10.3390/fi12090157

Kure HI, Islam S. Assets focus risk management framework for critical infrastructurecybersecurity risk management. IET Cyber-Phys Syst Theory Appl. 2019;4(4):332–340.doi: 10.1049/iet-cps.2018.5079

Caltagirone S, Pendergast A, Betz C. The diamond model of intrusion analysis. ThreatConnect. 2013;298(704):1–61.

Mandiant. APT1: exposing one of China’s cyber espionage units. 2013.

Schnaubelt CM, Larson EB, Boyer ME. Vulnerability assessment method pocket Guide.Small Wars J. 2014;8:2–3. http://www.rand.org/content/dam/rand/pubs/tools/TL100/TL129/RAND_TL129.pdf

Woo PS, Kim BH. A study on quantitative methodology to assess cyber security risk ofSCADA systems. J Energy Eng. 2015;24(1):123–131. doi: 10.5855/ENERGY.2015.24.1.123

Markovic-Petrovic JD, Stojanovic MD. An improved risk assessment method for SCADAinformation security. Elektron ir Elektrotechnika. 2014;20(7):69–72. doi: 10.5755/j01.eee.20.7.8027

Yan J, Govindarasu M, Liu C-C, et al. A pmu-based risk assessment framework for powercontrol systems. In: Power and Energy Society General Meeting (PES), 2013 IEEE;Vancouver, BC, Canada. 2013. p. 1–5.

Beitel GA, Gertman DI, Plum MM. Balanced Scorecard Method for Predicting theProbability of a terrorist attack. WIT Transactions on Ecology and the Environment.2004;77(12):581–592. https://www.witpress.com/elibrary/wit-transactions-on-ecology-and-the-environment/77/14333

A Francia G, Thornton D, and Dawson J. Security best practices and risk assessment ofSCADA and Industrial control systems. 2012.

Aagedal J, Den Braber F, Dimitrakos T, et al. Model-based risk assessment to improveenterprise security. In: Proceedings - 6th International Enterprise Distributed ObjectComputing Conference; Lausanne, Switzerland, Switzerland. 2002. IEEE. vol. 2002-January, no. January, pp. 51–62.

Song J-G, Lee J-W, Lee C-K, et al. A cyber security risk assessment for the design of I&Csystems in nuclear power plants. Nucl Eng Technol. 2012;44(8):919–928 . doi: 10.5516/NET.04.2011.065

Stouffer K, Falco J, Scarfone K. Guide to industrial control systems (ICS) securityrecommendations of the national institute of standards and technology.Gaithersburg (MD), USA: NIST; 2011.

Shin J, Son H, Heo G. Cyber security risk evaluation of a nuclear I & C using BN and ET.Nucl Eng Technol. 2017;49(3):517–524. doi: 10.1016/j.net.2016.11.004

Ten CW, Manimaran G, Liu CC. Cybersecurity for critical infrastructures: attack anddefense modeling. IEEE Trans Syst Man Cybern Part A Systems Humans. 2010;40(4):853–865. doi: 10.1109/TSMCA.2010.2048028

LeMay E, Ford MD, Keefe K, et al. Model-based security metrics using Adversary VIewsecurity evaluation (ADVISE). In: 8th International Conference on Quantitative Evaluationof Systems, QEST 2011; 2011. Aachen, Germany. p. 191–200.

Deavours DD, Clark G, Courtney T, et al. The Mobius Framework and ItsImplementation. IEE Trans Softw Enf. 2002;28(10):956–969. doi: 10.1109/TSE.2002.1041052

McQueen MA, Boyer WF, Flynn MA, et al. Quantitative cyber risk reduction estimationmethodology for a small SCADA control system. In: Proceedings of the Annual HawaiiInternational Conference on System Sciences; 2006. Vol. 9. Kauia, HI, USA. p. 226.

Patel SC, Graham JH, Ralston PAS. Quantitatively assessing the vulnerability of criticalinformation systems: a new method for evaluating security enhancements. Int J InfManage. 2008;28(6):483–491. doi: 10.1016/j.ijinfomgt.2008.01.009

Baiardi F, Telmon C, Sgandurra D. Hierarchical, model-based risk management ofcritical infrastructures. Reliab Eng Syst Saf. 2009;94(9):1403–1415. doi: 10.1016/j.ress.2009.02.001

Henry MH, Haimes YY. A comprehensive network security risk model for processcontrol networks. Risk Anal. 2009;29(2):223–248. doi:10.1111/j.1539-6924.2008.01151.x

The Open Group. Dependency modeling (O-DM): constructing a data Model to managerisk and build trust between inter-dependent enterprises. Reading, Berkshire, (UK): TheOpen Group; 2012. p. 1–50.

Malatji M, Marnewick A, von Solms S. Validation of a socio-technical managementprocess for optimising cybersecurity practices. Comput Secur. 2020;95:101846. doi: 10.1016/j.cose.2020.101846

Aloul FA. The need for effective information security awareness. J Adv Inf Technol.2012;3(3):176–183. doi: 10.4304/jait.3.3.176-183

Ani UD, He H, Tiwari A. Vulnerability-based impact criticality estimation for industrialcontrol systems. In: International Conference on Cyber Security and Protection of DigitalServices (Cyber Security 2020) Dublin, Ireland; 2020 (IEEE). p. 33–40 doi:10.1109/CyberSecurity49315.2020.9138886.

Henrie M. Cyber security risk management in the SCADA critical infrastructureenvironment. Eng Manag J. 2013;25(2):38–45. doi: 10.1080/10429247.2013.11431973

Peffers K, Tuunanen T, Rothenberger MA, et al. A design science research methodologyfor information systems research. J Manag Inf Syst. 2007;24(3):45–77. doi: 10.2753/MIS0742-1222240302

Peffers K, A Model for producing and presenting information systems research. ArXiv.2020;2006:1–24.

Ani UD, He H, Tiwari A. Human capability evaluation approach for cyber security incritical industrial infrastructure. In: Nicholson D, editor. Advances in Human Factors inCyber Security: Proceedings of the AHFE 2016 International Conference on Human Factorsin Cybersecurity, 2016 July 27-31; Walt Disney World® (FL)USA. Florida: SpringerInternational Publishing; 2016. Vol. 501. p. 169–182.

C’ardenas AA, Amin S, Lin ZS, et al. Attacks against process control systems: riskassessment, detection, and response. In: Proceedings of the 6th ACM Symposium onInformation, Computer and Communications Security (ASIACCS’11); Hong Kong, China.2011. ACM. p. 355–366.

Ropkins K, Ferguson A, Beck AJ. Development of hazard analysis and critical controlpoints (HACCP) procedures to control organic chemical hazards in the agriculturalproduction of raw food commodities. Crit Rev Food Sci Nutr. 2003;43(3):287–316. doi:10.1080/10408690390826536

Sekheta MAF, Sahtout AH, Airoud ASA, et al. A preventive strategy for possible attacksaimed at crippling the cyberspace controlling food & water supplies in HACCP pro-grams. Internet J Food Saf. 2007;9:17–21.

Tenable I. Nessus professional | TenableTM. Tenable Nessus Webiste. 2017. [Online].[cited 2017 Oct 11]. Available from: http://www.tenable.com/products/nessus-vulnerability-scanner/nessus-professional

Rapid7. Top rated vulnerability management software | Rapid7. Rapid7 website, 2017.[Online]. [cited 2017 Oct 11]. Available from: https://www.rapid7.com/products/nexpose/

Antrobus RFrey SGreen B, et al. SimaticScan: towards a specialised vulnerabilityScanner for industrial control systems. 4th International Symposium for ICS & SCADACyber Security Research 2016; August 2016; Belfast United Kingdom. 2016; ACM. p.11–18.

Wang S, Xia C, Gao J, et al. Vulnerability evaluation based on CVSS and Environmentalinformation statistics. In: Proceedings of 2015 4th International Conference on ComputerScience and Network Technology, ICCSNT 2015; Harbin, China. 2016. p. 1249–1252.

Ani UPD, He HM, Tiwari A. Human capability evaluation approach for cyber security incritical industrial infrastructure. In: Nicholson D, editor. Advances in Human Factors inCyber Security: Proceedings of the AHFE 2016 International Conference on Human Factorsin Cybersecurity, 2016 July 27-31; Walt Disney World® (FL)USA. Florida: SpringerInternational Publishing; 2016. Vol. 501. p. 169–182.

NIST. Security and Privacy Controls for Information Systems and Organizations.Gaithersburg, MD, USA: National Institute of Standards and Technology (NIST); 2020.https://doi.org/10.6028/NIST.SP.800-53r5

CIS. CIS controls. Centre for internet security website. 2017. [Online]. [cited 2017 Oct 20].Available from: https://www.cisecurity.org/controls/

Pescatore J, Filkins B. Back to Basics: Focus on the first six critical security controls SANSSpotlight White Paper. 2018. https://www.dlt.com/sites/default/files/resource-attachments/2019-09/White%2520Paper%2520-%2520Focus%2520on%2520the%2520First%2520Six%2520CIS%2520Critical%2520Security%2520Controls_0_13.pdf

UK-Cabinet-Office. 10 steps to cyber security. Cyber security strategy. 2012. [Online].[cited 2015 Mar 26]. Available from: https://www.gov.uk/government/publications/cyber-risk-management-a-board-level-responsibility/10-steps-summary

Most read articles by the same author(s)

1 2 3 4 5 6 7 > >>

International Journal of Cyber Threat Intelligence and Secure Networking

A Socio-Technical Approach to Mitigating Cybersecurity Risks in Industrial Control Systems: The Vulnerability Analysis Critical Impact Point (VACIP) Methodology

Abstract

Keywords

References

Most read articles by the same author(s)

Similar Articles