MUMBA: Multi-faceted Metrics for ICS Business Risk Analysis

The evolution of cyber space is transforming the way our infrastructure is managed. Industrial control systems, that is those systems that manage critical utility infrastructure such as Energy, Water and Transport are increasingly interacting with enterprise IT systems in intricate fashions. This leads to an increase in the level of threats to these critical infrastructures. This is only too evident from cyber weapons such as Stuxnet which targeted centrifuges in Iran's nuclear facilities and more recent news that over 60,000 exposed control systems were accessible online. The US Defence Secretary Leon Panetta described a recent spate of cyber attacks against critical infrastructures as a "pre-9/11 moment". The cyber attack surface of future generations of control systems is likely to increase further with new technologies and working practices such as the use of autonomous software agents in their operation and handheld wireless devices in control and maintenance.

Given the importance of industrial control systems to society, it is important that decision-makers are able to effectively articulate the risks posed to them from cyber space. Even more importantly, decision-makers should be able to understand and respond to such risks from a business continuity and recovery perspective in order to evaluate and prioritise their mitigation responses. However, to date, metrics for articulating cyber risk in such settings have largely been driven by technical measures pertaining to security of information or resilience of the control system itself. Though important, these metrics bear little relationship to typical factors used in business risk analysis, such as business continuity, disaster recovery, cost, reputation, impact on resources, etc.

The MUMBA project takes the perspective that metrics for articulating cyber risk (in industrial control systems) as business risk only make sense in the context of what we understand the larger system to be, and cannot sensibly be designed without a model of this system. Post-hoc mapping of security and resilience metrics to business risk fails to account for the complex socio-technical landscape in which current and future generations of control systems reside. Effective articulation of cyber risk as business risk requires multi-faceted metrics that are first and foremost driven by business risk concepts. Such metrics consider business risk both along and across various facets of an industrial control system setting i.e., the control system itself, enterprise systems, business processes, people, third party organisations in the product/service supply chain and new/emergent technologies (and associated working practices). Furthermore, the project addresses the need to contextualise these metrics to a particular critical infrastructure domain to ensure meaningful interpretation of business risks and prioritisation and implementation of responses (i.e., whether to mitigate, transfer, accept or avoid particular risks).

The project involves a world-leading multi-disciplinary team of researchers in cyber security, resilient industrial control systems, risk management and social anthropology from the Security Lancaster research centre. This academic expertise is complemented by practical insights provided by four industry partners: Airbus, Thales, Atkins Global and Raytheon. Through its research into the complex socio-technical processes at play in contemporary industrial control system settings, new metrics and how to instrument such environments to gather relevant data to compute such metrics, the project aims to become a cornerstone for future research and practice on articulating cyber risk as business risk.

There are four principal beneficiaries of the project:

1. Industry organisations in ICS and critical national infrastructure (CNI) domains will benefit from new and improved metrics enabling them to translate cyber risk to business risk as well as evaluate and understand higher order impacts of cyber risk on business, i.e. across space and time. They will also benefit from a deeper understanding of the broader ICS context in which cyber risk is situated, how intersections of various elements, i.e. ICS, enterprise systems, business processes, people, 3rd parties, new technologies, etc. shape this risk and the associated risk responses. They will also benefit from design principles for new metrics, a methodology and decision-support tool along with guidelines to operationalise them in different organisational contexts. Equally importantly, they will benefit from improved skills in business risk assessment of contemporary and future generations of ICSs.

They will also benefit from economic gain through a reduction in costs from cyber-security breaches - being better equipped with knowledge of associated business risks and strategies to counter/mitigate such risks. The results of the project will prepare risk assessors in these organisations for more effective assessment and communication of cyber risks.

Our industry partners and the various domains they cover will directly benefit from knowledge and technology transfer into their working practices with regards to cyber security and ICS settings.


2. Cyber-security industry will benefit from improved methods and tools and new insights into how to tackle the complex landscape of cyber-security and ICS/CNI they encounter on a regular basis and how best to articulate business risk and the impact on business continuity in such settings. They will also benefit from metrics, methodology and tools to provide innovative services to the ICS sector to help manage the impact of increasing connectivity, virtualisation and use of mobile handheld (wireless) devices.

3. Policy makers and government organisations charged with CNI protection will benefit from a deeper understanding of the role that various facets of a modern ICS environment play with regards to cyber risk, how this exposes various business sectors to a range of threats and what mitigation approaches can have the maximum impact in minimising the potential economic and security impact. Equally importantly, they will gain insights into developing good practice guidelines to help businesses protect themselves against a range of known and future cyber-security risks in modern (and future) ICS settings.

4. Last, but not least, the general public will benefit from more resilient utility infrastructures that are better equipped to manage the risks arising from an increasingly complex, highly connected landscape where battles are often being fought in cyber space and the impact of any compromise of such infrastructure will be most felt by citizens.