<p>Cybersecurity risk assessment is essential for ensuring the security and resilience of Operational Technology (OT) systems, which are increasingly targeted by cyber threats. Traditional assessment frameworks often struggle with complexity, inefficiency, and the inability to adapt dynamically to evolving attack scenarios. In this work, we propose a novel approach that utilizes Attack Graphs to systematically model and assess cybersecurity risks in OT environments. Attack Graphs provide a structured representation of attack paths, enabling a comprehensive analysis of vulnerabilities and potential adversary actions. We extend conventional Attack Graphs by integrating countermeasures and impact assessment, allowing for a more complete cybersecurity risk evaluation process. Our framework facilitates adaptive assessments by efficiently incorporating system or environmental changes and identifying the most critical security threats. We validate our approach through a case study, demonstrating its effectiveness in enhancing OT risk assessment and aligning it with established cybersecurity standards. By bridging the gap between theoretical cybersecurity risk assessment models and practical security challenges, our work contributes to a more proactive and structured defense strategy for OT systems.</p>

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Cybersecurity risk assessment in OT systems using attack graphs

  • Simon Unger,
  • Ektor Arzoglou,
  • Markus Heinrich,
  • Dirk Scheuermann,
  • Stefan Katzenbeisser

摘要

Cybersecurity risk assessment is essential for ensuring the security and resilience of Operational Technology (OT) systems, which are increasingly targeted by cyber threats. Traditional assessment frameworks often struggle with complexity, inefficiency, and the inability to adapt dynamically to evolving attack scenarios. In this work, we propose a novel approach that utilizes Attack Graphs to systematically model and assess cybersecurity risks in OT environments. Attack Graphs provide a structured representation of attack paths, enabling a comprehensive analysis of vulnerabilities and potential adversary actions. We extend conventional Attack Graphs by integrating countermeasures and impact assessment, allowing for a more complete cybersecurity risk evaluation process. Our framework facilitates adaptive assessments by efficiently incorporating system or environmental changes and identifying the most critical security threats. We validate our approach through a case study, demonstrating its effectiveness in enhancing OT risk assessment and aligning it with established cybersecurity standards. By bridging the gap between theoretical cybersecurity risk assessment models and practical security challenges, our work contributes to a more proactive and structured defense strategy for OT systems.