A framework for Operational Security Metrics Development for industrial control environment. Issue 3 (2nd October 2018)

• Record Type: Journal Article
• Authors: Ani, Uchenna P. Daniel; He, Hongmei (Mary); Tiwari, Ashutosh
• Is Part Of: Journal of cyber security technology. Volume 2:Issue 3/4(2018)
• Page Start: 201
• Page End: 237
• Publication Date: 2018-10-02
• Subjects: OSMD framework -- security metrics -- Operational Security metrics -- industry control environments -- security measurement; Computer security -- Periodicals; Data encryption (Computer science) -- Periodicals; 005.805
• DOI: 10.1080/23742917.2018.1554986
• Languages: English
• ISSNs: 2374-2917

Abstract

ABSTRACT: Security metrics are very crucial towards providing insights when measuring security states and susceptibilities in industrial operational environments. Obtaining practical security metrics depend on effective security metrics development approaches. To be effective, a security metrics development framework should be scope-definitive, objective-oriented, reliable, simple, adaptable, and repeatable (SORSAR). A framework for Operational Security Metrics Development (OSMD) for industry control environments is presented, which combines concepts and characteristics from existing approaches. It also adds the new characteristic of adaptability. The OSMD framework is broken down into three phases of: target definition, objective definition, and metrics synthesis. A case study scenario is used to demonstrate an instance of how to implement and apply the proposed framework to demonstrate its usability and workability. Expert elicitation has also be used to consolidate the validity of the proposed framework. Both validation approaches have helped to show that the proposed framework can help create effective and efficient ICS-centric security metrics taxonomy that can be used to evaluate capabilities or vulnerabilities. The understanding from this can help enhance security assurance within industrial operational environments.