WP1

We have identified the following distinct tasks to operationalize the research in WP1:

Task 1.1. Undertake an impact analysis for integrating cyber issues into current risk assessment of ICS. Input from project partners and other stakeholders will be important here to identify communication needs of stakeholders. We will explore how to communicate epistemic uncertainties associated with High Impact Low Probability Risks as well as the socio-technical and psychological aspects on regulatory decision making.

Task 1.2. Define a set of archetypal argument fragments that are CAE “building blocks” for security and assurance cases. The scope of the blocks will be based on an analysis of real risk assessments as well as requirements captured from first principles. These might address, for example, describing the impact of a security control on a system. Define a semantics for the “blocks” that combines the informality of uninterpreted terms with the power of formal techniques such as model checkers and SAT solvers. Prove the formal parts of the fragments correct and well formed.

Task 1.3. Experiment with the expressiveness of the CAE “block” approach to determine if it adequately captures the stakeholder risk assessments. Consider ways of graduated rigour for deploying the CAE fragments i.e. using the formal semantics to underpin less formal uses. Review and revise CAE in the light of this.

Task 1.4. Research issues of compositionality and scale. Develop further the abstraction models which range from policy level to implementation level and build on other research on layered assurance. This will be driven by the stakeholder examples.

WP2

The work in WP is conducted in a number of interrelated tasks:

Task 2.1 Probabilistic models of an Adversary applicable to modern ICS. We extend the state-of-the art as follows:

• capture dependence of the adversary profile on the likelihood of successful attack on ICS;
• adversaries act either in isolation or in collusion, e.g. SWARM attacks which in turn can be either pure cyber-attacks or a combination of vandalism and cyber-attacks;
• capture evolution of the adversary profiles over time. This evolution may be due to successful attacks or due to ‘strengthening’ the defences of the ICS, e.g. due to introducing new technologies.

Task 2.2: Toolset for model-based risk assessment. Since the WP is driven by examples, the existing tools will be continuously enhanced to allow for studies, as summarised in Task 2.1, to be conducted.

Task 2.3: Industrial examples. We will apply the new modelling techniques and tools on a number of realistically complex case-studies:

• We already have several detailed descriptions of complex power systems (transmission and distribution) and the respective ICS (based on the international standard IEC 61850 for a substation in power systems). These will be used in the work on WP2.
• With our partner ALSTOM Grid we have identified a number of practically interesting problems, specific for ICS, e.g. the impact of limited observability of the state of the power networks (e.g. due to sensor failures or DoS attacks) on the accuracy of the advice produced by so called “special purpose software”, i.e. advisory software which assists operators with the control decisions in case of emergency. Analysing how limited observability affects the decisions taken by the operators will be studied in detail.