Traditional approaches to risk reduction which focus exclusively on threats, vulnerabilities, and consequences of exposure may not be ideally suited to assess complex and highly connected systems critical to the successful completion of mission objectives. Therefore, cyber resilience should be considered within a variety of domains (physical, information, social, cognitive) which include software, firmware, interconnected hardware, sensing components, the supply chain, and ultimately actions of the cybersecurity professionals who interact with a system to sustain operations. To this end, G2 Ops envisions a multi-disciplinary approach towards defining a quantitative resiliency metric which encompasses: Identification of the critical functions and features (i.e., operational performance requirements) specific to Industrial Control System (ICS) components typically present in automated shipboard systems (hull, mechanical and electrical (HM&E)); Identification of key performance parameters (KPPs) for ICS components and their correlation (i.e., role) in the fulfillment of mission objectives; Identification of external data sources which might contribute to the definition of quantifiable cyber resiliency metrics; Suitability of technical controls specified in the DoD Risk Management Framework (RMF); and Application of best practices (technology, processes, compensating controls) which can be used to buy down the implementation cost of unnecessary cybersecurity capabilities through cost and schedule evaluation.
Benefit: Cyber threats against ship combat and platform systems are not new but evolving. For the U.S. Navy, the operational and warfighting capabilities are often controlled by automated shipboard systems (hull, mechanical and electrical (HM&E)). These systems are closely interconnected and controlled utilizing vendor-developed or -provided commercial-off-the shelf (COTS) software and hardware. This architectural design, along with the current Department of Defense acquisition strategy which encourages the Navy to procure software and hardware from commercial vendors, exposes the systems to various potential cyberattacks due to insider threats. Program Offices and engineering support activities across the Navy are looking for more efficient and effective ways to evaluate, manage, and implement cybersecurity measures that use a better and more diverse set of criteria for decision making. The approach to implementing cybersecurity measures in this fashion will look less at blanket security measure requirements that add little to no value and more towards affordable solutions that evaluate the best security measures to reduce risk and maximize resiliency. Industrial control systems (ICS), program logic controllers (PLCs), and Supervisory Control and Data Acquisition (SCADA) systems require firmware and software to perform their function. However, their technical and operational footprint may not match that of a traditional information technology (IT) system. While these systems may have critical functions and still must uphold the standards of availability, integrity, and confidentiality, their function and purpose may not carry the same voluptuous nature of integration, communication, and data management that warrant or require the traditional standards of cybersecurity. For these reasons, it is necessary to develop a new strategy and capability that will quantify and standardize a process for measuring resiliency that can be evaluated across all information systems.
Keywords: Industrial Control Systems, Industrial Control Systems, Risk Management, Critical Infrastructure, SysML modeling, Cybersecurity Defense-in-depth, System of Systems, MBSE, Cybersecurity Resiliency
