Critical infrastructure protection: Requirements and challenges for the 21st century

International Journal of Critical Infrastructure Protection

Volumn 8, Issue , 2015, Pages 53-66

  Alcaraz, Cristina ^a   Zeadally, Sherali ^b  

^a UNIVERSITY OF MÁLAGA   (Spain)

^b UNIVERSITY OF KENTUCKY   (United States)

Author keywords

Challenges; Critical infrastructure protection; Requirements; Risk; SCADA systems; Security

Indexed keywords

COMPUTER SIMULATION; NETWORK ARCHITECTURE; PUBLIC WORKS; RISKS; SCADA SYSTEMS; WIDE AREA NETWORKS;

CHALLENGES; CRITICAL INFRASTRUCTURE PROTECTION; INDUSTRIAL CONTROL SYSTEMS; MODEL AND SIMULATION; REQUIREMENTS; SECURE NETWORK ARCHITECTURE; SECURITY; SITUATIONAL AWARENESS;

CRITICAL INFRASTRUCTURES;

EID: 84922217316     PISSN: 18745482     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.ijcip.2014.12.002     Document Type: Article

References (87)

1. C. Alcaraz, I. Agudo, C. Fernandez-Gago, R. Roman, G. Fernandez, J. Lopez, Adaptive dispatching of incidents based on reputation for SCADA systems, in: Proceedings of the Sixth International Conference on Trust, Privacy and Security in Digital Business, 2009, pp. 86-94.
2. C. Alcaraz, I. Agudo, D. Nunez, J. Lopez, Managing incidents in smart grids a la cloud, in: Proceedings of the Third IEEE International Conference on Cloud Computing Technology and Science, 2011, pp. 527-531.
3. C. Alcaraz, A. Balastegui, J. Lopez, Early warning system for cascading effect control in energy control systems, in: Proceedings of the Fifth International Conference on Critical Information Infrastructures Security, 2010, pp. 55-67.
4. Alcaraz C., Fernandez G., Carvajal F. Security aspects of SCADA and DCS environments. Advances in Critical Infrastructure Protection: Information Infrastructure Models, Analysis and Defense 2011, 120-149. Springer, Berlin, Heidelberg, Germany. J. Lopez, R. Setola, S. Wolthusen (Eds.).
5. Alcaraz C., Fernandez-Gago C., Lopez J. An early warning system based on reputation for energy control systems. IEEE Trans. Smart Grid 2011, 2(4):827-834.
6. Alcaraz C., Lopez J. A security analysis for wireless sensor mesh networks in highly critical systems. IEEE Trans. Syst. Man Cybern. Part C: Appl. Rev. 2010, 40(4):419-428.
7. Alcaraz C., Lopez J. Analysis of requirements for critical control systems. Int. J. Crit. Infrastruct. Prot. 2012, 5(3-4):137-145.
8. Alcaraz C., Lopez J. Wide-area situational awareness for critical infrastructure protection. IEEE Comput. 2013, 46(4):30-37.
9. Alcaraz C., Lopez J., Roman R., Chen H. Selecting key management schemes for WSN applications. Comput. Secur. 2012, 31(8):956-966.
10. Alcaraz C., Lopez J., Zhou J., Roman R. Secure SCADA framework for the protection of energy control systems. Concurr. Comput. Pract. Exp. 2011, 23(12):1414-1430.
11. Alcaraz C., Roman R., Najera P., Lopez J. Security of industrial sensor network based remote substations in the context of the Internet of Things. Ad Hoc Netw. 2013, 11(3):1091-1104.
12. Alcaraz C., Zeadally S. Critical control system protection in the 21st century. IEEE Comput. 2013, 46(4):74-83.
13. API Standard 1164: Pipeline SCADA Security 2009, American Petroleum Institute, American Petroleum Institute, Washington, DC. 2nd ed.
14. ARTEMIS Project, Internet of Energy for Electric Mobility, SINTEF, Oslo, Norway, 2011.
15. F. Baker, D. Meyer, Internet Protocols for the Smart Grid, RFC 6272, 2011.
16. Bendisch U., Bologna S., Le Grand G., Luiijf E. Towards a European research agenda for CIIP. results from the CI2RCO Project. Critical Information Infrastructures Security 2008, 1-12. Springer, Heidelberg, Germany. J. Lopez, B. Hammerli (Eds.).
17. A. Bondi, Characteristics of scalability and their impact on performance, in: Proceedings of the Second International Workshop on Software and Performance, 2000, pp. 195-203.
18. Y. Chen, J. Welch, Self-stabilizing mutual exclusion using tokens in mobile ad hoc networks, in: Proceedings of the Sixth International Workshop on Discrete Algorithms and Methods for Mobile Computing and Communications, 2002, pp. 34-42.
19. CloudCERT, Testbed Framework to Exercise Critical Infrastructure Protection, National Institute of Communication Technologies, Leon, Spain, 2012.
20. T. Cohen, M. Lubell, Nations must talk to halt "cyber terrorism:" Kaspersky, Reuters, June 6, 2012.
21. Colloquium for Information Systems Security Education, Belleville, Michigan 〈〉, 2014. http://www.cisse.info.
22. A. Datta, M. Gradinariu, S. Tixeuil, Self-stabilizing mutual exclusion using an unfair distributed scheduler, in: Proceedings of the Fourteenth International Parallel and Distributed Processing Symposium, 2000, pp. 465-470.
23. Dijkstra E. Self-stabilizing systems in spite of distributed control. Commun. ACM 1974, 17(11):643-644.
24. European Commission, Critical Infrastructure Protection in the Fight Against Terrorism, COM(2004) 702 Final, Brussels, Belgium, 2004.
25. European Commission, Green Paper on a European Programme for Critical Infrastructure Protection, COM(2005) 576 Final, Brussels, Belgium, 2005.
26. European Commission, Communication from the Commission on a European Programme for Critical Infrastructure Protection, COM(2006) 786 Final, Brussels, Belgium, 2006.
27. Exemys, Exemys, Buenos Aires, Argentina 〈〉, 2014. http://www.exemys.com.
28. Gungor V., Hancke G. Industrial wireless sensor networks. challenges, design principles and technical approaches. IEEE Trans. Ind. Electron. 2009, 56(10):4258-4265.
29. M. Hadley, K. Huston, AGA 12, Part 2, Performance Test Plan, National SCADA Test Bed, Office of Electricity Delivery and Energy Reliability, U.S. Department of Energy, Washington, DC, 2006.
30. K. Harrison and G. White, A taxonomy of cyber events affecting communities, in: Proceedings of the Forty-Fourth Hawaii International Conference on System Sciences, 2011.
31. HART Communication Foundation, WirelessHART Technical Notes 〈〉, 2014. http://en.hartcomm.org/hcp/tech/articles/wiHART_resources/witech_witechnote.html.
32. S. Hou, X. Zhang, Alarm association rules based on a sequential pattern mining algorithm, in: Proceedings of the Fifth International Conference on Fuzzy Systems and Knowledge Discovery, vol. 2, 2008, pp. 556-560.
33. Institute of Electrical and Electronics Engineers, IEEE Standard 610-1990-IEEE Standard Computer Dictionary: A Compilation of IEEE Standard Computer Glossaries, Piscataway, New Jersey, 1990.
34. Institute of Electrical and Electronics Engineers, IEEE Standard 1402-2000-IEEE Guide for Electric Power Substation Physical and Electronic Security, Piscataway, New Jersey, 2000.
35. Institute of Electrical and Electronics Engineers, IEEE Standard 802.15.4d-200p-IEEE Standard for Information Technology-Local and Metropolitan Area Networks-Specific Requirements-Part 15.4: Wireless Medium Access Control (MAC) and Physical Layer (PHY) Specifications for Low-Rate Wireless Personal Area Networks (WPANs), Amendment 3: Alternative Physical Layer Extension to Support the Japanese 950MHz Bands, Piscataway, New Jersey, 2009.
36. International Electrotechnical Commission, IEC 62351: Power Systems Management and Associated Information Exchange-Data and Communications Security, Geneva, Switzerland, 2013.
37. International Organization for Standardization, ISO/IEC 17779: 2005, Technology of Information Techniques Related to Security Code for the Practice of the Security Management of Information, Geneva, Switzerland, 2005.
38. International Organization for Standardization, ISO/IEC TR 19791:2010: Information Technology-Security Techniques-Security Assessment of Operational Systems, Geneva, Switzerland, 2010.
39. International Organization for Standardization, ISO/IEC 27002:2013: Information Technology-Security Techniques-Code of Practice for Information Security Controls, Geneva, Switzerland, 2013.
40. International Organization for Standardization, ISO/IEC 27001:2013: Information Technology-Security Techniques-Information Security Management Systems - Requirements, Geneva, Switzerland, 2013.
41. International Society of Automation, ANSI/ISA-100.11a-2011 Wireless Systems for Industrial Automation: Process Control and Related Applications, Research Triangle Park, North Carolina, 2011.
42. International Society of Automation, Security for Industrial Automation and Control Systems, Security Technologies for Industrial Automation and Control Systems, ISA-TR62443-3-1 (99.03.01), Research Triangle Park, North Carolina, 2012.
43. M. Jain, A. Jain, M. Srinivas, A web-based expert system shell for fault diagnosis and control of power system equipment, in: Proceedings of the International Conference on Condition Monitoring and Diagnosis, 2008, pp. 1310-1313.
44. Josang A., Ismail R., Boyd C. A survey of trust and reputation systems for online service provision. Decis. Support Syst. 2007, 43(2):618-644.
45. G. Kalogridis, C. Efthymiou, S. Denic, T. Lewis, R. Cepeda, Privacy for smart meters: towards undetectable appliance load signatures, in: Proceedings of the First IEEE International Conference on Smart Grid Communications, 2010, pp. 232-237.
46. S. Karnouskos, The cooperative Internet of Things enabled smart grid, in: Proceedings of the Fourteenth IEEE International Symposium on Consumer Electronics, 2010.
47. Knapp E., Langill J. Industrial Network Security: Securing Critical Infrastructure Networks for Smart Grid, SCADA and Other Industrial Control Systems 2011, Syngress, Waltham, Massachusetts.
48. Krumm J. A survey of computational location privacy. Pers. Ubiquitous Comput. 2009, 13(6):391-399.
49. McClanahan R. SCADA and IP: is network convergence really here?. IEEE Ind. Appl. 2003, 9(2):29-36.
50. G. Montenegro, N. Kushalnagar, J. Hui, D. Culler, Transmission of IPv6 Packets over IEEE 802.15.4 Networks, RFC 4944, 2007.
51. National Infrastructure Security Coordination Centre, Good Practice Guide on Firewall Deployment for SCADA and Process Control Networks, London, United Kingdom, 2005.
52. National Institute of Standards and Technology, Guidelines for Smart Grid Cyber Security: Vol. 1, Smart Grid Cyber Security Strategy, Architecture and High-Level Requirements, NISTIR 7628, Gaithersburg, Maryland, 2010.
53. National Institute of Standards and Technology, Guidelines for Smart Grid Cyber Security: Vol. 3, Supportive Analyses and References, NISTIR 7628, Gaithersburg, Maryland, 2010.
54. National Institute of Standards and Technology, NIST Framework and Roadmap for Smart Grid Interoperability Standards, Release 2.0, NIST Special Publication 1108 R2, Gaithersburg, Maryland, 2012.
55. National Institute of Standards and Technology, Security and Privacy Controls for Federal Information Systems and Organizations, NIST Special Publication 800-53, Revision 4, Gaithersburg, Maryland, 2013.
56. North American Electric Reliability Corporation, CIP-002: Critical Cyber Asset Identification, NERC CIP Standard, Washington, DC, 2009.
57. Pai S., Bermudez S., Wicker S., Meingast M., Roosta T., Sastry S., Mulligan D. Transactional confidentiality in sensor networks. IEEE Secur. Priv. 2008, 6(4):28-35.
58. P. Parikh, M. Kanabar, T. Sidhu, Opportunities and challenges of wireless communications technologies for smart grid applications, in: Proceedings of the IEEE Power and Energy Society General Meeting, 2010.
59. Psaier H., Dustdar S. A survey on self-healing systems. approaches and systems. Computing 2011, 91(1):43-73.
60. T. Rigole, G. Deconinck, A survey on modeling and simulation of interdependent critical infrastructures, in: Proceedings of the Third IEEE Benelux Young Researchers Symposium in Electrical Power Engineering, paper 44, 2006.
61. B. Rimal, C. Eunmi, I. Lumb, A taxonomy and survey of cloud computing systems, in: Proceedings of the Fifth International Joint Conference on INC, IMS and IDC, 2009, pp. 44-51.
62. S. Rinaldi, Modeling and simulating critical infrastructures and their interdependencies, in: Proceedings of the Thirty-Seventh Annual Conference on Hawaii International System Sciences, 2004.
63. Rinaldi S., Peerenboom J., Kelly T. Identifying, understanding and analyzing critical infrastructure interdependencies. IEEE Control Syst. 2001, 21(6):11-25.
64. Roman R., Alcaraz C., Lopez J. The role of wireless sensor networks in the area of critical information infrastructure protection. Inf. Secur. Tech. Rep. 2007, 12(1):24-31.
65. Roman R., Najera P., Lopez J. Securing the Internet of Things. IEEE Comput. 2011, 44(9):51-58.
66. Salah A., Pauwels E., Tavenard R., Gevers T. T-patterns revisited. mining for temporal patterns in sensor data. Sensors 2010, 10(8):7496-7513.
67. Salihbegovic A., Marinkovic V., Cico Z., Karavdic E., Delic N. Web based multilayered distributed SCADA/HMI system in refinery application. Comput. Stand. Interfaces 2009, 31(3):599-612.
68. SELFMAN Project, Self-Management for Large-Scale Distributed Systems based on Structured Overlay Networks and Components, Catholic University of Louvain, Louvain-la-Neuve, Belgium, 2010.
69. SRI International, Event Monitoring Enabling Responses to Anomalous Live Disturbances (EMERALD), Menlo Park, California 〈〉, 2014. http://www.csl.sri.com/projects/emerald.
70. K. Suresh, R. Kirubashankar, K. Krishnamurthy, Research of Internet based supervisory control and information system, in: Proceedings of the International Conference on Recent Trends in Information Technology, 2011, pp. 1180-1185.
71. Takabi H., Joshi J., Ahn G. Security and privacy challenges in cloud computing environments. IEEE Secur. Priv. 2010, 8(6):24-31.
72. The White House, President Obama announces $3.4 billion investment to spur transition to smart energy grid, Washington, DC, October 27, 2009.
73. U.S. Department of Homeland Security, National Infrastructure Protection Plan (NIPP), Washington, DC, 2009.
74. U.S. Department of Homeland Security, Catalog of Control Systems Security: Recommendations for Standards Developers, Washington, DC, 2011.
75. U.S. General Accounting Office, Critical Infrastructure Protection, Challenges in Securing Control Systems, Robert F. Dacey, Testimony before the Subcommittee on Technology, Information Policy, Intergovernmental Relations and the Census, House Committee on Government Reform, GAO-04-140T, Washington, DC, 2003.
76. U.S. General Accounting Office, Critical Infrastructure Protection, Cybersecurity Guidance is Available, but More can be Done to Promote its Use, Report to Congressional Requesters, GAO-12-92, Washington, DC, 2011.
77. U.S. Government, Homeland Security Act 2002-Public Law 107-296, Washington, DC, 2002.
78. WebSCADA Corporation, WebSCADA, Irvine, California 〈〉, 2014. http://www.webscada.com.
79. Y. Yang, Microchip MiWi P2P Wireless Protocol, AN1204, Microchip Technology, Chandler, Arizona, 2010.
80. Yokogawa, Yokogawa Electric Corporation, Tokyo, Japan 〈〉, 2014. http://www.yokogawa.com.
81. S. Zanero, S. Savaresi, Unsupervised learning techniques for an intrusion detection system, in: Proceedings of the ACM Symposium on Applied Computing, 2004, pp. 412-419.
82. Zeadally S., Martinez G., Chao H. Securing cyberspace in the 21st century. IEEE Comput. 2013, 46(4):22-23.
83. Zeadally S., Pathan A., Alcaraz C., Badra M. Towards privacy protection in the smart grid. Wirel. Pers. Commun. 2013, 73(1):23-50.
84. Zheng Z., Lyu M. An adaptive QoS-aware fault-tolerance strategy for web services. Empir. Softw. Eng. 2010, 15(4):323-345.
85. B. Zhu, A. Joseph, S. Sastry, A taxonomy of cyber attacks on SCADA systems, in: Proceedings of the International Conference on the Internet of Things and the Fourth International Conference on Cyber, Physical and Social Computing, 2011, pp. 380-388.
86. Q. Zhu, Y. Yang, E. Scholte, M. Natale, A. Sangiovanni-Vicentelli, Optimizing extensibility in hard real-time distributed systems, in: Proceedings of the Fifteenth IEEE Real-Time and Embedded Technology and Applications Symposium, 2009, pp. 275-284.
87. ZigBee Alliance, ZigBee-2007 Layer PICS and Stack Profiles, Revision 3, ZigBee Document 08006r03, San Ramon, California, 2008.