Towards Agile Industrial Control Systems Incident Response

The integration of Industrial Control Systems (ICS) with IT systems has increased the ICS’ exposure to cyber threats.We have seen a tremendous increase in the number of security incidents happened to ICS in the past five years. This requires the ICS to provide effective incident response capabilities to counteract security attacks. Previous research on ICS incident response has been focusing on incident detection and analysis. This paper examines the current ICS incident response procedure from a managerial perspective, identifies the unique characteristics of ICS incident response and proposes a framework to improve incident response capabilities. In particular, it evaluates the benefit of agile values to address specific characteristics of ICS Incident Response. This foundational work sets the scene for future research to apply agile practices into ICS Incident Response.

Content

Author and article information

Contributors

Ying He

Helge Janicke

Conference

Publication date: September 2015

Publication date (Print): September 2015

Pages: 95-98

Affiliations

[0001]Cyber Security Centre

De Montfort University

The Gateway House

Leicester, UK

[0002]Software Technology Research Laboratory

De Montfort University

The Gateway House

Leicester, UK

Article

DOI: 10.14236/ewic/ICS2015.11

SO-VID: ef86d492-4e93-408b-80a5-059b794558eb

License:

This work is licensed under a Creative Commons Attribution 4.0 Unported License. To view a copy of this license, visit http://creativecommons.org/licenses/by/4.0/

Conference name: 3rd International Symposium for ICS & SCADA Cyber Security Research 2015 (ICS-CSR 2015)

Conference acronym: ICS-CSR

Conference number: 3

Conference location: Germany

Conference date: 17 - 18 September 2015

Conference sponsor: Electronic Workshops in Computing (eWiC)

Conference theme: Industrial Control System & SCADA Cyber Security Research (ICS-CSR)

History

Product

1477-9358 BCS Learning & Development

Self URI (article page): https://www.scienceopen.com/hosted-document?doi=10.14236/ewic/ICS2015.11

Self URI (journal page): https://ewic.bcs.org/

References

Homeland Security 2009 Recommended Practice: Developing an Industrial Control Systems Cyber-security Incident Response Capability
K StoufferJ FalcoK Scarfone 2011 Guide to industrial control systems (ICS) security NIST special publication 800 82
C. L FokG. C RomanC Lu 2009 Agilla: A mobile agent middleware for self-adaptive wireless sensor networks ACM Trans. Auton. Adaptive Syst. (TAAS) 4 3 16
Y He 2014 Diagramming approach to structure the security lessons: Evaluation using cognitive dimensions Trust and Trustworthy Computing Springer International Publishing 216 217
Y He 2014 Mar An empirical study on the use of the generic security template for structuring the lessons from information security incidents 6th IEEE International Conference on Computer Science and Information Technology 178 188
Y He 2014 May Improving the information security management: An industrial study in the privacy of electronic patient records IEEE 27th International Symposium on Computer-Based Medical Systems (CBMS) 525 526
Y HeC. W Johnson 2012 Generic security cases for information system security in healthcare systems Proceedings of the 7th IET International Conference on System Safety, Incorporating the Cyber Security Conference Edinburgh, U.K
P SheddenA AhmadA. B Ruighaver 2010 Organisational learning and incident response: Promoting effective learning through the incident response process School of Computer and Information Science Perth, Western Australia Edith Cowan University
A Nicholson 2012 SCADA security in the light of Cyber-Warfare Comput. Secur 31 4 418 436
K Beck 2001 Manifesto for agile software development Available from http://agilemanifesto.org/
European Commission 2015 Digital Security: Cybersecurity, privacy and trust - the role of ICT in critical infrastructure protection Available from http://ec.europa.eu/research/participants/portal/ desktop/en/opportunities/h2020/topics/1052-ds-03-2015.html
U. D. of Homeland Security 2010 ICS-CERT year in review 2010 Washington, D.C Available from https://icscert.us-cert.gov/ICS-CERT-Year-Review-2010
U. D. of Homeland Security 2014 ICS-CERT year in review 2014 Washington, D.C Available from https://ics-cert.us-cert.gov/NCCICICSCERTreleases-Year-Review-2014
R Werlinger 2010 Preparation, detection, and analysis: The diagnostic work of IT security incident response Inform. Manage. Comput. Secur 18 1 26 42 Emerald Group Publishing Limited
E Casey 2005 Case study: Network intrusion investigation lessons in forensic preparation Digital Investigation 2 4 254 260 Elsevier
C AlcarazG FernandezF Carvajal 2012 Security aspects of SCADA and DCS environments Critical Infrastructure Protection Berlin, Heidelberg, Germany Springer 120 149
G GrisposW. B GlissonT Storer 2014 Rethinking security incident response: The integration of agile principles arXiv preprint arXiv:1408.2431
A Pauna 2013 Can We Learn from SCADA Security Incidents White Paper European Union Agency for Network and Information Security Heraklion, Crete, Greece
A AhmadJ HadgkissA. B Ruighaver 2012 Incident response teams challenges in supporting the organisational security function Comput. Secur 31 5 643 652 Elsevier

Comments

Comment on this article

[1] Homeland Security 2009 Recommended Practice: Developing an Industrial Control Systems Cyber-security Incident Response Capability

[2] K StoufferJ FalcoK Scarfone 2011 Guide to industrial control systems (ICS) security NIST special publication 800 82

[3] C. L FokG. C RomanC Lu 2009 Agilla: A mobile agent middleware for self-adaptive wireless sensor networks ACM Trans. Auton. Adaptive Syst. (TAAS) 4 3 16

[4] Y He 2014 Diagramming approach to structure the security lessons: Evaluation using cognitive dimensions Trust and Trustworthy Computing Springer International Publishing 216 217

[5] Y He 2014 Mar An empirical study on the use of the generic security template for structuring the lessons from information security incidents 6th IEEE International Conference on Computer Science and Information Technology 178 188

[6] Y He 2014 May Improving the information security management: An industrial study in the privacy of electronic patient records IEEE 27th International Symposium on Computer-Based Medical Systems (CBMS) 525 526

[7] Y HeC. W Johnson 2012 Generic security cases for information system security in healthcare systems Proceedings of the 7th IET International Conference on System Safety, Incorporating the Cyber Security Conference Edinburgh, U.K

[8] P SheddenA AhmadA. B Ruighaver 2010 Organisational learning and incident response: Promoting effective learning through the incident response process School of Computer and Information Science Perth, Western Australia Edith Cowan University

[9] A Nicholson 2012 SCADA security in the light of Cyber-Warfare Comput. Secur 31 4 418 436

[10] K Beck 2001 Manifesto for agile software development Available from http://agilemanifesto.org/

[11] European Commission 2015 Digital Security: Cybersecurity, privacy and trust - the role of ICT in critical infrastructure protection Available from http://ec.europa.eu/research/participants/portal/ desktop/en/opportunities/h2020/topics/1052-ds-03-2015.html

[12] U. D. of Homeland Security 2010 ICS-CERT year in review 2010 Washington, D.C Available from https://icscert.us-cert.gov/ICS-CERT-Year-Review-2010

[13] U. D. of Homeland Security 2014 ICS-CERT year in review 2014 Washington, D.C Available from https://ics-cert.us-cert.gov/NCCICICSCERTreleases-Year-Review-2014

[14] R Werlinger 2010 Preparation, detection, and analysis: The diagnostic work of IT security incident response Inform. Manage. Comput. Secur 18 1 26 42 Emerald Group Publishing Limited

[15] E Casey 2005 Case study: Network intrusion investigation lessons in forensic preparation Digital Investigation 2 4 254 260 Elsevier

[16] C AlcarazG FernandezF Carvajal 2012 Security aspects of SCADA and DCS environments Critical Infrastructure Protection Berlin, Heidelberg, Germany Springer 120 149

[17] G GrisposW. B GlissonT Storer 2014 Rethinking security incident response: The integration of agile principles arXiv preprint arXiv:1408.2431

[18] A Pauna 2013 Can We Learn from SCADA Security Incidents White Paper European Union Agency for Network and Information Security Heraklion, Crete, Greece

[19] A AhmadJ HadgkissA. B Ruighaver 2012 Incident response teams challenges in supporting the organisational security function Comput. Secur 31 5 643 652 Elsevier

Celebrating 65 years of The Computer Journal - free-to-read perspectives - bcs.org/tcj65