S Zahid
Threat modeling in smart firefighting systems: aligning MITRE ATT&CK Matrix and NIST security controls
Zahid, S; Mazhar, MS; Abbas, SG; Hanif, Z; Hina, S; Shah, GA
Authors
MS Mazhar
SG Abbas
Z Hanif
Dr Sadaf Hina S.Hina@salford.ac.uk
Lecturer in Computer Sci Cyber Security
GA Shah
Abstract
Industrial automation technologies are envisioned as multi-device systems that are constantly interacting with one another and with enterprise systems. In these industrial systems, the industrial internet of things (IIoT) significantly improves system efficiency, scalability, ease of control, and monitoring. These benefits have been achieved at the cost of greater security risks, thus making the system vulnerable to cyberattacks. Historically, industrial networks and systems lacked security features like authentication and encryption due to intended isolation over the Internet. Lately, remote access to these IIoT systems has made an attempt of holistic security alarmingly critical. In this research paper, a threat modeling framework for smart cyber–physical system (CPS) is proposed to get insight of the potential security risks. To carry out this research, the smart firefighting use case based on the MITRE ATT&CK matrix was investigated. The matrix analysis provided structure for attacks detection and mitigation, while system requirement collection (SRC) was applied to gather generic assets’ information related to hardware, software and network. With the help of SRC and MITRE ATT&CK, a threat list for the smart firefighting system was generated. Conclusively, the generated threat list was mapped on the national institute of standards and technology (NIST) security and privacy controls. The results show that these mapped controls can be well-utilized for protection and mitigation of threats in smart firefighting system. In future, critical cyber–physical systems can be modeled upon use case specific threats and can be secured by utilizing the presented framework.
Citation
Zahid, S., Mazhar, M., Abbas, S., Hanif, Z., Hina, S., & Shah, G. (in press). Threat modeling in smart firefighting systems: aligning MITRE ATT&CK Matrix and NIST security controls. Internet of Things, 22, https://doi.org/10.1016/j.iot.2023.100766
Journal Article Type | Article |
---|---|
Acceptance Date | Mar 21, 2023 |
Online Publication Date | Apr 5, 2023 |
Deposit Date | Apr 18, 2023 |
Publicly Available Date | Apr 18, 2023 |
Journal | Internet of Things |
Print ISSN | 2542-6605 |
Electronic ISSN | 2542-6605 |
Publisher | Elsevier |
Volume | 22 |
DOI | https://doi.org/10.1016/j.iot.2023.100766 |
Publisher URL | https://doi.org/10.1016/j.iot.2023.100766 |
Files
Published Version
(1.8 Mb)
PDF
Licence
http://creativecommons.org/licenses/by/4.0/
Publisher Licence URL
http://creativecommons.org/licenses/by/4.0/
You might also like
CyberEntRel: Joint Extraction of Cyber Entities and Relations using Deep Learning
(2023)
Journal Article
Agentless approach for security information and event management in industrial IoT
(2023)
Journal Article
An automated context-aware IoT vulnerability assessment rule-set generator
(2022)
Journal Article
Beyond the horizon, backhaul connectivity for offshore IoT devices
(2021)
Journal Article
Downloadable Citations
About USIR
Administrator e-mail: library-research@salford.ac.uk
This application uses the following open-source libraries:
SheetJS Community Edition
Apache License Version 2.0 (http://www.apache.org/licenses/)
PDF.js
Apache License Version 2.0 (http://www.apache.org/licenses/)
Font Awesome
SIL OFL 1.1 (http://scripts.sil.org/OFL)
MIT License (http://opensource.org/licenses/mit-license.html)
CC BY 3.0 ( http://creativecommons.org/licenses/by/3.0/)
Powered by Worktribe © 2024
Advanced Search