A lightweight risk analysis of a critical infrastructure based ICSs

Abstract

Industrial Control Systems (ICS) are currently integrated into critical infrastructures and are designed to support industrial processes, monitor and control in real time a large number of processes and operations such as gas and electricity distribution (conventional and nuclear), water treatment, etc. ICSs have evolved significantly in recent years and have embraced new technologies such as IoT and have been made accessible through the Internet to allow remote access to administrators, service providers, etc. The aim of this paper is to illustrate, through the use of EBIOS risk analysis method that such infrastructures are subject to vulnerabilities, overwhelming threats and potentials risks. The paper also proposes a number of recommendations and organizational and technological security measures to reduce these risks to an acceptable level and to decrease both their impacts and potentialities.