Security of Safety Important I&C Systems - Nuclear Power Plant Instrumentation and Control Systems for Safety and Security - page 258

Figure 11. Proposed approach to assurance of
cyber security

Further, in order to implement the approach,
the following cases are possible, depending on
the scope of the assessment:

1. Assessment of the I&C system as a whole.
Then, a set of particular IMECA tables
(which represent all the identified gaps by a
set of discrepancies) should be integrated into
the single global IMECA table that reflects
the whole system. In this case, each row of
the global IMECA table forms the basis for
creating a global criticality matrix, which can
be used in cyber security assurance process.
2. Assessment of particular (sub-)systems
within the I&C system. In this case, it is
possible to create an appropriate set of lo-
cal criticality matrixes that correspond to
certain (sub-)systems, based on a set of local
IMECA tables.

So, proposed gap-and-IMECA-based approach
to assessment can be expressed in the consequence
of actions (see also Figure 11) listed below.

Step 1: Performance of GA: identification of
security gaps lists for all the components (or
modules) of I&C system, being assessed,
during each life cycle stage. Such lists should
include both process gaps (in terms of dis-
crepancies) and product cyber security gaps
(in terms of vulnerabilities).
Step 2(a): Performance of IMECA-based assess-
ment: determination of an appropriate set
of vulnerabilities for each identified during
GA process gap, security gap and possible
scenarios to exploit the vulnerabilities. So,
for each identified discrepancy or vulner-
ability, there should be created local IMECA
table that reflects: attack mode, attack nature,
attack cause, occurrence probability, effect
severity, and type of effects. In this way each
gap is being represented by one or several
rows in a local IMECA table.

Step 2(b): Assessment of appropriate columns
(occurrence probability and effect sever-
ity) in each particular IMECA table, for
example, on the basis of expert evaluation.
Then, each row of such a local IMECA
table represents security weaknesses, which
should be analyzed further in context of the
whole I&C system.
Step 3: Creating of security criticality matrix
to analyze the cyber security risks of I&C
system components during different stages.
Each row in local IMECA tables forms
the basis for creation of security criticality
matrix, which reveals the weaknesses of ap-
propriate components in a visual form. The
highest cyber security risk corresponds to
the highest row in security criticality matrix.