Cyber Security Evaluation for a Petroleum Refinery Using Attack Tree Methodology and Economic Indexes

Abstract

Information Technology (IT) is vital and valuable to our society. An important type of IT system is Supervisory Control and Data Acquisition (SCADA) systems. The most common misconception regarding the security of SCADA was that this network was electronically isolated from other networks and hence attackers could not access them. Over the years SCADA systems have become incorporated with other IT systems, which has made them becoming increasingly vulnerable to cyber threats. Decision makers should assess the security that the SCADA system’s architecture offers so as to make notified decisions about its appropriateness. In this work a mixed qualitative and quantitative approach for evaluation of Cyber security for a Hypothetical Refinery. Cyber security scenario has been modeled by using Defense Tree (DT), an extension of Attack Tree (AT) with attack countermeasures. Numerical values were assigned to the leaf nodes to assert the difficulty of compromising the root nodeand quantitative indexes for computing the defender’s Return On security Investment (ROI) and the attacker’s Return On Attack (ROA). It has been shown that this approach can be used to evaluate the strength and economic profitability of countermeasures as well as their impediment effect on attackers, thus providing decision makers with a utilitarian tool for performing better evaluation of Cyber security investments during the risk management process in our local refinery.