A Security-Aware Framework for Designing Industrial Engineering Processes

Abstract

Modern critical infrastructures (CI) are complex Cyber-Physical-Systems (CPS) that tightly integrate physical processes with information and communication technology components. Numerous safety mishaps and security attacks in such systems have demonstrated the need to ensure their safety and security from early design stages. Research on CPS has mostly focused on securing existing, implemented industrial systems, while safety and security consideration during the design stages of modern industrial infrastructures has largely gone unnoticed. In this paper, we present a framework that extends previous, preliminary work on the integration of security in industrial engineering design practices, and provide an algorithmic approach that effectively reduces risk during industrial system design lifecycles. We achieve this by analyzing flows of materials and information related to physical processes using three steps: (1) Identifying critical components and flows, (2) prioritizing flows based on their ties to high risk and importance in terms of dependencies, and (3) classifying system components based on their influence on the overall industrial system. To do that, we utilize (i) material flow networks (MFN) for modelling/designing the physical system (ii) dependency risk graphs for analyzing networks dependencies and assessing the system, in terms of risk, (iii) graph minimum spanning trees, and (iv) network centrality metrics. To evaluate our approach, we model and assess the production chain corresponding to an oil refinery plant’s Liquefied Petroleum Gas (LPG) purification process. Preliminary findings demonstrate the complex dependencies between cybersecurity vulnerabilities and system safety.

Keywords

• Security by design
• industrial engineering
• risk analysis
• risk assessment
• risk mitigation
• dependency risk graphs