A manufacturer-specific security assessment methodology for critical infrastructure components

Abstract

Protecting critical infrastructure assets such as telecommunications networks and energy generation and distribution facilities from cyber attacks is a major challenge. However, because security is a complex and multi-layered topic, a foundation for manufacturers to assess the security of products used in critical infrastructures is often missing. This paper describes a structured security assessment methodology that is specifically designed for use by manufacturers during product development. The methodology, which incorporates risk analysis, theoretical assessment and practical assessment, anticipates operational security challenges before products are deployed in critical infrastructures. © 2010 IFIP International Federation for Information Processing.