| 1. |
|
|
| 2. |
- Kour, Ravdeep, 1981-, et al.
(författare)
-
Cybersecurity for railways : A maturity model
- 2020
-
Ingår i: Proceedings of the Institution of mechanical engineers. Part F, journal of rail and rapid transit. - : Sage Publications. - 0954-4097 .- 2041-3017. ; 234:10, s. 1129-1148
-
Tidskriftsartikel (refereegranskat)abstract
- With the advancements in and widespread adoption of information and communication technologies in infrastructures, cyber-attacks are becoming more frequent and more severe. Advanced cybersecurity threats with automated capabilities are increasing in such sectors as finance, health, grid, retail, government, telecommunications, transportation, etc. Cyber-attacks are also increasing in railways with an impact on railway stakeholders, e.g. threat to the safety of employees, passengers, or the public in general; loss of sensitive railway information; reputational damage; monetary loss; erroneous decisions; loss of dependability, etc. There is a need to move towards advanced security analytics and automation to identify, respond to, and prevent such security breaches. The objective of this research is to reduce cyber risks and vulnerabilities and to improve the cybersecurity capabilities of railways by evaluating their cybersecurity maturity levels and making recommendations for improvements. After assessing various cybersecurity maturity models, the Cybersecurity Capability Maturity Model (C2M2) was selected to assess the cybersecurity capabilities of railway organizations. The contributions of this research are as follows. First, a new maturity level MIL4 (Maturity Indicator Level 4) is introduced in the C2M2 model. Second, the C2M2 model is adapted by adding advanced security analytics and threat intelligence to develop the Railway-Cybersecurity Capability Maturity Model (R-C2M2). The cybersecurity maturity of three railway organizations is evaluated using this model. Third, recommendations and available standards & guidelines are provided to the three railway organizations to improve maturity levels within different domains. In addition, they are given an action plan to implement the recommendations in a streamlined way. The application of this model will allow railway organizations to improve their capability to reduce the impacts of cyber-attacks and eradicate vulnerabilities. The approach can also be extended to other infrastructures with necessary adaptations.
|
|
| 3. |
- Kour, Ravdeep, 1981-
(författare)
-
Cybersecurity in Railway : A Framework for Improvement of Digital Asset Security
- 2020
-
Doktorsavhandling (övrigt vetenskapligt/konstnärligt)abstract
- Digitalisation changes operation and maintenance in railways. Emerging digital technologies facilitate implementation of enhanced eMaintenance solutions through utilisation of distributed computing and artificial intelligence. In railway, the digital technology deployment is expected to improve the railway system’s sustainability, availability, reliability, maintainability, capacity, safety, and security including cybersecurity. In digitalised railway, aspects of cybersecurity are essential in order to achieve overall system dependability. Lack of cybersecurity imposes negative impacts on the railways like reputational damage, heavy costs, service unavailability and risk to the safety of employees and passengers.It has been observed, through open access data, that many railway organizations focus on detective measures of security threats with less emphasis on forecasting of cyber-attacks. In order to prepare in advance for cyberattacks, it is essential that Information and Communication Technology (ICT) and Operational Technology (OT) in railways need to undergo continuous updating towards security analytics approach. This approach will help the railways to produce proactive security measures to cyberattacks. In this work, it has been observed that there exists some standards and guidelines related to cybersecurity in railways (e.g. AS 7770- Rail Cyber Security, APTA SS-CCS-004-16, BS EN 50159:2010+A1:2020). These standards and guidelines are proprietary (i.e. either organization-specific or country-specific) and are followed by most of the railway organizations. These proprietary standards and guidelines lack in providing a holistic approach to enable interoperability, scalability, orchestration, adaptability, and agility for railway’s stakeholders. Therefore, there is a need for a generic cybersecurity framework for digitalized railways to facilitate proactive cybersecurity and threat intelligence sharing within the railways. The proposed framework, i.e., Cybersecurity Information Delivery Framework has been developed by integrating existing models, technologies, and standards to minimize the risks of cyber-attacks in the railways. The framework maps different layers of Open System Architecture for Condition-Based Maintenance (OSA-CBM) in the context of cybersecurity to deliver threat intelligence. The framework implements extended Cyber Kill Chain (CKC) and Industrial Control System (ICS) Kill Chain for detecting cyberattacks. The framework also incorporates proposed Railway Defender Kill Chain (RDKC) that enables proactive cybersecurity. Therefore, the proposed framework enables proactive cybersecurity and shares threat intelligence for improving cybersecurity in railways.
|
|
| 4. |
- Kour, Ravdeep, 1981-, et al.
(författare)
-
Predictive model for multistage cyber-attack simulation
- 2020
-
Ingår i: International Journal of Systems Assurance Engineering and Management. - : Springer. - 0975-6809 .- 0976-4348. ; 11:3, s. 600-613
-
Tidskriftsartikel (refereegranskat)abstract
- Adoption of information and communication technologies (ICT) in railway has improved the reliability, maintainability, operational efficiency, capacity as well as the comfort of passengers. This adoption introduces new vulnerabilities and entry points for hackers to launch attacks. Advanced cybersecurity threats with automated capabilities are increasing in such sectors as finance, health, grid, retail, government, telecommunications, transportation, etc. These cyber threats are also increasing in railways and, therefore, it needs for cybersecurity measures to predict, detect and respond these threats. The cyber kill chain (CKC) model is a widely used model to detect cyber-attacks and it consists of seven stages/chains; breaking the chain at an early stage will help the defender stop the adversary’s malicious actions. Due to lack of real cybersecurity data, this research simulates cyber-attacks to calculate the attack penetration probabilities at each stage of the cyber kill chain model. The objective of this research is to predict cyber-attack penetrations by implementing various security controls using modeling and simulation. This research is an extension of developed railway defender kill chain which provides security controls at each stage of CKC for railway organizations to minimize the risk of cyber threats.
|
|
| 5. |
- Kour, Ravdeep, 1981-, et al.
(författare)
-
Railway Defender Kill Chain to Predict and Detect Cyber-Attacks
- 2020
-
Ingår i: Journal of Cyber Security and Mobility. - : River Publishers. - 2245-1439 .- 2245-4578. ; 9:1, s. 47-90
-
Tidskriftsartikel (refereegranskat)abstract
- Most organizations focus on intrusion prevention technologies, with lessemphasis on prediction and detection. This research looks at prediction anddetection in the railway industry. It uses an extended cyber kill chain (CKC)model and an industrial control system (ICS) cyber kill chain for detectionand proposes predictive technologies that will help railway organizationspredict and recover from cyber-attacks. The extended CKC model consistsof both internal and external cyber kill chain; breaking the chain at anearly stage will help the defender stop the adversary’s malicious actions.This research incorporates an OSA (open system architecture) for railwayswith the railway cybersecurity OSA-CBM (open system architecture forcondition-based maintenance) architecture. The railway cybersecurity OSA-CBM architecture consists of eight layers; cybersecurity information movesfrom the initial level of data acquisition to data processing, data analysis, inci-dent detection, incident assessment, incident prognostics, decision support,and visualization.The main objective of the research is to predict, prevent, detect, andrespond to cyber-attacks early in the CKC by using defensive controls calledthe Railway Defender Kill Chain (RDKC).The contributions of the research are as follows. First, it adapts and mod-ifies the railway cybersecurity OSA-CBM architecture for railways. Second,it adapts the cyber kill chain model for the railway. Third, it introduces theRailway Defender Kill Chain. Fourth, it presents examples of cyber-attackscenarios in the railway system.
|
|
| 6. |
|
|
