New Publication: Exploring Dimensions and Metrics of Cyber-to-physical Impact: A Systematic Review
When a cyberattack reaches a food production facility, wastewater treatment plant, or electricity or water distribution system, what exactly happens?
How are operations, equipment, and people affected? How do we measure those impacts? More importantly, where can we find guidance?
Our latest open-access article in the International Journal of Critical Infrastructure Protection, titled Exploring Dimensions and Metrics of Cyber-to-physical Impact: A Systematic Review, explores these exact questions.
Based on a systematic literature review and grounded theory analysis of model-based studies, this work supports understanding and measuring Cyber-to-physical (C2P) impact in Industrial Control Systems (ICS). It helps researchers and practitioners decide what to measure. which metrics to use, and what those choices entail.
This includes:
- The PERSEOS model of impact analysis, clarifying the nuances of seven interconnected impact dimensions: Physical, Economic, Reputational, Safety, Environmental, Operational, and Societal.
- A categorization of impact metrics across four themes: generalizability, scope, tooling requirements, and measured attributes, explaining their characteristics, utility, and trade-offs.
- Guidance for selecting analysis objectives and navigating key decisions during an impact analysis. We examine the framework against historical ICS security incidents and demonstrate its use through two real-world water and wastewater case studies, alongside data-scarce food production systems.
The goal is to provide a clear and shared vocabulary, alongside the theoretical foundations to support more structured, objective, and informed C2P impact analyses.
See Publications for more details!