In a globally connected world, cybersecurity has become a key issue for the citizen, companies but also operators of essential services such as energy, transportation, drinking water or health. The NIS European Directive requires countries to identify such operators to ensure that adequate cybesecurity measures are in place, that impacting problems are promptly noti ed and that an European cooperation is in place. Our work shows the bene t of a global modelling approach using i* to deploy the directive from understanding the cooperation and duties of all actors/roles through a regulation model, down to its implementation in a speci c domain to support a cybersecurity risk analysis process. Our work is illustrated on the drinking water essential domain.
Our world is increasingly dependent on information processing networks and
systems. Their global interconnection makes them more vulnerable to cyber attack
growing at a fast pace. In addition to protecting the citizens and companies, it
is crucial to the secure critical infrastructures of our society and economy. The
purpose of the Network of Information System directive (NIS) is precisely to
provide a global framework at the European level to secure such infrastructures
through a coordinated approach across member states (MS) [
The main Operator of Essential Services (OES) are energy production, various forms of transport (rail, sea, air, etc.), production and distribution of drinking water and hospitals. It is important to ensure that such operators have rm cybersecurity commitments in order to prevent and react to any attempt to attack their networks and systems. As OESs depend on Digital Service Providers (DSPs), e.g. for hosting data or services, those must also be adequately secured. In addition, the emergence of industry 4.0 is increasing risks due to the mix of information technologies (IT) and operation technologies (OT), e.g. through exposing industrial SCADA control systems with few intrinsic protection.
The NIS directive has de ned a clear set of objectives: 1. monitoring of critical sectors by identifying OESs and making sure they have protective and noti cation measures against cybersecurity attacks. Copyright © 2020 for this paper by its authors. Use permitted under Creative Commons License Attribution 4.0 International (CC BY 4.0). 2. creation of a regulatory framework strengthening the cybersecurity of DSPs. 3. development of national cybersecurity capacities, through one or more Computer Security Incident Response Team (CISRT, aka CERT). 4. cross-border cooperation between EU countries.
Unlike the General Data Protection Regulation (GDPR), the NIS is not a European regulation but a directive transposed at the national level in each of the MS. This process requires to set up a complex network of actors at di erent levels: EU level for cooperation between MS, setup of national contact points and CSIRT and, last but not least, the organisation of each OES domain.
The aim of this paper is to show the bene ts of a modelling approach able to
cope with organisational and prescriptive concepts in the NIS deployment. Di
erent goal modelling approaches developed in the Requirements Engineering (RE)
eld can be considered, e.g. i* [
This paper is structured as follows. First, Section 2 provides a global NIS model through Strategic Dependencies across involved actors and their Strategic Rationales to understand their motivations to engage and collaborate. Then, Section 3 details a risk-oriented approach to address speci c OES threats using the water domain as case. Section 4 discusses the resulting model in the light of related work before concluding and identifying future work in Section 5. 2
Modelling regulatory texts is the rst step in a broader process to ensure compliance. Other logical steps are veri cation, analysis and enforcement. The resulting model has a number of bene ts over legal texts: it enables a better understanding through graphical notations which are easier to navigate and decode than long and very formal legal documents in text format. In the NIS case, it is very important to make sure all actors understand their role, responsibilities and interactions with other actors, especially given the large scope covering many countries and domains.
In order to provide a global vision of the NIS, Figure 1 depicts the Strategic Dependency (SD) graph gathering all agents (EU, CSIRT Network, ENISA,...) and roles (MS, OES,...). It re ects the hierarchical structure from EU level to national level and then sector speci c management for OESs/DSPs through the use of "participates in" links. Various types of OESs are modelled through "IsA" links. Complementary actors with speci c roles are also associated through dependencies: the national cybersecurity agency is taking responsibility for the cybersecurity management at national level and OESs depend for being granted compliance. CSIRTs depend on OESs for noti cation and can provide support in return. They can themselves call for assistance from the ENISA and take part in the CSIRT EU network together with the CERT-EU. This diagram immediately reveals that the directive relies on a delegation of speci c goals and tasks from the EU level to MS and nally to OESs/DSPs. This global interaction structure is far less easy to catch when reading of the 30 pages legal text.
To illustrate the instantiation in a concrete domain, we use a drinking water utility for its lesser complexity and maturity than other elds such as transport or energy. It requires a substantial infrastructure from water supply, treatment, Fig. 2. Strategic Rationale diagram for the NIS directive
. storage to nally reach consumers through a distribution network. The global chain is controlled by two OESs: the supplier and the distributor. The SR diagram in Figure 3 details how each actor is achieving its goals with milestones.
i* can be used in this part to perform the security risk assessment using
some extensions depicted in Figure 3: an attacker agent is introduced with its
motivations captured as (anti-)goals. An attack link is expressed using
dependencies linking anti-goals to concrete actionable goals inside the attacked actor
to break its goals. For re ecting the negative thinking, all attack concepts are
coloured in red. This extension could be achieved through a minor relaxation of
i* 2.0 rules inside the piStar tool used in this paper [
We cross-checked the risks inferred in our model with known attacks on water
infrastructures [
Considering the security risk analysis, others frameworks can be used, either
generic RE (e.g. KAOS) or more specialised languages (e.g. attack trees [
On the practical side, our model is very complementary to the long legal text through the use of pointers from the model to speci c NIS articles. The tagging process revealed quite easy and text coverage was used to check for completeness or missing aspects to be discussed with domain actors. 5
In this paper, we demonstrated how i* can be used for modelling the NIS
directive and to support a domain speci c risk analysis. The comparison with
other frameworks such as KAOS revealed interesting bene ts. As future work,
we would like to validate various modelling approaches with OESs during the
next NIS workshops planned in Belgium. We will also deepen our analysis of
other essential domains and experiment with tooling to better support the
integration of models and legal documents (e.g. through URL support). We also
plan to align our approach with other security and risk-oriented i* extensions
[