Information and communication technologies (ICT) implementation in various industries, on the one hand, increases the efficiency of different business processes and, on the other hand, generates new threats and vulnerabilities in ICT. Critical infrastructures (CI) need principal new effective methods and means for cybersecurity ensuring. In the situation with limited resources, CI objects defining and ranking is an important task. To rank objectively, CI objects should be assessed using some criteria. Previously, authors have proposed a FMECA-based method to assess importance level (disasters criticality) for state critical information infrastructure, which allows ranking and evaluating the importance of CI objects using both quantitative and qualitative parameters. This paper presents a complex experimental study of the proposed method using the aviation industry as an example. An experimental technique was introduced and using it, the adequacy of method response to changing input data was checked. It confirmed the possibility of disaster criticality and importance level assessment of critical aviation information systems related to various categories: information systems for air navigation services; on-board information systems for aircraft; information systems for airlines and airports.
Information and communication technologies (ICT) rapid development has led to
significant and sometimes revolutionary changes in all spheres of people’s lives in
most states of the world. This has significantly increased the vulnerability of various
networks, systems and ICT objects and has made it difficult to ensure their protection
Copyright © 2020 for this paper by its authors. This volume and its papers are published under
the Creative Commons License Attribution 4.0 International (CC BY 4.0).
and security. All these factors have caused the world's leading states to pay significant
attention to the protection of critical facilities, systems and resources, as well as to the
identifying critical infrastructures (CI) [
Related papers analysis and problem statement
Increasing concentration of means and resources for protecting CI of different types
necessitated the ranking of CI objects, the selection of the most important ones and
the emergence of the CI concept [
In the study [
The main results of the implementation of the proposed method are presented in the form of a report, which summarizes such information as: a list of system components, their functions, types of interruptions for each component of the system; information on the causes and consequences of interruptions for each component of the system; calculations of criticality rankings, ranking results are a list of the most significant (critical) interruptions of work, which are displayed in a formalized and convenient for experts form. Other output data was obtained at different stages of the method implementation: criticality matrix, which according to the collected preliminary data graphically reflects the criticality of the system components (stage 7); Pareto diagram which shows the level of criticality inside the system and makes it possible to compare several different systems (stage 9); Ishikawa's cause and effect diagram that allows to identify priority areas for developing appropriate corrective measures (stage 10).
The main purpose of this work is experimental study of method for importance
level assessing of the CII objects in aviation (CAIS) based on criticality analysis of
systems (subsystems) disaster risks. This method was proposed by authors before [
Let`s consider in detail step by step of implementation of the proposed method study.
One CAIS from each of the categories defined in [
Stage 1. Identifying system components and setting the level of detail
Step 1.1-1.2 The sets of CAIS classes and systems according to [
Step 1.3. To determine subsystem sets, we arbitrarily select one set of systems from
each class, for example SSOD , SSSPZ , SGDS and according to (3) in [
Step 1.4. To determine the set of components, we arbitrarily select one subsystem from each set of subsystems, for example SSOAD , STCAS , SAMDS .
For system SSOAD , with b = 7 , while using (4) in [
7 ={ Ci } i=1 ={C1,C2 ,..., C7 }
={СODSS , СОPD , СMKS , СZVI , СKGZ , СPPR , СZBP } , where C1 = СODSS is data processing of the surveillance system; C2 = СОPD is flight data processing; C3 = СMKS is system monitoring and control; C4 = СZVI is recording and reproduction of information; C5 = СKGZ is commutation of voice communication; C6 = СPPR is decision support; C7 = СZBP is ensuring the safety of flights.
Similarly for systems STCAS according to [
Step 1.5. Let us set the minimum level of detail Detmin to describe and decompose the system. The purpose of the analysis Sij / Sijk is to determine the level of criticality of possible types of components interruptions that cause loss of their functionality, to find out their causes, consequences, methods of detection and recommendations for reducing their criticality.
Therefore, the description and decomposition are limited by level “system class” / “system” / “subsystem” / “component” (Si / Sij / Sijk / Ci ) and concern only the effects of possible interruptions of certain components Ci . Meaning that Detmin = Ci , however, a more detailed study of the more complex components (subsystems) of CAIS may consider the case of Detmin = Cij , where Cij are parts of components Ci ( Detmin = Sij ∨ Sijk ∨ Ci / Cij ) etc.
The selected systems are limited by level
SІSАО / SSOD / SSOАD / CSOАD ; SBSPS / SSSPZ / STCAS / СTCAS ; SІSАА / SGDS / SAMDS / CAMDS і and concern only the effects of possible interruptions of certain components Ci .
Stage 2. Defining the functions of each detected system component. For system
SSOАD , containing a set of components CSOАD , with l = 15 , while using (5) in [
Similarly for systems STCAS according to [
Stage 3. Determining the list of possible disasters for each system component.
For system SSOАD set of components CSOАD , with p = 9 , while using (6) in [
9
DSOАD = { Di } = {D1, D2 ,..., D9} = {DVNIS , DNOPS , DPFOD , DPNI , DVZZ , DNSD , DVRTZ , DVPKS , DVAF},
i=1
where D1 = DVNIS is detecting a nonexistent signal; D2 = DNOPS is incorrect
estimation of signal parameters; D3 = DPFOD is data processing and distribution
breaches; D4 = DPNI is suspension of receipt of information on flights of aircraft;
D5 = DVZZ is loss or destruction of a recording device; D6 = DNSD is unauthorized
access to the recording device; D7 = DVRTZ is loss of radio or telephone
communication with crews, related dispatch points and other traffic participants;
D8 = DVPKS is the occurrence of potential conflict situations of the PCC; D9 = DVAF is
detection of an emergency factor [
Similarly for systems STCAS according to [
D22 = DNNI is unreliability of the information provided; D23 = DNIMP is failure to provide landing information (only schedule is displayed, regardless of availability); D24 = DVMPK is the inability to buy a ticket unless the airline has an agreement to sell with Amadeus; D25 = DNZD is inability to find airline information to alert you to potential threats or to obtain necessary information.
Stage 4. Determining the consequences of each possible disasters. For each
possible work interruption (disaster) of the set DSOАD with q = 10 , while using (7) in
[
E1 = ENPR is wrong decision-making, due to incorrect analysis of the air
situation; E2 = EPRSY is malfunction of control systems, power supply, communication,
piloting, lack of fuel, interruptions in the life support of the crew and passengers, failure
of engines, destruction of individual aircraft structures; E3 = EVVPS is lack of ability to
track aircraft; E4 = EVRLP is loss of opportunity to investigate a flight incident FI;
E5 = ENODD is inability to evaluate the actions of the operator; E6 = EVRTZ is no radio
or telephone connection; E7 = EPRVZ is violation of recommendations on solving the
collision threat; E8 = EVNM is choosing the wrong maneuver; E9 = EZPS are aircraft
collisions; E10 = EPRS is malfunction of control systems, power supply, communication,
piloting, lack of fuel, interruptions in the life support of the crew and passengers, failure
of engines, destruction of individual aircraft structures [
Similarly, for each possible work interruption of sets DTCAS according to [
is inability to use the control panel accordingly; E14 = ENRS is system inability to work in real time; E15 = EVIA is lack of information on airlines; E16 = ENOOI is inability to get online flight booking information; E17 = EMZGP is a possible malfunction in the flight schedule or the need to reformat it; E18 = EVPZD are problems with refueling, the possibility of a collision threat; E19 = ENSP is lack of awareness of employees, which could lead to the wrong decision.
Stage 5. Identifying signs of work interruption detection. For possible work
interruptions DSOАD , while using (8)-(9) in [
4
={ Oi }
i=1
={O1, O2 ,..., O4}
={OVSI , OTIM , OAUS , OSCH } ,
(3)
where O1 = OVSI is VSI/TRA display; O2 = OTIM is Timetable (general schedule
screen); O3 = OAUS is Amadeus Access Update/Amadeus Access Sell; O4 = OSCH is
Schedule (schedule screen). Taking into account (9) in [
Stage 6. Identifying ways of detecting work interruptions. For each possible work
interruption of the set DSOАD according to [
Stage 7. Construction of a three-dimensional criticality matrix. For the system SSOАD we form a criticality table according to such parameters as “probability – weight – number of interruptions of system operation” and construct a three-dimensional criticality matrix (Fig. 1 a). Similarly, for systems STCAS and SAMDS we form a criticality table and construct a three-dimensional matrix (Fig. 1 b and Fig. 1 c, respectively). a) b) c)
Fig. 1. Three-dimensional criticality matrix for SSOАD (a), STCAS (b) and SAMDS (c) Stage 8. Calculation of the criticality rank of probable disasters
Step 8.1-8.3. For the SSOАD system, work interruptions D1 = DVNIS , let’s define an
indicator B1 j , B2 j , B3 j as (13)-(15) in [
Stage 8.4. Calculation of values for the weighting coefficients of work interruption consequences. Mentioned coefficients are introduced according to [18].
Step 8.4.1. For example, for the weighting coefficients of work interruption
consequences according to [18], having n = 7 considering (16) in [
7 VK = { VKi} = {VK1, VK2,..., VK7} = {VKKZG , VKEKON , VKVNNS, VKPOLN , VKMZT , VKTRV , VKVSKI}, (5) i=1 where VK1 = VK KZG is number of citizens involved (health and social consequences); VK 2 = VK EKON is economic effect; VK3 = VK VNNS is impact on the environment; VK4 = VKPOLN is political implications; VK5 = VKMZT is territorial reach; VK6 = VKTRV is duration; VK7 = VKVSKI is interdependence of sectors CI (the consequence of the destruction of one is the destruction of the others) according to [18].
It also should be noted that, criteria of weighting coefficients of work interruption consequences are placed from most important – “7” to least important – “1”.
Step 8.4.2. For example, if n = 1, m1 = 5 using (17) in [
5 VK1 = VKKZG = {VK1j} = {VK1.1,VK1.2,VK1.3,VK1.4,VK1.5} = {VK0−5,VK6−20,VKD100,VKD499,VKB500}, j=1 where VK1.1 = VK0−5 is 0-5 deceased; VK1.2 = VK6−20 is 6-20 deceased; VK1.3 = VKD100 is 21-100 deceased; VK1.4 = VKD499 is 101-499 deceased; VK1.5 = VKВ500 is ≥ 500 according to [18].
Similarly, for sets of coefficients
VK 2 , VK 2 ,..., VK7 , if n = 2, 7 and
m2 = m3 =m4 =m5 =5 accordingly, using (17) in [
are rallies, protests; VK4.4 = VKMASZ are riots; VK4.5 = VKREV are revolutions, wars; VK5.1 = VKOBYD is separate building; VK5.2 = VKSEL is village; VK5.3 = VKRGN is district, city; VK5.4 = VKOBL is region; VK5.5 = VKDER is country; VK6.1 = VKDGOD is less than an hour; VK6.2 = VKDOBA is day; VK6.3 = VK3DOB are 3 days; VK6.4 = VK5DOB are 5 days; VK6.5 = VK10DIB are 10 days; VK7.1 = VKMVID is almost no; VK7.2 = VKNVR are causes no destruction; VK7.3 = VKVR1S are causes destruction of one sector; VK7.4 = VKVR2S are causes destruction of two sectors; VK7.5 = VKVR3S are causes destruction of three and more sectors [18].
Step 8.4.3. For the SSOАD system, work interruptions D1 = DVNIS , indicator B3 = 7,
and value of weighting coefficient as (19) in [
Stage 9. Selection of the list of the most significant (critical) disasters. For the
SSOАD system, work interruptions D1 = DVNIS , calculated interruptions criticality rank
R = 5 ⋅ 4 ⋅ 5 = 100 , according to the criticality determination rule (20) in [
a) b) c)
Fig. 2. Calculation results of Ri for SSOАD (a), STCAS (b) and SAMDS (c)
The diagram is created separately for each Sij (to rank the most significant (critical) Di ,
hence Di are placed on the horizontal axis, and calculated values Ri are ont the vertical
axis (like (12) in [
Stage 10. Forming a list of corrective measures. To make a a list of corrective measures for SSOАD , STCAS and SAMDS systems let’s create Ishikawa cause and effect diagrams [17, 19] (Fig. 3), that graphically reflect the characteristics that cause work interruptions Di and increase the effectiveness of corrective measures development. a) b) c) Ishikawa cause and effect diagrams for selected systems has devided all identified Di by the main causes of their occurrence, namely due to errors of: users (а), software (b), hardware (c), network technologies (d). Therefore, priority areas for developing corrective measures for SSOАD and SAMDS systems are elimination of software errors causes and user errors (b and а on Fig. 3 a and Fig. 3 c), for STCAS system – elimination of hardware and software related causes (b and c on Fig. 3 b).
Whereafter for every possible work interruption of SSOАD , STCAS and SAMDS
systems, if g =3, g =2, g =1 accordingly, using (21) in [
6 K = { Ki } = {K1, K2 ,..., K6} = {KPONA , KOROB , KOKPD , KZRTO , KPOBR , KVOAA } , i=1 (6) where K1 = KPONA is directional antenna inspection and repair; K2 = KOROB is inspection and repair of system’s computer unit, K3 = KOKPD are scheduled review and repair of data transmission channels; K4 = KZRTO is change of maintenance and repair regulations; K5 = KPOBR is scheduled review of flight recorders; K6 = KVOAA are Amadeus AIR components update as scheduled.
The list of necessary corrective measures for SSOАD , STCAS and SAMDS systems, is
presented in [
Stage 11 – Report generation. At this stage, data obtained in the previous stages is systematized, visualization of qualitative and calculation of quantitative values of CAIS criticality is carried out. An example of report creation for SSOАD , STCAS and SAMDS systems is presented in Table 1.
Novelty of the paper defines by proposed improvements of the FMECA technique (settheoretical approach, criticality matrix, Pareto diagram, Ishikawa's cause and effect diagram etc.). The practical values of this study define by verification of the ability of different CAIS assessment and potential efficiency to assess criticality of infrastructures in different industries. С11 С12 С13 С14 С15 С16 F19 F20 F21 F22 F23 F24 … F29 F30 F31 F32 F33 D13 D14 D15 D16 D17 D18 D19 D20 D21 D22 D23 D24 D25 E14 E15 E16 E17 E18 E19 W8 W8 W8 W8 W8 W8 W9 W9 W9 W9 W9 W9 W9 3 3 3 4 2 2 3 3 5 4 5 4 6 7 6 7 6 7 4 7 5 6 6 6 6 6 7 7 6 6 7 6 6 3 4 6 4 4 4 126 126 126 144 98 48 126 45 120 144 120 96 144 4
In this paper experimental study of proposed by authors FMECA-based method for importance level assessing of the CII objects in aviation based on criticality analysis of systems (subsystems) disaster risks was carried out. It was selected three CAIS from different categories (air navigation systems, aircraft on-board information systems as well (aeronautical information processing and as airlines and airports systems): SSOАD transmission system), STCAS (onboard collision avoidance system, TCAS) and SAMDS (Amadeus system).
Three-dimensional criticality matrix as well as Pareto bar charts shows that STCAS system is the most critical among selected CAIS (5 critical disasters and 3 critical components). Ishikawa cause and effect diagrams shows that priority areas for developing corrective measures for SSOАD and SAMDS systems are elimination of software errors causes and user errors, but for STCAS system – elimination of hardware and software related causes.
In the future research study it is planned to develop software that, based on the proposed method, will allow to conduct an experimental research and confirm the possibility of determining the importance of different categories of CAIS as well as to assess infrastructure risks in different industries (power energy, communications etc). 17. Kharchenko V., Andrashov A., Sklyar V., Kovalenko A., Siora O. Gap-and-IMECA-based assessment of I&C systems cyber security, Advances in Intelligent and Soft Computing, vol. 170, pp.149-164, 2012. 18. Report on Research Project “Infrastructure”, State Scientific and Research Institute of
Cybersecurity Technologies and Information Protection, №0114U000038d (Restricted). 19. Т. Yeliseeva, “Analysis of the security for electric isolation valve by AVPKO method”,
Izvestia TulGU, Technical Sciences, issue 5, pp. 182-186, 2013 (in Russian). 20. Gnatyuk S., Sydorenko V., Polozhentsev A., Fesenko A., Akatayev N., Zhilkishbayeva G., Method of cybersecurity level determining for the critical information infrastructure of the state, CEUR Workshop Proceedings, vol. 2616, pp. 332-341, 2020.