Cybersecurity of critical infrastructures: Challenges and future perspectives

The article analyzes the existing legal mechanisms for managing critical information infrastructure in Ukraine. The instruments for their improvement are proposing in this article. An important component of critical infrastructure is its information component – a critical information infrastructure. The sphere of protection of critical information infrastructure in Ukraine is at the initial stage of formation. The current legislation defines only certain objects of socio-economic sphere, in which extraordinary events can lead to socially dangerous consequences. In view of the fact, that the term “critical information infrastructure” does not having a consistent interpretation in different countries, we propose our opinion. “Critical information infrastructure is a system of information management of critical facilities and information and communication networks that provide defense capabilities and security of public and private institutions, whose operation may flow to the national security of Ukraine” (KII). In the KII we can identified information and network components. Information environment of KII is a system for information management of critical objects, including computing and information resources that form automated control systems (ACS). The network component of KII consists of a set of telecommunication devices, communication lines and network equipment, systems of open protocols for the exchange of information between elecommunication devices, global system of digital addresses and digital identifiers, software. The Internet network can be considered as a technological add-on over a telecommunication network that provides the provision of data transmission and processing services (e-mail, teleconferencing, file transfer, access to computing and information systems in local area networks). The main threat to the safety of ACS of critical information infrastructure objects is targeted actions on information systems, information and telecommunication networks by software and hardware. KII legal security include two main components – national and international. The national component may be forming by a set of principles, legal institutions and norms, which are enshrined in the national legislation regulating public relations in Ukraine in the area of counteracting the security threats of the ACS of critical objects. In order to protect the most important objects of KII, it is necessary to identify these objects. The current legislation defines such categories of objects, for which special conditions for ensuring their protection and functioning are established. Some of them, in whole or in part, may be classifying as objects of critical infrastructure. The specificity of providing information security was reflecting in such Ukraine laws like “On the Fundamentals of National Security of Ukraine”, “On the Concept of the National Program of Informatization”, “On the National Program of Informatization”. As well as the Concept of Development of the Security and Defense Sector of Ukraine, the National Security Strategy of Ukraine, the Strategy of Cybersecurity Of Ukraine. The National Security Strategy identifies actual threats to national security and sets priorities for information security, cyber security and security of information resources and critical infrastructure. At the same time, the implementation of the state policy in the field of security of KII requires the further development of legal principles and norms governing the relevant social relations, that is, the national component of the legal security of KII. Ukraine should ensure the establishment of a nationwide system for assessing risks and threats to critical infrastructure, and after the legislative definition of the main terms, the implementation of the Identification of Critical Information Infrastructure objects. Identification of objects of critical information infrastructure can be accomplishing by introducing the certification of objects of critical information infrastructure. Such passports must contain general data about the facility, data on the main sources of danger, data on hazardous natural conditions, technological processes and response to threats. The international component of the legal security of KII provides for the regulation of a set of principles and norms defined by international treaties and recognized by the state, regulating issues of international cooperation in this area. Ukraine has signed the Convention on Cybercrime together with the member states of the Council of Europe and other States. It is aiming at stopping actions against the confidentiality, integrity and availability of computer systems, networks and computer data, as well as abusing such systems, networks and data by installing the criminal responsibility for such behavior, the provision of powers sufficient to combat criminal offenses, and the conclusion of agreements on rapid and reliable international cooperation. In addition, the plan of measures for 2017 on implementation of the Cybersecurity Strategy of Ukraine provides for the implementation of Directive 2008/114/EC on the protection of critical infrastructure, in particular on cybersecurity and cyber defense of critical infrastructure objects. Development of the system of international information security, the following main groups of international relations that requirenormative legal regulation within the framework of the legal security of KII: definition of the boundaries of the national KII in the global information and communication infrastructure and fixing signs of computer incidents in the control system of critical objects information infrastructure. The absence of generally recognized borders of state sovereignty of States in this space is a significant obstacle to the application of international law to the actions of other states. In particular, this impedes the establishment of limits of responsibility of states for violating the security of the KII and organizing international cooperation in the field of countering computer crime. The urgency of the legislative consolidation of signs of computer incidents in the automated control system of critical information infrastructure objects suggests the widespread use of the concept of “incident” in international law. An incident in cyberspace usually associated with a violation of the functioning of the components of cyberspace – an electronic collection environment and automated processing of information that determines the processes of the implementation of these operations, as well as information systems and automated control systems. The essence of the general definition of the “international incident” in the field of KII will be determining, firstly, by the nature of international relations between states that are violating by the “incident”. This event may be the result of unforeseen actions of the state, including actions that harm the interests of public bodies of one or more states, or, conversely, be one of many intentional but minor provocations carried out by agents of one state against another state. Given that international relations in the field of incidents in the field of KII are not regulating by international treaties, the main and, in fact, the only source of international law in this case serves as an international custom, however, its application to the sphere of KII is accompanying by considerable difficulties. For Ukraine, it is possible to introduce the positive experience of other states in the security of the KII. In particular, the problem of security of information technologies has been enshrined in the international standard ISO / IEC 15408 “General criteria for assessing the safety of information technology”.

The present study explores contemporary approaches to the analysis, modelling and assurance of cyber security of critical information infrastructure in the face of modern threats. This text focuses on the utilisation of intelligent methods and advanced technologies for the protection of critical information infrastructure (CII). The objective of the present study is to employ an integrative approach to analysing, modelling, and ensuring the cyber security of CII in the face of contemporary threats. The methodological foundation of the study is a comprehensive analysis of scientific literature dedicated to the application of intelligent methods and technologies for the protection of CII. This includes both fundamental theoretical developments and practical aspects of implementing modern cyber security approaches, as well as experimental modelling of fraud detection processes in the CII of the financial sector. This modelling was conducted by the authors using artificial intelligence (AI) methods. A comparative analysis of concepts proposed by modern researchers is given particular emphasis, with the objective of identifying the main trends, development prospects, and potential areas for improving existing CII protection systems. In relation to the outcomes of the extension of scientific sources, it was determined that intelligent methodologies founded on machine learning and AI represent pivotal technologies for the effective safeguarding of critical infrastructure within the financial sector against contemporary cyberattacks and security threats. The results of the modelling of fraud detection processes in the CII of the financial sector of the economy allow an assessment of the effectiveness of the methods used, determination of their advantages and limitations, and formulation of recommendations for further improvement of cyber protection systems for the CII of the financial sector of the economy. The employment of an integrative approach, encompassing threat analysis, simulation modelling, artificial intelligence, and contemporary cyber defence technologies, facilitates the enhancement of the security of critical infrastructure and the effective response to emergent threats. The proposed solutions have the potential to facilitate the development of highly effective cyber defence systems in various critical infrastructure industries, including the financial, energy, and government sectors.

Since the Internet of Things (IoT) will be entwined with everything we use in our daily life, the consequence of security flaws escalates. Smart objects will govern most of the home appliances and car engines yielding potential disaster scenarios. In this context, successful attacks could lead to chaos and scary scenarios (www.darkreading.com). Unprotected personal information may expose sensitive and embarrassing data to the public and attacks may threaten not only our computers and smart devices, but our intimacy and perhaps our lives too. Because persons and objects will be bonded with each other, user consent becomes critical. Therefore, thing, object, and user Identity will be the focus of future IoT security solutions, yielding a Trust, Security, and Privacy (TSP) paradigm, which may constitute the Achilles' heel of IoT. While security issues are quite straightforward, mainly from background knowledge, privacy issues are far more complex. Privacy constitutes a rather challenging task, even for the m...

In this invited talk, we argue that designing cyber security of critical infrastructure requires a spilt-personality approach to design as opposed to design for correctness or for performance. Designing a functionally correct system, or a performance constrained system is fundamentally different in the sense that such design requires us to build models and to systematically refine models towards implementation such that correctness is preserved between refinements, and performance optimizations are introduced during refinements. Designing systems with cyber-security properties requires us to not only build models from theoretical principles, but also require modeling possible behaviors of an adversary. Modeling adversarial behavior is akin to test-driven model refinement, and hence not so different from certain approaches used when our goal is functionally correct design. However, for cyber-physical systems, we often need to detect an ongoing cyber attack since safe guards for cyber security often depend on assumptions which can be invalidated (e.g., insider attacks may invalidate perimeter security assumptions). Detecting ongoing attacks requires detecting behavioral anomalies in the physical system under cyber control – thus requiring us to build models from data. Machine learning approaches could be used to build such models. This we view as a schizoid approach – since the designer has to not only model the system from physical principles, he/she also has to build nominal behavioral models from data. While arguing this point of view, we introduce a virtual SCADA (supervisory control and data acquisition) laboratory we have built to help design cyber security of critical systems. The majority of this talk focuses on describing this software based virtual laboratory called VSCADA. Most of this research is published in [8,11] and summarized here for the sake of exposition to the present audience.KeywordsCritical InfrastructureHuman Machine InterfaceSchedule AgentModel Drive EngineeringEnergy Society GeneralThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

In current years, Internet of Things (IoT) has come a long way and is well emerged within many organizations and fields covering the sector of healthcare. Continuously, encompassing of the Internet of Medical Things (IoMT) in the field of the medical sector helps in the rise of medical data and analysis of that. Smart healthcare plays important role in human life and various research projects are running on it. It consists of diverse ingredients like wireless communication technology, cloud computing, edge computing, medical sensors, artificial intelligence (AI), IoMT, and IoT. The chapter introduces IoMT with respect to the multiple challenges like privacy, security and low-power operation faced while incorporating IoT with healthcare sector. For emergency treatment, a cloud-based healthcare framework provides a platform to support patients over internet communication by medical experts. Privacy and security to the medical records are on higher priority due to the very sensitive nature of the content. Moreover, a comprehensive survey on IoMT-based cloud and edge-intelligent healthcare system is also described. The current advancement in the field of IoT, IoMT, cloud computing, and AI related to privacy and security, some pathways for forthcoming work in collaboration of healthcare sector and IoT based on a collection of challenges and open issues are also addressed.

As critical infrastructures become more complex, sophisticated and digitally interconnected they are also more susceptible to cyber and physical security attacks. In order to mitigate the risks of such attacks, there is a need for securing them in an integrated way, which considers the simultaneous protection of their cyber and physical assets. In this paper we introduce a BigData platform that implements an integrated approach to securing and protecting critical infrastructures for the financial sector, by treating them as large scale cyber-physical systems. The main building blocks of the platform include an integrated security model that covers cyber and physical assets, an architecture for security monitoring and control based on appropriate probes, as well as a range of data analytics algorithms for detecting risks, vulnerabilities and threats. These building blocks are outlined in the paper, along with their deployment and use in a number of representative critical infrastructure protection use cases for the financial sector. One of the merits of our work is its reference character i.e. it can serve as a blueprint for developing and deploying systems for integrated cyber/physical security in various application areas.

Cognitive computing is the development of computerized models to mimic human behavior. The best examples are virtual assistants such as Siri, Alexa, Cortana, etc. Cognitive computing and AI play a big role in solving problems and building applications to support several domains in Internet of Things (IoT). The downside to AI and cognitive computing is the complexity of the architecture involved in building models that supports IoT. Toward the late 1960s, researchers came up with a technology called cloud computing that allowed individuals and organizations to make use of services provided by the cloud to solve problems. This meant that one no longer needed to worry about the software and hardware components required to develop intelligent models. Although cloud computing has been able to solve most complexity issues, it has several drawbacks of its own – latency, privacy, security, reliability, etc. Domains like healthcare rely on intelligent models to make important time-sensitive decisions and cannot wait for data to be shipped all the way to the cloud to get results. The need for quick and real-time results is what probed researchers to develop Edge Intelligence or Cognitive Computing at the Edge with IoT application services. Edge Intelligence is the deployment of intelligent computerized models close to the data source – on the edge node of an IoT network or very near to the network edge. This chapter highlights and examines the principles, architecture, challenges, applications, and existing industrial implementations of Edge Intelligence.

Purpose– Cloud Computing (CC) technology is getting implemented rapidly in the educational sector to improve learning, research and other administrative process. As evident from the literature review, most of these implementations are happening in the western countries such as USA, UK, while the level of implementation of CC in developing countries such as India is rare. Moreover, implementing CC technology in the educational sector require various decisions to be made by the managers of the Information Technology (IT) department such as selecting suitable deployment model, vendor providing cloud service, etc. in their respective university or institute. The purpose of this paper is to attempt to address one such decision. Since, different types of CC deployment are available; selecting a suitable one plays a key role, as it might have an impact on the requirements of various stakeholders such as students, teachers, administrative staff (especially the staff members in the IT department), etc. apart from affecting the overall performance of the facilities such as a laboratory. Naturally, a proper decision by analysing multiple perspectives has to be made while carrying out such strategic initiatives by any educational institute.Design/methodology/approach– A case study methodology has been chosen as the research methodology to discuss and demonstrate the above decision problem that was faced in real time by one of the educational institutes in India, offering high-quality management education. The IT managers of this institute were planning to switch over to CC technology for the computer laboratory and they have to make a decision of choosing suitable alternative CC deployment models such as private cloud (PRC), public cloud (PUC), community cloud (COC), hybrid cloud (HYC), etc. by analysing and comparing them based on various factors and perspectives such as elasticity, availability, scalability, etc. Since, multiple factors are involved in making such a strategic decision, the most commonly used Multi-Criteria Decision Making (MCDM) model – namely, the Analytic Hierarchy Process (AHP) is used as a decision support during the decision making process.Findings– The team of decision makers, who were planning to implement CC in the case institute, found that PRC is best as they believed that it would provide adequate cost savings, apart from providing necessary security to maintain confidential information such as student's detail, grades, etc.Research limitations/implications– The results obtained are based on a single case study. Hence, they cannot be generalized for institutions across educational sector. However, the decision making situation and understanding its impact on the stakeholders of the educational institute can be common across various educational institute.Practical implications– Using a real-life case study of an educational institute, this paper presented a strategic decision making situation, which needs to be considered by the IT managers of the educational institutes when they decide to switch over to CC technology. Various criteria to be considered during the decision making process was identified from the literature review were identified and enumerated. These factors would useful for the IT managers of the different educational institute and they can suitably add or delete these decision criteria as per their requirements and situation at hand. Moreover, the algorithm of AHP, which was used as a decision support, was presented in a step-by-step manner, which should be beneficial for the practitioners to apply the same for similar decision making situations.Originality/value– It is believed that this paper would be the first to report on a strategic decision of choosing the deployment model for CC technology especially in the educational sector. Similarly, this paper would also contribute to the field of CC, as it lists out the decision criteria that are to be considered for making the above decision, which has not got adequate importance. Lastly, this paper is also unique in the realm of AHP because application for a decision problem in the field of CC especially in the educational sector is least reported.

Securing massive IoT in 6G: Recent solutions, architectures, future directions

This study aims to describe and assess the impact of critical infrastructure (CI) cybersecurity issues on the sustainable development of smart cities. This study highlights the integration of PayTech systems into the broader CI landscape, highlighting their impact on maintaining economic stability and ensuring the smooth operation of city services. Key companies within smart regions, particularly those operating in the payment industries, are essential to maintaining the functionality of critical services. These companies facilitate the processing of services provided to citizens, enabling access to vital municipal services. As key players in the PayTech and online e-commerce sectors, they form a crucial part of modern critical infrastructure, operating within an ever-evolving digital environment. This study examines the recovery processes employed after cyberattacks, focusing on the differing perspectives of internal and external professionals. It identifies significant differences in the perceptions of recovery strategies among internal stakeholders, such as investor relations (IR) teams, reputation management (RM) experts, and Chief Information Security Officers (CISOs), who represent critical infrastructure companies. Additionally, it explores the roles of external auditors, who provide impartial emergency support and perform specialized recovery tasks. Importantly, this study underscores the current attitudes toward future information security strategies and their influence on the financial recovery and reputation of reliable companies following cyber incidents. This research contributes to the existing knowledge by shedding light on the perspectives of both a company’s internal and external specialists involved in the recovery process and cyber resilience strategies in critical infrastructure sectors.

In recent days, advancements in the Internet of Things (IoT) and cloud computing (CC) technologies have emerged in different application areas, particularly healthcare. The use of IoT devices in healthcare sector often generates large amount of data and also spent maximum energy for data transmission to the cloud server. Therefore, energy efficient clustering mechanism is needed to effectively reduce the energy consumption of IoT devices. At the same time, the advent of deep learning (DL) models helps to analyze the healthcare data in the cloud server for decision making. With this motivation, this paper presents an intelligent disease diagnosis model for energy aware cluster based IoT healthcare systems, called IDDM-EAC technique. The proposed IDDM-EAC technique involves a 3-stage process namely data acquisition, clustering, and disease diagnosis. In addition, the IDDM-EAC technique derives a chicken swarm optimization based energy aware clustering (CSOEAC) technique to group the IoT devices into clusters and select cluster heads (CHs). Moreover, a new coyote optimization algorithm (COA) with deep belief network (DBN), called COA-DBN technique is employed for the disease diagnostic process. The COA-DBN technique involves the design of hyperparameter optimizer using COA to optimally adjust the parameters involved in the DBN model. In order to inspect the betterment of the IDDM-EAC technique, a wide range of experiments were carried out using real time data from IoT devices and benchmark data from UCI repository. The experimental results demonstrate the promising performance with the minimal total energy consumption of 63% whereas the EEPSOC, ABC, GWO, and ACO algorithms have showcased a higher total energy consumption of 69%, 78%, 83%, and 84% correspondingly.

The security of the country, its economy, cities, and their citizens depends on the critical infrastructure, which is the most important part of the total infrastructure. Each subsystem within the critical infrastructure system provides services to other subsystems, and in this sense, they are characterized by a large number of interwoven, tight connections. By maliciously acting on one subsystem, a ripple effect is created that can grow so much that it threatens the security of the state itself. Therefore, the cyber security aspects of critical infrastructure are very important for researchers, government agencies, and professional individuals. The vision of a smart city should enable a better life for all its citizens and humanity as a whole. It presupposes the use of 4.0 technologies such as the Internet of Things, cloud computing, big data, and artificial intelligence. In past, critical infrastructure subsystems have relied to a greater or lesser extent on isolated and proprietary technologies. With the introduction of "things" into those subsystems, a new polygon is created that includes a large number of vulnerabilities that did not exist until that moment.This paper attempts to shed light on the cybersecurity aspects of critical infrastructure in smart city scenarios.

With the extensive deployment and application of the Internet of Things (IoT), 5G and 6G technologies and edge intelligence, the volume of data generated by IoT and the number of intelligence applications derived from these data are rapidly growing. However, the absence of effective mechanisms to safeguard the vast data generated by IoT, along with the security and privacy of edge intelligence applications, hinders their further development and adoption. In recent years, Trusted Execution Environment (TEE) has emerged as a promising technology for securing cloud data storage and cloud processing, demonstrating significant potential for ensuring data and application confidentiality in more scenarios. Nevertheless, applying TEE technology to enhance security in IoT and edge intelligence scenarios still presents several challenges. This paper investigates the technical challenges faced by current TEE solutions, such as performance overhead and I/O security issues, in the context of the resource constraints and data mobility that are inherent to IoT and edge intelligence applications. Using Intel Software Guard Extensions (SGX) technology as a case study, this paper validates these challenges through extensive experiments. The results provide critical assessments and analyses essential for advancing the development and usage of TEE in IoT and edge intelligence scenarios.

Relevance. All healthcare institutions, including ophthalmology, belong to critical information infrastructure, which is described in law on «the security of critical information infrastructure of the Russian Federation» 26.07.2017 No. 187-FL. It is mandatory to carry out the compliance of critical information infrastructure objects with the established criteria and indicators of significance for these institutions. The article deals with the issues of information security risk assessment and categorization in relation to organizations working in the field of ophthalmology. The research was carried out as part of the implementation of the federal project «Information Security» of the national program «Digital Economy of the Russian Federation». Purpose. Analysis of the features of the categorization process for ophthalmology organizations, designing decision-making algorithm for assigning a category of significance. Material and methods. The article deals with the issues of information security risk assessment and categorization in relation to ophthalmology organizations. The study was carried out as part of the implementation of the federal project «Information Security» (the national program «Digital Economy of the Russian Federation»). Results. The consequences of the implementation of attacks on information systems that are significant for specific types of critical information infrastructure objects in the healthcare sector (in the field of ophthalmology) were considered. The choice of significance criteria was substantiated. An algorithm for making a decision on assigning a category of significance was developed. Conclusion. An analysis of current threats to critical information infrastructure facilities in the healthcare sector was explored. It was found that in the proposed methodologies, the detection of the possibility of detecting an object under the first detection is not wide enough, which may seem to be based on unreasonable costs to ensure the necessary level of security for healthcare and ophthalmology facilities. Keywords: critical information infrastructure, healthcare institution, ophthalmology, information security threats, intruder model, actual threats, computer incidents

Cloud computing has transformed the IT field by offering adaptable and versatile resources to cater to the increasing demands of businesses and organizations. Virtualization technologies are instrumental in facilitating the efficient deployment and management of resources within cloud environments. However, there are notable concerns regarding the security implications of virtualization in the cloud. This research paper thoroughly examines the security aspects of virtualization technologies in cloud computing, primarily focusing on identifying potential weaknesses, risks, and strategies to mitigate security threats. Additionally, the study investigates the security features and mechanisms provided by leading virtualization platforms and management tools. It scrutinizes access controls, isolation methods, network security, data protection, and integrity mechanisms offered by virtualization technologies to safeguard the cloud infrastructure and customer data. Furthermore, the paper addresses emerging security concerns associated with containerization technologies, encompassing vulnerabilities related to container escape, risks stemming from shared kernels, and issues concerning image integrity. It explores the effectiveness of container security measures, such asisolation, sandboxing, and access controls, in reducing these risks. Lastly, the paper summarizes the main findings and provides recommendations to enhance the security of virtualization technologies in cloud computing. It emphasizes the importance of continuous monitoring, regular security updates, robust access controls, and threat intelligence integration to mitigate security risks and uphold a secure cloud infrastructure.