Engineering Mission Assurance for the Cyber Security of Supervisory Control and Data Acquisition (SCADA) Systems

摘要

Mission assurance is enabling government agencies to integrate security with continuity and risk management practices to develop a day-to-day operational model that focuses on safeguarding employees and managing business. This same philosophy can be applied to DoD SCADA networks through the careful integration of risk management and information assurance controls to achieve mission assurance objectives. However, current DoD IA controls have not been updated since 2003 and do not adequately address the security of DoD SCADA systems. This research sampled U.S. Air Force Civil Engineering subject matter experts representing eight major commands that manage and operate SCADA systems. They ranked 30 IA controls in three categories, and evaluated eight SCADA specific IA controls for inclusion into the DoD IA control framework. Spearman's Rho ranking results (ρ=.972414) indicate a high preference for encryption, system integrity, and information integrity as key IA Controls to mitigate cyber risk. Equally interesting was the strong agreement among raters on ranking certification and accreditation dead last as an effective IA control. The respondents strongly favored including four new IA controls of the eight considered.