Achieving Cyber-Informed Engineering Through Bayesian Belief Network and Sensitivity Analysis

The security of critical infrastructures is a challenge facing nations and states today as a result of the increased complexity and interconnectivity of these systems and their control from remote locations. Ensuring the security of critical systems requires engineering cybersecurity-related risks that attackers can exploit to cause severe consequences, such as equipment damage, environmental/water pollution, monetary loss, or even loss of life. It is important to identify and prioritize actions or attacks that can lead to high-consequence events (HCEs) capable of crippling critical functions of any organization. In this work, we proposed a new approach to cybersecurity risk assessment by proposing the Consequence-Driven Cyber-Informed Engineering (CCE) approach and the Bayesian Belief Network (BBN) with Sensitivity Analysis (SA). For proof of concept, we tested the proposed approach at the Tennessee Eastman chemical plant and were able to uncover and prioritize ripple effects caused by disturbance or noise-induced attacks on critical infrastructure.