Creating a Concept Map for ICS Security – A Delphi Study

This Research Full Paper presents the results of a Delphi study. Industrial Control Systems (ICS) is a term used to describe highly integrated and mutually dependent systems made up of a complex network of hundreds of thousands of interconnected control systems. These systems usually incorporate different mass production and distribution elements to accomplish an industrial purpose. These highly integrated and mutually dependent systems have been deployed to manage, monitor, and control industrial infrastructure to provide essential services, such as electricity, energy, chemical, food and beverage, water, gas, oil, and traffic control systems. As these internet-connected systems and technologies continue to grow globally, the risks and threats of ICS cyberattacks' are rapidly increasing. If left susceptible to cyberattacks, any significant stoppage or interruption can cause real-world damages, considerable loss, and undesirable events. ICS security, the process of keeping these systems secure, is becoming a challenging priority for industrial organizations. A recent study conducted by the Center for Strategic International Studies (CSIS) showed that across eight countries of I.T. decisionmakers, 82 % of employers reported a cybersecurity skills shortage, and 71 % believe this talent gap poses direct and observable harm to their organization. A report by (ISC)2 found that there is a vast ICS cybersecurity workforce gap, and the cybersecurity workforce needs to grow 89% to meet industry needs in the United States and 145% to close the skills gap worldwide. The major factor driving the market is the increasing number of complex cyber-attacks on ICS systems, requiring a high demand for trained and skilled professionals in the ICS cybersecurity field. In 2016, a CSIS survey of IT employers found that only 23 % believed education curriculums were fully training students to join the cybersecurity industry. Likewise, in 2018, ISACA found that 61 % of institutes believe that fewer than half of those filling cybersecurity positions were qualified for the job. The current education curriculum lacks essential cybersecurity programs and degrees. It does not provide a strong foundation for building the role-specific knowledge necessary to meet the needs of the cybersecurity workforce. This deficiency needs to be urgently addressed through the creation of multiple, flexible programs in industrial control systems security. One of the first steps in this development is to identify the most critical knowledge, skills, and abilities necessary to become proficient in ICS security. This paper reports on a Delphi study designed to identify these foundational concepts and create a concept map based on the findings. This study used the Delphi method to develop the concept map. A selection of 25 experts in ICS security from academia, industry, and government were contacted and asked to outline a list of core knowledge areas. The researchers developed a summary of the experts' opinions. Two more rounds of input and feedback were solicited from the panel of experts. This paper describes the process and the resulting concept map describing the landscape of ICS cybersecurity.