Skip to main content
SpringerLink
Log in

An Approach to Organizational Cybersecurity

  • Conference paper
  • First Online:
Enterprise Security (ES 2015)

Part of the book series: Lecture Notes in Computer Science ((LNSC,volume 10131))

Included in the following conference series:

Abstract

Large organizations must plan for Cybersecurity throughout their entire network, taking into account network granularity and outside subcontractors. The United States Department of Defense (DoD) has large networked systems that span the globe, crossing multiple intra-organizational systems. This larger network includes Information Systems typical of enterprise networks, SCADA Systems monitoring critical infrastructure, newer Cyber-physical systems, and mobile networks. With increased connectivity within the DoD and to external organizations, Cybersecurity is seen as a critical organizational need. There is not currently a standard evaluation process to gauge whether various Cybersecurity technologies adequately meet the needs of either the DoD at large or the context of lower-tier organizations. We introduce the DoD-Centric and Independent Technology Evaluation Capability (DITEC), an enterprise-ready evaluation tool that offers a repeatable evaluation process, the ability to take prior product evaluations into account during the acquisition process, and tools to assist security non-experts in understanding which technologies meet their specific needs. This work describes DITEC and the Cyber-SCADA Evaluation Capability (C-SEC), an implementation of DITEC in a Cyber-Physical context.

The rights of this work are transferred to the extent transferable according to title 17 § 105 U.S.C.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 39.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 54.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Notes

  1. 1.

    https://opcfoundation.org/.

  2. 2.

    http://linuxmint.com.

  3. 3.

    https://www.nginx.com.

  4. 4.

    https://www.djangoproject.com.

  5. 5.

    http://www.highcharts.com.

  6. 6.

    https://www.turnkeylinux.org.

  7. 7.

    http://www.postgresql.org.

References

  • Axelrod, C.W.: Enforcing security, safety and privacy for the internet of things. In: 2015 IEEE Long Island Systems, Applications and Technology Conference (LISAT), pp. 1–6. IEEE (2015)

    Google Scholar 

  • Bunge, J.: Agriculture giants boost cybersecurity to shield farm data (2015)

    Google Scholar 

  • Chang, V., Kuo, Y.-H., Ramachmandaran, M.: Cloud computing adoption framework: a security framework for business clouds. Future Gener. Comput. Syst. 57, 24–41 (2016)

    Article  Google Scholar 

  • Cruz, T., Barrigas, J., Proena, J., Graziano, A., Panzieri, S., Lev, L., Simões, P.: Improving network security monitoring for industrial control systems. In: 2015 IFIP/IEEE International Symposium on Integrated Network Management (I), pp. 878– 881. IEEE (2015)

    Google Scholar 

  • Dalesio, E.P.: Duke energy executive says utility battles off steady cyberattacks. Charlotte Obs. (2015)

    Google Scholar 

  • Dalesio, E.P.: Duke Energy Corp. CEO Lynn Good says the volume of cyberattacks on the country’s largest electric company is astonishing. Charlotte Obs. (2016)

    Google Scholar 

  • DoD: Cybersecurity/Information Assurance (IA). United States Department of Defense, Defense Contract Management Agency (2014)

    Google Scholar 

  • Drias, Z., Serhrouchni, A., Vogel, O.: Taxonomy of attacks on industrial control protocols. In: 2015 International Conference on Protocol Engineering (ICPE) and International Conference on New Technologies of Distributed Systems (NTDS), pp. 1–6. IEEE (2015)

    Google Scholar 

  • ESET: ESET finds connection between cyber espionage and electricity outage in Ukraine. Technical report (2016)

    Google Scholar 

  • Fink, G.A., Zarzhitsky, D.V., Carroll, T.E., Farquhar, E.D.: Security and privacy grand challenges for the internet of things. In: 2015 International Conference on Collaboration Technologies and Systems (CTS), pp. 27–34 (2015)

    Google Scholar 

  • Hallman, R., Romero-Mariona, J., Kline, M., San Miguel, J.: DITEC user priority designation (UPD) algorithm: an approach to prioritizing technology evaluations. Technical report, DTIC Document (2014)

    Google Scholar 

  • Hentunen, D.: Havex hunts for ICS/SCADA systems (2014)

    Google Scholar 

  • Hsu, A.P.T., Lee, W.T., Trappey, A.J.C., Trappey, C.V., Chang, A.C.: Using system dynamics analysis for performance evaluation of IoT enabled one-stop logistic services. In: IEEE International Conference on Systems, Man, and Cybernetics (SMC), pp. 1291–1296 (2015)

    Google Scholar 

  • Hultquist, J.: Sandworm team and the Ukrainian power authority attacks (2016)

    Google Scholar 

  • ICS-CERT: ICSB-11-327-01-Illinois Water Pump Failure Report, United States Department Of Homeland Security (DHS) Industrial Control Systems Cyber-Emergency Response Team (ICS-CERT). Technical report (2011)

    Google Scholar 

  • ICS-CERT: ICS-CERT alerts, United States Department of Homeland Security (DHS) Industrial Control Systems Cyber-Emergency Response Team (ICS-CERT) (2016)

    Google Scholar 

  • Jajodia, S., Noel, S., Kalapa, P., Albanese, M., Williams, J.: Cauldron mission-centric cyber situational awareness with defense in depth. In: Military Communications Conference 2011, MILCOM 2011, pp. 1339–1344 (2011)

    Google Scholar 

  • Jing, Q., Vasilakos, A.V., Wan, J., Lu, J., Qiu, D.: Security of the internet of things: perspectives and challenges. Wirel. Netw. 20(8), 2481–2501 (2014)

    Article  Google Scholar 

  • Kerr, L., Hallman, R., Major, M., Romero-Mariona, J., Bryan, J., Kline, M., San Miguel, J., Coronado, B.: TMT: technology matching tool for SCADA network security. In: 2016 Cybersecurity Symposium. University of Idaho, Springer, Heidelberg (2016, in press)

    Google Scholar 

  • Krebs, B.: DHS blasts reports of Illinois water station hack (2011)

    Google Scholar 

  • Meltzer, D.: Securing the industrial internet of things. ISSA J., 24–30 (2015)

    Google Scholar 

  • Moral-García, S., Moral-Rubio, S., Rosado, D.G., Fernández, E.B., Fernández-Medina, E.: Enterprise security pattern: a new type of security pattern. Secur. Commun. Netw. 7(11), 1670–1690 (2014)

    Article  Google Scholar 

  • NIST: Cybersecurity Framework. National Institute for Standards and Technology, 100 Bureau Drive Gaithersburg, MD 20899 (2015)

    Google Scholar 

  • Ponemon, I.: Fourth annual benchmark study on patient privacy and data security. Technical report (2014)

    Google Scholar 

  • Ponemon, I.: Sixth annual benchmark study on privacy & security of healthcare data. Technical report (2016)

    Google Scholar 

  • Ramachandran, M., Chang, V., Li, C.-S.: The improved cloud computing adoption framework to deliver secure services. In: Proceedings of ESaaSA 2015-2nd International Workshop on Emerging Software as a Service and Analytics, in conjunction with the 5th International Conference on Cloud Computing and Services Science-CLOSER 2015, pp. 73–79. Scitepress (2015)

    Google Scholar 

  • Romero-Mariona, J.: DITEC (DoD-centric and independent technology evaluation capability): a process for testing security. In: 2014 IEEE Seventh International Conference on Software Testing, Verification and Validation Workshops (ICSTW), pp. 24–25 (2014)

    Google Scholar 

  • Romero-Mariona, J., Hallman, R., Kline, M., San Miguel, J., Major, M., Kerr, L.: Security in the industrial internet of things - the C-SEC approach. In: Proceedings of the International Conference on Internet of Things and Big Data, pp. 421–428. INSTICC, SCITEPRESS Science and Technology Publications (2016)

    Google Scholar 

  • Romero-Mariona, J., Kline, M., Miguel, J.S.: C-SEC (cyber SCADA evaluation capability): securing critical infrastructures. In: 2015 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW), pp. 38–38. IEEE (2015)

    Google Scholar 

  • Symantec: Dragonfly: western energy companies under sabotage threat. Technical report (2014)

    Google Scholar 

  • TrendMicro: Report on cyber-security and critical infrastructure in the americas. Technical report, Organization of American States (2015)

    Google Scholar 

  • Wyant, S.: Monsanto confirms security breach at precision planting unit (2014)

    Google Scholar 

  • Yu, T., Sekar, V., Seshan, S., Agarwal, Y., Xu, C.: Handling a trillion (unfixable) flaws on a billion devices: rethinking network security for the internet-of-things. In: Proceedings of the 14th ACM Workshop on Hot Topics in Networks, HotNets-XIV, pp. 5:1– 5:7. ACM (2015)

    Google Scholar 

  • Zetter, K.: Exclusive: comedy of errors led to false water-pump hack report (2011)

    Google Scholar 

  • Zhu, B., Sastry, S.: SCADA-specific intrusion detection/prevention systems: a survey and taxonomy. In: Proceedings of the 1st Workshop on Secure Control Systems (SCS) (2010)

    Google Scholar 

Download references

Author information

Authors and Affiliations

  1. SPAWAR Systems Center Pacific, San Diego, California, USA

    Jose Romero-Mariona, Roger Hallman, Megan Kline, Geancarlo Palavicini, Josiah Bryan, John San Miguel, Lawrence Kerr, Maxine Major & Jorge Alvarez

Authors
  1. Jose Romero-Mariona
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Roger Hallman
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Megan Kline
    View author publications

    You can also search for this author in PubMed Google Scholar

  4. Geancarlo Palavicini
    View author publications

    You can also search for this author in PubMed Google Scholar

  5. Josiah Bryan
    View author publications

    You can also search for this author in PubMed Google Scholar

  6. John San Miguel
    View author publications

    You can also search for this author in PubMed Google Scholar

  7. Lawrence Kerr
    View author publications

    You can also search for this author in PubMed Google Scholar

  8. Maxine Major
    View author publications

    You can also search for this author in PubMed Google Scholar

  9. Jorge Alvarez
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding authors

Correspondence to Jose Romero-Mariona or Roger Hallman .

Editor information

Editors and Affiliations

  1. Xi’an Jiaotong-Liverpool University, Suzhou, China

    Victor Chang

  2. School of Computing, Creative Technologies, and Engineering, Leeds Beckett University, Leeds, United Kingdom

    Muthu Ramachandran

  3. University of Southampton , Southampton, United Kingdom

    Robert J. Walters

  4. Department of Electronics and Computer Science, University of Southampton, Southampton, United Kingdom

    Gary Wills

Rights and permissions

Reprints and permissions

Copyright information

© 2017 Springer International Publishing AG (outside the USA)

About this paper

Cite this paper

Romero-Mariona, J. et al. (2017). An Approach to Organizational Cybersecurity. In: Chang, V., Ramachandran, M., Walters, R., Wills, G. (eds) Enterprise Security. ES 2015. Lecture Notes in Computer Science(), vol 10131. Springer, Cham. https://doi.org/10.1007/978-3-319-54380-2_9

Download citation

  • DOI: https://doi.org/10.1007/978-3-319-54380-2_9

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-319-54379-6

  • Online ISBN: 978-3-319-54380-2

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation