Cybersecurity Vulnerability Mitigation Framework through Empirical Paradigm: Enhanced Prioritized Gap Analysis

Journal Article · Wed Apr 01 04:00:00 EDT 2020 · Future Generation Computer Systems

DOI:https://doi.org/10.1016/j.future.2019.12.018· OSTI ID:1580581

Gourisetti, Sri Nikhil G. ^[1]; Mylrea, Michael E. ^[1]; Patangia, Hirak ^[2]

---

1. BATTELLE (PACIFIC NW LAB)
2. University of Arkansas at Little Rock

Existing cybersecurity vulnerability assessment tools were designed based on the policies and standards defined by organizations such as the U.S. Department of Energy and the National Institute of Standards and Technology (NIST). Frameworks such as the cybersecurity capability maturity model (C2M2) and the NIST Cybersecurity Framework (CSF) are often used by the critical infrastructure owners and operators to determine the cybersecurity maturity of their facility. Although these frameworks are exceptional at performing qualitative cybersecurity analysis and identifying vulnerabilities, they do not provide a means to perform prioritized mitigation of those vulnerabilities in order to achieve a desired cybersecurity maturity. To address that challenge, we developed a framework and software application called the cybersecurity vulnerability mitigation framework through empirical paradigm (CyFEr). This paper presents the detailed architecture of CyFEr’s enhanced prioritized gap analysis (EPGA) methodology and its application to CSF. The efficacy of the presented framework is demonstrated by comparing against existing similar models and testing against the cyber injects from a real-world cyber-attack that targeted industrial control systems (ICS) in critical infrastructures.

• Research Organization: Pacific Northwest National Laboratory (PNNL), Richland, WA (United States)
• Sponsoring Organization: USDOE
• DOE Contract Number: AC05-76RL01830
• OSTI ID: 1580581
• Report Number(s): PNNL-SA-143834
• Journal Information: Future Generation Computer Systems, Journal Name: Future Generation Computer Systems Vol. 105
• Country of Publication: United States
• Language: English