The NCSC research problem book
Page 17 of 21
CP3 - How can we understand the security of a wide variety of cyber-physical assets?
How can we understand the security of a wide variety of cyber-physical assets?
Developing better integrated systems, and more of them, is a significant design and architectural challenge, not just when it comes to the individual components present in the system, but also at a systems level. To reduce the risk of attack, we need to understand how and from where systems face a heightened adversarial threat.
In large-scale systems of any type, it can be very difficult to monitor and audit the number of devices present in the environment. If there is no reliable inventory, it's difficult for architects to analyse security issues or to evaluate the security landscape. This is particularly true when it comes to connecting modern technologies with legacy technology.
This means we need to create a reliable way to identify and accurately catalogue cyber-physical systems. This challenge is made more difficult in the cyber-physical space, as the wide variety of devices can make interaction difficult.
Strands or sub-problems
-
Data science
More advanced approaches in managing and controlling cyber-physical systems has put a greater emphasis on data and analytical processes. While solutions such as cloud-based architectures are well suited to these tasks technically, there is a greater need for operators to have data-science skills. Any solutions also need to be secure, especially if they are off-premises or in the cloud.
-
Supply chain
Security isn’t just a concern for an organisation on its own, but one it shares with many others, directly or indirectly, through the supply chain. There is a clear need to understand the potential risks present in an organisation’s supply chain and to identify ways to lower the risk of exploitation.
-
Stability
There is a need to maintain performance in cyber-physical systems. Keeping track of assets in a system must be done in a way that doesn’t degrade system operation.