Incidents of Industrial Systems – Part 2: Incident Categories

Abstract

In the study, design, and maintenance of information system security, knowledge of relevant standards is fundamental. These standards require risk analysis [1]. During risk analysis, incidents are assessed, and attackers are identified. It is useful to categorize incidents when assessing the likelihood of their occurrence and their impact, which facilitates the transparency and management of incidents [2], [3]. Our premise is that there is currently no universally accepted and applied classification system for industrial system incidents and attacks. The first part of our two-part study introduced the topics of industrial security risk management and incident management. This is the second part, which delves into the categorization of incidents in more detail. Our goal is to substantiate the hypothesis with literature sources and explore related causes and possibilities.