Incidents of Industrial Systems Part 1: Industrial Cybersecurity

Abstract

In the study, design, and maintenance of information system security, knowledge of relevant standards is fundamental. These standards require risk analysis. During risk analysis, incidents are assessed, and attackers are identified. It is useful to categorize incidents when assessing the likelihood of their occurrence and their impact, which facilitates the transparency and management of incidents. Our premise is that there is currently no universally accepted and applied classification system for industrial system incidents and attacks. The first part of our two-part study introduces the topics of industrial security risk management and incident management, laying the foundation for the second part, which delves into the categorization of incidents in more detail. Our goal by the end of the second part is to substantiate the hypothesis with literature sources and explore related causes and possibilities.