Change search
Link to record
Permanent link

Direct link
BETA
Publications (10 of 15) Show all publications
Välja, M., Korman, M. & Lagerström, R. (2017). A study on software vulnerabilities and weaknesses of embedded systems in power networks. In: Proceedings - 2017 2nd Workshop on Cyber-Physical Security and Resilience in Smart Grids, CPSR-SG 2017 (part of CPS Week): . Paper presented at 2nd Workshop on Cyber-Physical Security and Resilience in Smart Grids, CPSR-SG 2017, 21 April 2017 (pp. 47-52). Association for Computing Machinery, Inc
Open this publication in new window or tab >>A study on software vulnerabilities and weaknesses of embedded systems in power networks
2017 (English)In: Proceedings - 2017 2nd Workshop on Cyber-Physical Security and Resilience in Smart Grids, CPSR-SG 2017 (part of CPS Week), Association for Computing Machinery, Inc , 2017, p. 47-52Conference paper (Refereed)
Abstract [en]

In this paper we conduct an empirical study with the purpose of identifying common software weaknesses of embedded devices used as part of industrial control systems in power grids. The data is gathered about the devices and software of 6 companies, ABB, General Electric, Schneider Electric, Schweitzer Engineering Laboratories, Siemens and Wind River. The study uses data from the manufacturersfi online databases, NVD, CWE and ICS CERT. We identified that the most common problems that were reported are related to the improper input validation, cryptographic issues, and programming errors.

Place, publisher, year, edition, pages
Association for Computing Machinery, Inc, 2017
Keywords
Cyber security, Power networks, Software vulnerability CVSS, Electric network analysis, Electric power transmission networks, Embedded systems, Intelligent control, Laboratories, Network security, Smart power grids, Cryptographic issues, Engineering laboratories, Industrial control systems, Programming errors, Schneider electrics, Software vulnerabilities, Electric power system control
National Category
Computer Systems
Identifiers
urn:nbn:se:kth:diva-216531 (URN)10.1145/3055386.3055397 (DOI)2-s2.0-85019013078 (Scopus ID)9781450349789 (ISBN)
Conference
2nd Workshop on Cyber-Physical Security and Resilience in Smart Grids, CPSR-SG 2017, 21 April 2017
Note

QC 20171128

Available from: 2017-11-28 Created: 2017-11-28 Last updated: 2017-11-28Bibliographically approved
Korman, M., Välja, M., Björkman, G., Ekstedt, M., Vernotte, A. & Lagerström, R. (2017). Analyzing the effectiveness of attack countermeasures in a SCADA system. In: Proceedings - 2017 2nd Workshop on Cyber-Physical Security and Resilience in Smart Grids, CPSR-SG 2017 (part of CPS Week): . Paper presented at 2nd Workshop on Cyber-Physical Security and Resilience in Smart Grids, CPSR-SG 2017, 21 April 2017 (pp. 73-78). Association for Computing Machinery, Inc
Open this publication in new window or tab >>Analyzing the effectiveness of attack countermeasures in a SCADA system
Show others...
2017 (English)In: Proceedings - 2017 2nd Workshop on Cyber-Physical Security and Resilience in Smart Grids, CPSR-SG 2017 (part of CPS Week), Association for Computing Machinery, Inc , 2017, p. 73-78Conference paper (Refereed)
Abstract [en]

The SCADA infrastructure is a key component for power grid operations. Securing the SCADA infrastructure against cyber intrusions is thus vital for a well-functioning power grid. However, the task remains a particular challenge, not the least since not all available security mechanisms are easily deployable in these reliability-critical and complex, multi-vendor environments that host modern systems alongside legacy ones, to support a range of sensitive power grid operations. This paper examines how effective a few countermeasures are likely to be in SCADA environments, including those that are commonly considered out of bounds. The results show that granular network segmentation is a particularly effective countermeasure, followed by frequent patching of systems (which is unfortunately still difficult to date). The results also show that the enforcement of a password policy and restrictive network configuration including whitelisting of devices contributes to increased security, though best in combination with granular network segmentation.

Place, publisher, year, edition, pages
Association for Computing Machinery, Inc, 2017
Keywords
Cyber security, SCADA system, Security controls, Threat modeling, Vulnerability assessment, Electric power system security, Electric power transmission networks, Legacy systems, SCADA systems, Smart power grids, Multi-vendor environment, Network configuration, Network segmentation, Power grid operations, Vulnerability assessments, Network security
National Category
Computer Systems
Identifiers
urn:nbn:se:kth:diva-216532 (URN)10.1145/3055386.3055393 (DOI)2-s2.0-85019036296 (Scopus ID)9781450349789 (ISBN)
Conference
2nd Workshop on Cyber-Physical Security and Resilience in Smart Grids, CPSR-SG 2017, 21 April 2017
Note

QC 20171128

Available from: 2017-11-28 Created: 2017-11-28 Last updated: 2017-11-28Bibliographically approved
Gehrke, O., Heussen, K. & Korman, M. (2017). Integrated multi-domain risk assessment using automated hypothesis testing. In: Proceedings - 2017 2nd Workshop on Cyber-Physical Security and Resilience in Smart Grids, CPSR-SG 2017 (part of CPS Week): . Paper presented at 2nd Workshop on Cyber-Physical Security and Resilience in Smart Grids, CPSR-SG 2017, 21 April 2017 (pp. 55-60). Association for Computing Machinery, Inc
Open this publication in new window or tab >>Integrated multi-domain risk assessment using automated hypothesis testing
2017 (English)In: Proceedings - 2017 2nd Workshop on Cyber-Physical Security and Resilience in Smart Grids, CPSR-SG 2017 (part of CPS Week), Association for Computing Machinery, Inc , 2017, p. 55-60Conference paper (Refereed)
Abstract [en]

In this paper we present an approach for the integration of cyberse-curity tools from multiple domains into an overall risk assessment framework which takes the complex interactions between domains in smart grid systems into account. The approach is based on generating hypotheses from a template, which are then analyzed for their probability and associated impact on the system. The feasibility of the proposed approach is discussed using a very simple example case to serve as a proof of concept. Furthermore, we introduce a generic software framework for the processing of hypothesis templates.

Place, publisher, year, edition, pages
Association for Computing Machinery, Inc, 2017
Keywords
Cybersecurity, Distributed energy resources, Distribution grid, Hypothesis testing, Intrusion detection, Power system, Risk assessment, Computer programming, Electric power transmission networks, Energy resources, Smart power grids, Cyber security
National Category
Energy Engineering
Identifiers
urn:nbn:se:kth:diva-216530 (URN)10.1145/3055386.3055398 (DOI)2-s2.0-85019024337 (Scopus ID)9781450349789 (ISBN)
Conference
2nd Workshop on Cyber-Physical Security and Resilience in Smart Grids, CPSR-SG 2017, 21 April 2017
Note

QC 20171128

Available from: 2017-11-28 Created: 2017-11-28 Last updated: 2017-11-28Bibliographically approved
Välja, M., Korman, M., Lagerström, R., Franke, U. & Ekstedt, M. (2016). Automated Architecture Modeling for Enterprise Technology Management Using Principles from Data Fusion: A Security Analysis Case. In: Kocaoglu, DF Anderson, TR Daim, TU Kozanoglu, DC Niwa, K Perman, G (Ed.), PORTLAND INTERNATIONAL CONFERENCE ON MANAGEMENT OF ENGINEERING AND TECHNOLOGY (PICMET 2016): TECHNOLOGY MANAGEMENT FOR SOCIAL INNOVATION. Paper presented at Portland International Conference on Management of Engineering and Technology (PICMET), SEP 04-08, 2016, Honolulu, HI (pp. 14-22). IEEE
Open this publication in new window or tab >>Automated Architecture Modeling for Enterprise Technology Management Using Principles from Data Fusion: A Security Analysis Case
Show others...
2016 (English)In: PORTLAND INTERNATIONAL CONFERENCE ON MANAGEMENT OF ENGINEERING AND TECHNOLOGY (PICMET 2016): TECHNOLOGY MANAGEMENT FOR SOCIAL INNOVATION / [ed] Kocaoglu, DF Anderson, TR Daim, TU Kozanoglu, DC Niwa, K Perman, G, IEEE , 2016, p. 14-22Conference paper, Published paper (Refereed)
Abstract [en]

Architecture models arc used in enterprise management for decision support. These decisions range from designing processes to planning for the appropriate supporting technology. It is unreasonable for an existing enterprise to completely reinvent itself. Incremental changes are in most cases a more resource efficient tactic. Thus, for planning organizational changes, models of the current practices and systems need to be created. For mid-sized to large organizations this can be an enormous task when executed manually. Fortunately, there's a lot of data available from different sources within an enterprise that can be used for populating such models. The data are however almost always heterogeneous and usually only representing fragmented views of certain aspects. In order to merge such data and obtaining a unified view of the enterprise a suitable methodology is needed. In this paper we address this problem of creating enterprise architecture models from heterogeneous data. The paper proposes a novel approach that combines methods from the fields of data fusion and data warehousing. The approach is tested using a modeling language focusing on cyber security analysis in a study of a lab setup mirroring a small power utility's IT environment.

Place, publisher, year, edition, pages
IEEE, 2016
Series
Portland International Conference on Management of Engineering and Technology, ISSN 2159-5100
National Category
Computer and Information Sciences
Identifiers
urn:nbn:se:kth:diva-242720 (URN)10.1109/PICMET.2016.7806662 (DOI)000403104500002 ()2-s2.0-85016195766 (Scopus ID)
Conference
Portland International Conference on Management of Engineering and Technology (PICMET), SEP 04-08, 2016, Honolulu, HI
Note

QC 20190220

Available from: 2019-02-20 Created: 2019-02-20 Last updated: 2019-09-19
Korman, M., Lagerström, R., Välja, M., Ekstedt, M. & Blom, R. (2016). Technology Management through Architecture Reference Models: A Smart Metering Case. In: Kocaoglu, DF Anderson, TR Daim, TU Kozanoglu, DC Niwa, K Perman, G (Ed.), PORTLAND INTERNATIONAL CONFERENCE ON MANAGEMENT OF ENGINEERING AND TECHNOLOGY (PICMET 2016): TECHNOLOGY MANAGEMENT FOR SOCIAL INNOVATION. Paper presented at Portland International Conference on Management of Engineering and Technology (PICMET), SEP 04-08, 2016, Honolulu, HI (pp. 2338-2350). IEEE
Open this publication in new window or tab >>Technology Management through Architecture Reference Models: A Smart Metering Case
Show others...
2016 (English)In: PORTLAND INTERNATIONAL CONFERENCE ON MANAGEMENT OF ENGINEERING AND TECHNOLOGY (PICMET 2016): TECHNOLOGY MANAGEMENT FOR SOCIAL INNOVATION / [ed] Kocaoglu, DF Anderson, TR Daim, TU Kozanoglu, DC Niwa, K Perman, G, IEEE , 2016, p. 2338-2350Conference paper, Published paper (Refereed)
Abstract [en]

Enterprise architecture (EA) has become an essential part of managing technology in large enterprises. These days, automated analysis of EA is gaining increased attention. That is, using models of business and technology combined in order to analyze aspects such as cyber security, complexity, cost, performance, and availability. However, gathering all information needed and creating models for such analysis is a demanding and costly task. To lower the efforts needed a number of approaches have been proposed, the most common are automatic data collection and reference models. However these approaches are all still very immature and not efficient enough for the discipline, especially when it comes to using the models for analysis and not only for documentation and communication purposes. In this paper we propose a format for representing reference models focusing on analysis. The format is tested with a case in a large European project focusing on security in advanced metering infrastructure. Thus we have, based on the format, created a reference model for smart metering architecture and cyber security analysis. On a theoretical level we discuss the potential impact such a reference model can have.

Place, publisher, year, edition, pages
IEEE, 2016
Series
Portland International Conference on Management of Engineering and Technology, ISSN 2159-5100
National Category
Computer and Information Sciences
Identifiers
urn:nbn:se:kth:diva-242722 (URN)10.1109/PICMET.2016.7806518 (DOI)000403104502019 ()
Conference
Portland International Conference on Management of Engineering and Technology (PICMET), SEP 04-08, 2016, Honolulu, HI
Note

QC 20190219

Available from: 2019-02-19 Created: 2019-02-19 Last updated: 2019-09-19
Holm, H., Korman, M. & Ekstedt, M. (2015). A Bayesian network model for likelihood estimations of acquirement of critical software vulnerabilities and exploits. Information and Software Technology, 58, 304-318
Open this publication in new window or tab >>A Bayesian network model for likelihood estimations of acquirement of critical software vulnerabilities and exploits
2015 (English)In: Information and Software Technology, ISSN 0950-5849, E-ISSN 1873-6025, Vol. 58, p. 304-318Article in journal (Refereed) Published
Abstract [en]

Context: Software vulnerabilities in general, and software vulnerabilities with publicly available exploits in particular, are important to manage for both developers and users. This is however a difficult matter to address as time is limited and vulnerabilities are frequent. Objective: This paper presents a Bayesian network based model that can be used by enterprise decision makers to estimate the likelihood that a professional penetration tester is able to obtain knowledge of critical vulnerabilities and exploits for these vulnerabilities for software under different circumstances. Method: Data on the activities in the model are gathered from previous empirical studies, vulnerability databases and a survey with 58 individuals who all have been credited for the discovery of critical software vulnerabilities. Results: The proposed model describes 13 states related by 17 activities, and a total of 33 different datasets. Conclusion: Estimates by the model can be used to support decisions regarding what software to acquire, or what measures to invest in during software development projects.

Keywords
Cyber security, Vulnerabilities, Exploits, Statistical model, Security metrics
National Category
Computer and Information Sciences
Identifiers
urn:nbn:se:kth:diva-159347 (URN)10.1016/j.infsof.2014.07.001 (DOI)000347022800018 ()2-s2.0-84914169057 (Scopus ID)
Note

QC 20150202

Available from: 2015-02-02 Created: 2015-01-29 Last updated: 2018-01-11Bibliographically approved
Välja, M., Lagerström, R., Ekstedt, M. & Korman, M. (2015). A Requirements Based Approach for Automating Enterprise IT Architecture Modeling Using Multiple Data Sources. In: 2015 IEEE 19th International Enterprise Distributed Object Computing Workshop (EDOCW): . Paper presented at Enterprise Distributed Object Computing (EDOC) International Conference 2015 (pp. 79-87). Adelaide, SA
Open this publication in new window or tab >>A Requirements Based Approach for Automating Enterprise IT Architecture Modeling Using Multiple Data Sources
2015 (English)In: 2015 IEEE 19th International Enterprise Distributed Object Computing Workshop (EDOCW), Adelaide, SA, 2015, p. 79-87Conference paper, Published paper (Refereed)
Abstract [en]

Enterprise Architecture (EA) is an approach where models of an enterprise are used for decision support. An important part of EA is enterprise IT architecture. Creating models of both types can be a complex task. EA can be difficult to model due to unavailable business data, while in the case of enterprise IT architecture, there can be too much IT data available. Furthermore, there is a trend of a growing availability of data possibly useful for modeling. We call the process of making use of available data, automatic modeling. There have been previous attempts to achieve automatic model creation using a single source of data. Often, a single source of data is not enough to create the models required. In this paper we address automatic modeling when data from multiple heterogeneous sources are needed. The paper looks at the potential data sources, requirements that the data must meet and proposes a four-part approach. The approach is tested in a study using the Cyber Security Modeling Language in order to model a lab setup at KTH Royal Institute of Technology. The lab aims at mirroring a small power utility's IT setup. The paper demonstrates that it is possible to create timely and scalable enterprise IT architecture models from multiple sources, and that manual modeling and data quality related problems can be resolved using known data processing methods.

Place, publisher, year, edition, pages
Adelaide, SA: , 2015
Series
Enterprise Distributed Object Computing Workshop (EDOCW), 2015 IEEE 19th International
Keywords
enterprise architecture, automatic data collection, model quality
National Category
Other Electrical Engineering, Electronic Engineering, Information Engineering
Research subject
Information and Communication Technology
Identifiers
urn:nbn:se:kth:diva-181864 (URN)10.1109/EDOCW.2015.33 (DOI)000380478000011 ()2-s2.0-84964663592 (Scopus ID)
External cooperation:
Conference
Enterprise Distributed Object Computing (EDOC) International Conference 2015
Funder
EU, FP7, Seventh Framework Programme
Note

QC 20160226

Available from: 2016-02-05 Created: 2016-02-05 Last updated: 2016-08-30Bibliographically approved
Välja, M., Korman, M., Shahzad, K. & Johnson, P. (2015). Integrated metamodel for security analysis. In: 2015 48TH HAWAII INTERNATIONAL CONFERENCE ON SYSTEM SCIENCES (HICSS): . Paper presented at 48th Annual Hawaii International Conference on System Sciences (HICSS), JAN 05-08, 2015, Kauai, HI (pp. 5192-5200). IEEE Computer Society
Open this publication in new window or tab >>Integrated metamodel for security analysis
2015 (English)In: 2015 48TH HAWAII INTERNATIONAL CONFERENCE ON SYSTEM SCIENCES (HICSS), IEEE Computer Society, 2015, p. 5192-5200Conference paper, Published paper (Refereed)
Abstract [en]

This paper proposes a metamodel for analyzing security aspects of enterprise architecture by combining analysis of cybersecurity with analysis of interoperability and availability. The metamodel extends an existing attack graph based metamodel for cybersecurity modeling and evaluation, (PCySeMoL)-Cy-2, and incorporates several new elements and evaluation rules. The approach improves security analysis by combining two ways of evaluating reachability: one which considers ordinary user activity and another, which considers technically advanced techniques for penetration and attack. It is thus permitting to evaluate security in interoperability terms by revealing attack possibilities of legitimate users. Combined with data import from various sources, like an enterprise architecture data repository, the instantiations of the proposed metamodel allow for a more holistic overview of the threats to the architecture than the previous version. Additional granularity is added to the analysis with the reachability need concept and by enabling the consideration of unavailable and unreliable systems.

Place, publisher, year, edition, pages
IEEE Computer Society, 2015
Series
Proceedings of the Annual Hawaii International Conference on System Sciences, ISSN 1060-3425
National Category
Computer Sciences
Identifiers
urn:nbn:se:kth:diva-181009 (URN)10.1109/HICSS.2015.613 (DOI)000366264105039 ()2-s2.0-84944219720 (Scopus ID)978-1-4799-7367-5 (ISBN)
Conference
48th Annual Hawaii International Conference on System Sciences (HICSS), JAN 05-08, 2015, Kauai, HI
Note

QC 20160126

Available from: 2016-01-26 Created: 2016-01-26 Last updated: 2018-09-22Bibliographically approved
Korman, M., Lagerström, R. & Ekstedt, M. (2015). Modeling Authorization in Enterprise-wide Contexts. In: Sergio Espana, Jolita Ralyté, Pnina Soffer, Jelena Zdravkovic, Oscar Pastor (Ed.), PoEM-SDC 2015: Short and Doctoral Consortium Papers at PoEM 2015: Proceedings of Short and Doctoral Consortium Papers Presented at the 8th IFIP WG 8.1 Working Conference on the Practice of Enterprise Modelling (PoEM 2015) Valencia, Spain, November 10-12, 2015.. Paper presented at The 8th IFIP WG 8.1 working conference on the Practice of Enterprise Modeling (PoEM 2015). (pp. 81-90). CEUR-WS, 1497
Open this publication in new window or tab >>Modeling Authorization in Enterprise-wide Contexts
2015 (English)In: PoEM-SDC 2015: Short and Doctoral Consortium Papers at PoEM 2015: Proceedings of Short and Doctoral Consortium Papers Presented at the 8th IFIP WG 8.1 Working Conference on the Practice of Enterprise Modelling (PoEM 2015) Valencia, Spain, November 10-12, 2015. / [ed] Sergio Espana, Jolita Ralyté, Pnina Soffer, Jelena Zdravkovic, Oscar Pastor, CEUR-WS , 2015, Vol. 1497, p. 81-90Conference paper, Published paper (Refereed)
Abstract [en]

Authorization and its enforcement, access control, has stood at the beginning of the art and science of information security, and remains being a crucial pillar of secure operation of IT. Dozens of different models of access control have been proposed. Although enterprise architecture as a discipline strives to support the management of IT, support for modeling authorization in enterprises is lacking, both in terms of supporting the variety of individual models nowadays used, and in terms of providing a unified metamodel capable of flexibly expressing configurations of all or most of the models. This study summarizes a number of existing models of access control, proposes an unified metamodel mapped to ArchiMate, and illustrates its use on a selection of simple cases.

Place, publisher, year, edition, pages
CEUR-WS, 2015
Series
CEUR Workshop Proceedings, ISSN 1613-0073
National Category
Other Electrical Engineering, Electronic Engineering, Information Engineering
Research subject
Industrial Engineering and Management; Information and Communication Technology
Identifiers
urn:nbn:se:kth:diva-177993 (URN)2-s2.0-84955257235 (Scopus ID)
Conference
The 8th IFIP WG 8.1 working conference on the Practice of Enterprise Modeling (PoEM 2015).
Projects
SweGrids
Funder
SweGRIDS - Swedish Centre for Smart Grids and Energy StorageSwedish Energy Agency
Note

QC 20160205

Available from: 2015-11-30 Created: 2015-11-30 Last updated: 2016-02-05Bibliographically approved
Korman, M., Ekstedt, M., Sommestad, T., Hallberg, J. & Bengtsson, J. (2014). Overview of Enterprise Information Needs in Information Security Risk Assessment. In: Proceedings of the 18th IEEE International EDOC Conference (EDOC 2014): . Paper presented at The 18th IEEE International EDOC Conference (EDOC 2014).
Open this publication in new window or tab >>Overview of Enterprise Information Needs in Information Security Risk Assessment
Show others...
2014 (English)In: Proceedings of the 18th IEEE International EDOC Conference (EDOC 2014), 2014Conference paper, Published paper (Refereed)
Abstract [en]

Methods for risk assessment in information security suggest users to collect and consider sets of input information, often notably different, both in type and size. To explore these differences, this study compares twelve established methods on how their input suggestions map to the concepts of ArchiMate, a widely used modeling language for enterprise architecture. Hereby, the study also tests the extent, to which ArchiMate accommodates the information suggested by the methods (e.g., for the use of ArchiMate models as a source of information for risk assessment). Results of this study show how the methods differ in suggesting input information in quantity, as well as in the coverage of the ArchiMate structure. Although the translation between ArchiMate and the methods’ input suggestions is not perfect, our results indicate that ArchiMate is capable of modeling fair portions of the information needed for the methods for information security risk assessment, which makes ArchiMate models a promising source of guidance for performing risk assessments.

Keywords
risk assessment, information security, enterprise information needs, enterprise architecture, ArchiMate
National Category
Other Electrical Engineering, Electronic Engineering, Information Engineering
Research subject
Information and Communication Technology
Identifiers
urn:nbn:se:kth:diva-154231 (URN)10.1109/EDOC.2014.16 (DOI)000358531500006 ()2-s2.0-84937426317 (Scopus ID)
Conference
The 18th IEEE International EDOC Conference (EDOC 2014)
Funder
SweGRIDS - Swedish Centre for Smart Grids and Energy Storage
Note

Funded by Swedish Armed Forces.

QC 20150409

Available from: 2014-10-16 Created: 2014-10-16 Last updated: 2015-08-27Bibliographically approved
Organisations
Identifiers
ORCID iD: ORCID iD iconorcid.org/0000-0001-7386-7471

Search in DiVA

Show all publications