Elena Sitnikova

Building on a literature review conducted to identify literature on international best practices for the through-life technical assurance of cyber-capable systems, this chapter considers the use of cyber-physical systems (CPS) within the context of large and complex organizations such as nation-state defense organizations and critical civilian infrastructure. Building on the concept of CPS, the chapter discusses the societal impacts of complex CPS (CCPS) and systems of CCPS to draw out some of the safety consequences of operating CPS. Safety considerations and mitigation strategies are explored before moving to the regulation of public risk posed by CPS. The case for moving from traditional cybersecurity to cyber-worthiness is made by highlighting the need to consider not only the information assurance aspects of CPS but also the ongoing provision of timely and safe physical outputs of CPS. The importance of model-based cyber-worthiness assessments is considered in the context of tracking and communicating threats to CPS. The application of complex systems governance (CSG) to addressing cyber-worthiness is then considered a viable methodology for managing the complexity of present-day CPS before considering how emergent features of truly complex CPS may be handled via cyber-worthiness assessment and CSG.

Industrial Internet of Thing (IIoT) systems are considered attractive ransomware targets because they operate critical services that affect human lives and have substantial operational costs. The major concern is with brownfield IIoT systems since they have legacy edge systems that are not fully prepared to integrate with IoT technologies. Various existing security solutions can detect and mitigate such attacks but are often ineffective due to the heterogeneous and distributed nature of the IIoT systems and their interoperability demands. Consequently, developing new detection solutions is essential. Therefore, this paper proposes a novel targeted ransomware detection model tailored for IIoT edge systems. It uses Asynchronous Peer-to-Peer Federated Learning (AP2PFL) and Deep Learning (DL) techniques as a targeted ransomware detection algorithm. The proposed model consists of two modules: 1) Data Purifying Module (DPM) aims to refine and reconstruct a valuable and robust representation of data based on Contractive Denoising Auto-Encoder (CDAE), and 2) Diagnostic and Decision Module (DDM) is used to identify targeted ransomware and its stages based on Deep Neural Network (DNN) and Batch Normalization (BN). The main strengths of this proposed model include: 1) each edge gateway’s modules work cooperatively with its neighbors in an asynchronous manner and without a third party, 2) it deals with both homogeneous and heterogeneous data, and 3) it is robust against evasion attacks. An exhaustive set of experiments on three datasets prove the high effectiveness of the proposed model in detecting targeted ransomware (known and unknown attacks) in brownfield IIoT and the superiority over the state-of-the-art models.

Industrial Internet of Things (IIoT) is a high-value cyber target due to the nature of the devices and connectivity protocols they deploy. They are easy to compromise and, as they are connected on a large scale with high-value data content, the compromise of any single device can extend to the whole system and disrupt critical functions. There are various security solutions that detect and mitigate intrusions. However, as they lack the capability to deal with an IIoT’s co-existing heterogeneity and interoperability, developing new universal security solutions to fit its requirements is critical. This is challenging due to the scarcity of accurate data about IIoT systems’ activities, connectivities, and attack behaviors. In addition, owing to their multiplatform connectivity protocols and multivendor devices, collecting and creating such data are also challenging. To tackle these issues, we propose a holistic approach for generating an appropriate intrusion data set for an IIoT called X-IIoTID, a connectivity-agnostic and device-agnostic intrusion data set for fitting the heterogeneity and interoperability of IIoT systems. It includes the behaviors of new IIoT connectivity protocols, activities of recent devices, diverse attack types and scenarios, and various attack protocols. It defines an attack taxonomy and consists of multiview features, such as network traffic, host resources, logs and alerts. X-IIoTID is evaluated using popular machine and deep learning algorithms and compared with 18 intrusion data sets to verify its novelty.

Cyber-Physical Systems (CPS) underpin global critical infrastructure, including power, water, gas systems and smart grids. CPS, as a technology platform, is unique as a target for Advanced Persistent Threats (APTs), given the potentially high impact of a successful breach. Additionally, CPSs are targets as they produce significant amounts of heterogeneous data from the multitude of devices and networks included in their architecture. It is, therefore, essential to develop efficient privacy-preserving techniques for safeguarding system data from cyber attacks. This paper introduces a comprehensive review of the current privacy-preserving techniques for protecting CPS systems and their data from cyber attacks. Concepts of Privacy preservation and CPSs are discussed, demonstrating CPSs' components and the way these systems could be exploited by either cyber and physical hacking scenarios. Then, classification of privacy preservation according to the way they would be protected, including perturbation, authentication, machine learning (ML), cryptography and blockchain, are explained to illustrate how they would be employed for data privacy preservation. Finally, we show existing challenges, solutions and future research directions of privacy preservation in CPSs.

While achieving security for Industrial Internet of Things (IIoT) is a critical and non-trivial task, more attention is required for brownfield IIoT systems. This is a consequence of long life cycles of their legacy devices which were initially designed without considering security and IoT connectivity, but they are now becoming more connected and integrated with emerging IoT technologies and messaging communication protocols. Deploying today’s methodologies and solutions in brownfield IIoT systems is not viable, as security solutions must co-exist and fit these systems’ requirements. This necessitates a realistic standardized IIoT testbed that can be used as an optimal format to measure the credibility of security solutions of IIoT networks, analyze IIoT attack landscapes and extract threat intelligence. Developing a testbed for brownfield IIoT systems is considered a significant challenge as these systems are comprised of legacy, heterogeneous devices, communication layers and applications that need to be implemented holistically to achieve high fidelity. In this paper, we propose a new generic end-to-end IIoT security testbed, with a particular focus on the brownfield system and provide details of the testbed’s architectural design and the implementation process. The proposed testbed can be easily reproduced and reconfigured to support the testing activities of new processes and various security scenarios. The proposed testbed operation is demonstrated on different connected devices, communication protocols and applications. The experiments demonstrate that this testbed is effective in terms of its operation and security testing. A comparison with existing testbeds, including a table of features is provided.

We used open source data from the Epiwatch observatory to monitor for early disease signals in Russia and surrounding countries following an explosion at a BSL 4 laboratory, Vector, in Siberia in September 2019. Upon news of the explosion at Vector on September 16th 2019, the Epiwatch team added the Russian language and key words Russia, Siberia, Novosibirsk, and Koltsovo to the Standard Operating Procedures, in addition to the usual epidemic-specific keywords used in Epiwatch. We also searched for outbreak reports in countries bordering Siberia, including Mongolia, Kazakhstan and China. Given local spread of an epidemic could manifest in these countries, we included searching in Chinese, Mongolian and Kazakh. We added “Ukraine” as a key word, given current conflict between Russia and Ukraine. Data collection began in September 2019, one week after the explosion, with this considered the baseline. We demonstrate a method for rapid epidemic intelligence following an incident of concern, the explosion at Vector. There were some unexplained outbreaks in Russia in the three months following the explosion. No unexplained outbreaks were detected in countries bordering Russia, nor in Ukraine in the three months following the explosion. We detected an accidental release of brucella from a laboratory in China in early December 2019 and two reports of severe pneumonia prior to official reports, which could have been early COVID-19 cases. Best practice in preparedness should include surveillance for disease events in the months following an event of concern at local, national and global levels. In the absence of official surveillance data, open source intelligence may be the only available means of detecting outbreaks and enabling early response and mitigation for the rest of the world. Epiwatch was able to identify reports of Russian outbreaks in the weeks and months following the Vector explosion, which allowed monitoring of outbreaks of concern without a known cause.

Cybersecurity threats in the Health sector are increasing globally due to the rising value of sensitive health information and availability of digitalised personal health records. This systematic review compares international and Australian health system cybersecurity landscapes in relation to the introduction of universal electronic health records. It examines recent trends in healthcare cybersecurity breaches that can disrupt essential services if patient safety and privacy are compromised. Often health systems and health mangers are ill-equipped to mitigate such threats. Recommendations are provided to proactively mature the cybersecurity culture within healthcare organisations, thus increasing their resilience to cyber threat.

Increasingly postgraduate courses are delivered online to meet professionals’ demands for life-long learning. The research examined the efficacy of students critiquing each other's seminal work, by either direct exchange or via online fora, as a structured part of their formal assessments. A total of 377 students across three experimental and two control subjects were involved in this comparative study of pedagogy. Mixed methods research included comparing students’ prior achievement with their achievement in these courses, qualitative interviews, and learning environment inventories. The research methods aligned and were statistically significant in finding that structured peer critiquing was more effective for students with lower or average prior achievement and led to improved perceptions of their learning environment. Forums were found to be a more subtle means of structuring critiquing and engagement than direct exchange; however, care is also needed to ensure online debate is incisive. Two revised pedagogical strategies are proposed.

Protecting Cyber-physical Systems (CPSs) is highly important for preserving sensitive information and detecting cyber threats. Developing a robust privacy-preserving anomaly detection method requires physical and network data about the systems, such as Supervisory Control and Data Acquisition (SCADA), for protecting original data and recognising cyber-attacks. In this paper, a new privacy-preserving anomaly detection framework, so-called PPAD-CPS, is proposed for protecting confidential information and discovering malicious observations in power systems and their network traffic. The framework involves two main modules. Firstly, a data pre-processing module is suggested for filtering and transforming original data into a new format that achieves the target of privacy preservation. Secondly, an anomaly detection module is suggested using a Gaussian Mixture Model (GMM) and Kalman Filter (KF) for precisely estimating the posterior probabilities of legitimate and anomalous events. The performance of the PPAD-CPS framework is assessed using two public datasets, namely the Power System and UNSW-NB15 dataset. The experimental results show that the framework is more effective than four recent techniques for obtaining high privacy levels. Moreover, the framework outperforms seven peer anomaly detection techniques in terms of detection rate, false positive rate and computational time.