Clustering of threats and identification of risks of information security breaches at hazardous industrial facilities

Abstract

The paper presents the results of developing a proactive integrated model for identifying and identifying threats to information security at a geographically distributed high-risk facility in a metropolitan area. This model utilizes methods and models for threat analysis and clustering, taking into account potential risks. These models are based on interdisciplinary models that integrate MITRE ATT&CK, IEC 62443, and HAZOP/FMEA methodologies and indicators of the essential properties of digital twins of infrastructure components of real-world facilities. These models also utilize dynamic scenario assessments that include the impact of cyber threats on the occurrence of physical accidents and fire emergencies. The scientific novelty of the research results lies in the application of the Lance-Williams hierarchical clustering algorithm to decompose situations at a geographically distributed hazardous industrial facility and in the consideration of information, functional, and fire safety risks through parameters for changing the edge metrics of the situation graph. The conducted modeling of critical situations with varying ratios of characteristics, with the threat list volume varying by an order of magnitude while impacting various resources of the facility's information infrastructure, demonstrated the possibility of ensuring stable error through dynamic procedures for selecting and applying the clustering method and algorithm. The presented results are proposed to be implemented as mathematical support for decision support systems for information security administrators of information security systems for hazardous industrial facilities in a metropolitan area.