The Bridge - Issue 2, 2023 - 6

Feature
A Barrier-based Approach to Cyber Security
in Critical Infrastructures
Knut Øien, Lars Halvdan Flå, Stein Hauge, and Martin Gilje Jaatun, Senior Member, IEEE
Abstract
Critical infrastructure environments that include process
control systems have long been conversant with the
concept of safety barriers that are intended to prevent
major accidents and damage to personnel and property.
Developments in the last decade where the domains of
information technology (IT) and operational technology
(OT) have become intertwined have made the need for
cybersecurity management in the OT domain clear to all
stakeholders, and this has led us to explore the possibilities
of defining cybersecurity barriers as a complement to
existing safety barriers. This article will describe a first
step on the road to integrating cybersecurity barrier
management into the already existing safety barrier
management regime in the petroleum industry.
Index Terms-cybersecurity, barriers, safety,
countermeasures
I. INTRODUCTION
Actors utilizing industrial control systems have historically
been most concerned with mitigating and protecting
against unintended events. Consequently, a strong culture
for ensuring the health and safety of humans and the
environment has been built over the years.
THE BRIDGE
However, with increased demands for the digitalization of
industrial control systems, these systems have become
increasingly vulnerable to cyberattacks that constitute
intended events. Examples from the last decade illustrate
how such attacks can interfere with normal operations
and pose a threat to health and safety of humans and
the environment. Thus, there is an urgent need to protect
industrial control systems against cyber threats.
In this article, we discuss the potential for adapting some
of the methods and procedures developed and used with
success in the safety domain to the cyber security domain.
Specifically, we investigate the applicability of barriers
and barrier management to industrial cyber security. A
barrier can be defined as a measure intended to identify
conditions that may lead to failure, hazard and accident
situations, prevent an actual sequence of events from
occurring or developing, influence a sequence of events in
a deliberate way, or limit damage and/or loss [1]. Barriers
can be illustrated in the bow-tie model, see Figure 1
(adapted from Øie et al. [2]).
Many causes can lead to the same incident, following
different event sequence paths, unless barriers prevent the
development into an incident, and the same incident can
lead to different consequences, following different paths,
unless barriers mitigate the consequences. This gives the
The Bridge - Issue 2, 2023

Table of Contents for the Digital Edition of The Bridge - Issue 2, 2023
