Journals / Türkiye Bilişim Vakfı Bilgisayar Bilimleri ve Mühendisliği Dergisi / 2021 / Cilt: 14 Sayı: 1

Cyber Risk Analysis and Management for Critical Infrastructures

Kritik Altyapılarda Siber Risk Analizi ve Yönetimi

Pages
15–33
Publication Date
2021-06-28
DOI
—
🏛️Bibliographic metadata and full text access for this article are provided via DergiPark.
DergiPark Record ↗
✨

AI Summary & Key Takeaways

AI Insight
⚡ TL;DR(Too Long; Didn't Read)

In this work, a framework is proposed to form for the protection of critical infrastructures, risk analysis and management by making use of international standards and frameworks.

📌 3 Key Takeaways

🎯
Objective & Hypothesis:As a result of the negative impact of the environment, the social order and the public services when it fails to fulfill its function partially or completely, it considers the network, assets, systems and structures that will have a serious impact on the health, safety and economy of the citizens as a critical infrastructure.
📊
Key Findings & Data:As the importance of the issue has increased day by day, efforts have been accelerated by both countries and international organizations to set standards and to establish protection frameworks.
💡
Conclusion & Impact:In this work, a framework is proposed to form for the protection of critical infrastructures, risk analysis and management by making use of international standards and frameworks.
🔬Design:Research Article
📍Scope:Comprehensive Sample
⚙️Variables:Risk Analizi · Kritik Altyapılar · Katmanlı Mimari

Abstract

As a result of the negative impact of the environment, the social order and the public services when it fails to fulfill its function partially or completely, it considers the network, assets, systems and structures that will have a serious impact on the health, safety and economy of the citizens as a critical infrastructure. In order to protect these buildings due to their vital importance, it is necessary to know the value and to determine which risks they are exposed to. The studies to be carried out in this scope are considered as risk analysis that is to take into account the related threat scenarios in order to evaluate the possible effects and weaknesses of the degradation or destruction of the critical infrastructure. As the importance of the issue has increased day by day, efforts have been accelerated by both countries and international organizations to set standards and to establish protection frameworks. In this work, a framework is proposed to form for the protection of critical infrastructures, risk analysis and management by making use of international standards and frameworks.

Özet

İşlevini kısmen veya tamamen yerine getiremediğinde çevrenin, toplumsal düzenin ve kamu hizmetlerinin yürütülmesinin olumsuz etkilenmesi neticesinde, vatandaşların sağlık, güvenlik ve ekonomisi üzerinde ciddi etkiler oluşturacak ağ, varlık, sistem ve yapıların bütünü kritik altyapı olarak değerlendirmektedir. Bahse konu yapıların hayati önemi nedeniyle korunması ve korunabilmesi için de öncelikle değerinin bilinmesi ve hangi risklere maruz olduğunun tespiti gereklidir. Bu kapsamda yapılacak çalışmalar risk analizi olarak değerlendirilmekte olup, risk analizi kritik altyapının bozulmasının ya da yıkımının olası etkileri ile zayıf noktalarını değerlendirebilmek için ilgili tehdit senaryolarının göz önünde bulundurulmasıdır. Konunun öneminin gün geçtikçe artması nedeniyle hem ülkeler hem de uluslararası kuruluşlar tarafından standartların belirlenmesi, koruma çerçeveleri oluşturulması çalışmaları hız kazanmıştır. Bu çalışmada uluslararası standart ve çerçevelerden faydalanarak kritik altyapıların korunması, risk analizi ve yönetiminin yapılmasına yönelik bir çatı önerilmiştir.

🔖

Cite This Article

KIRAN, E., SOĞUKPINAR, İ. (2021). Cyber Risk Analysis and Management for Critical Infrastructures. Türkiye Bilişim Vakfı Bilgisayar Bilimleri ve Mühendisliği Dergisi, Cilt: 14 Sayı: 1, 15–33. https://ajindex.com/articles/914361

📄 Full Text PDF Viewer

📄

PDF görüntüleyici hazırlanıyor...

References (5)

  1. Gandhi R., Sharma A., Mahoney W., Sousan W., Zhu Q, Laplante P., Dimensions of Cyber-Attacks, IEEE Technology and Society Magazine, vol.30, issue.1, pp.28-38, Spring 2011. CEC, 2004, Critical Infrastructure Protection in the Fight Against Terrorism, Commission of the European Communities. BTK, 2011, Kritik Altyapıların Korunması Belgesi, Bilgi Teknolojileri ve İletişim Kurumu. UDHB, 2015, 2016-2019 Ulusal Siber Güvenlik Strateji Belgesi, Ulaştırma Denizcilik ve Haberleşme Bakanlığı. AFAD, 2014, 2014-2023 Kritik Altyapıların Korunması Yol Haritası Belgesi, Afet ve Acil Durum Yönetimi Başkanlığı. Beggs P., Securing the Nation’s Critical Cyber Infrastructure, US Department of Homeland Security, February 2010.
  2. Jung-Ho E., Nam-Uk K., Sung-Hwan K., Tai-Myoung C., Cyber Military Strategy for Cyberspace Superiority in Cyber Warfare, International Conference on Cyber Security, Cyber Warfare and Digital Forensic, 2012. OECD, 2008, Working Party on Information Security and Privacy, Recommendations of the Council on the Protection of Critical Information Infrastructures, Organisation for Economic Co-operation and Development. TSE, 2002, Bilgi Teknoloji-Bilgi Güvenliği Yönetimi İçin Uygulama Prensipleri, TS ISO/IEC 17799, Türk Standartları Enstitüsü. ISO, 2005, 27001 Information Security Management System, International Organization for Standardization. ISO, 2009, 31010 Risk Assessment Techniques, International Organization for Standardization. ANSI, 2011, Z690.3 Risk Assessment Techniques, American National Standards Institute. Security Service on behalf of the UK Government, CRAMM Management Guide, first published April 1996. C&A System Security Limited. COBRA consultant products for Windows. Evaluation & User Guide, 2000.
  3. Soğukpınar İ., Karabacak B., ISRAM: information security risk analysis method, Elsevier Computer & Security, vol. 24, issue.2, pp. 147-159, March 2005.
  4. Christopher Alberts, Audree Dorofee, CarolWoody_Carnegie Mellon University, Introduction to the OCTAVE Approach, is sponsored by the Department of Defense, August 2003. [Kailey MP, Jarratt P. RAMEX: a prototype expert system for computer security risk analysis and management. Computers& Security, 14(5):449-63, 1995. Bilbao A. TUAR. A model of risk analysis in the security field, CH3119-5/92.IEEE, 1992.
  5. Paulina J., Marek P., “Designing a Security Policy According to BS 7799 Using the OCTAVE Methodology”, Second International Conference on Availability, Reliability and Security (ARES’07), 2007. Yong Q