Towards Cross-Standard Compliance Readiness: Security Requirements Model for Smart Grid

The critical infrastructure is constantly under cyber and physical threats. Applying security controls without guidance or traceability can create a false sense of security. Security standards facilitate security knowledge and control best practices in a more systematic way. However, the number of s...

Descripción completa

Guardado en:

Detalles Bibliográficos
Autores principales:	Milan Stojkov, Nikola Dalčeković, Branko Markoski, Branko Milosavljević, Goran Sladić
Formato:	article
Lenguaje:	EN
Publicado:	MDPI AG 2021
Materias:	critical infrastructure protection smart grid standards compliance security requirements requirement prioritization Technology T
Acceso en línea:	https://doaj.org/article/46f7e67820df49c399cbb0898f3fe9c5
Etiquetas:	Agregar Etiqueta Sin Etiquetas, Sea el primero en etiquetar este registro!

id	oai:doaj.org-article:46f7e67820df49c399cbb0898f3fe9c5
record_format	dspace
spelling	oai:doaj.org-article:46f7e67820df49c399cbb0898f3fe9c52021-11-11T15:43:13ZTowards Cross-Standard Compliance Readiness: Security Requirements Model for Smart Grid10.3390/en142168621996-1073https://doaj.org/article/46f7e67820df49c399cbb0898f3fe9c52021-10-01T00:00:00Zhttps://www.mdpi.com/1996-1073/14/21/6862https://doaj.org/toc/1996-1073The critical infrastructure is constantly under cyber and physical threats. Applying security controls without guidance or traceability can create a false sense of security. Security standards facilitate security knowledge and control best practices in a more systematic way. However, the number of standards is continually increasing. Product providers that operate in multiple geographical regions often face the obligation to comply with multiple standards simultaneously. This introduces the problem of the convenient interpretation of different standards. Thus, a comprehensive analysis of the requirements from different security standards and guidelines applicable to the smart grid has been performed to detect similarities that can be shaped into entities of the conceptual model for requirement representation. The purpose of the model—presented in a form of a Unified Modeling Language (UML) class diagram—is to give product providers a canonical way to map requirements from arbitrary standards, guidelines, and regulations and accelerate the cross-standard compliance readiness by defining priority for requirement implementation. In addition, the research showed that multiple vectors should impact the priority of the implementation of the security controls defined through the requirements: domain affiliation, the essence of the requirement, associated threats, risks, and social dependencies between actors involved in the implementation. To examine the model correctness, NISTIR 7628—de facto smart grid standard—was used to provide insights into how the model would be used for requirements implementation tracking. The structure of individual requirements was analyzed to detect the building blocks and extract relevant parts that can be mapped to the model components. Further, all requirements were classified into one of the defined domains to provide the basis for referencing similar requirements from different standards. Finally, one arbitrary requirement was used to demonstrate model usage, and depict all available information that can be provided to the users in a custom-made scenario where the need arises to have simultaneous alignment with three standards—NISTIR 7628, NIST 800-53, and IEC 62443-3-3.Milan StojkovNikola DalčekovićBranko MarkoskiBranko MilosavljevićGoran SladićMDPI AGarticlecritical infrastructure protectionsmart gridstandardscompliancesecurity requirementsrequirement prioritizationTechnologyTENEnergies, Vol 14, Iss 6862, p 6862 (2021)
institution	DOAJ
collection	DOAJ
language	EN
topic	critical infrastructure protection smart grid standards compliance security requirements requirement prioritization Technology T
spellingShingle	critical infrastructure protection smart grid standards compliance security requirements requirement prioritization Technology T Milan Stojkov Nikola Dalčeković Branko Markoski Branko Milosavljević Goran Sladić Towards Cross-Standard Compliance Readiness: Security Requirements Model for Smart Grid
description	The critical infrastructure is constantly under cyber and physical threats. Applying security controls without guidance or traceability can create a false sense of security. Security standards facilitate security knowledge and control best practices in a more systematic way. However, the number of standards is continually increasing. Product providers that operate in multiple geographical regions often face the obligation to comply with multiple standards simultaneously. This introduces the problem of the convenient interpretation of different standards. Thus, a comprehensive analysis of the requirements from different security standards and guidelines applicable to the smart grid has been performed to detect similarities that can be shaped into entities of the conceptual model for requirement representation. The purpose of the model—presented in a form of a Unified Modeling Language (UML) class diagram—is to give product providers a canonical way to map requirements from arbitrary standards, guidelines, and regulations and accelerate the cross-standard compliance readiness by defining priority for requirement implementation. In addition, the research showed that multiple vectors should impact the priority of the implementation of the security controls defined through the requirements: domain affiliation, the essence of the requirement, associated threats, risks, and social dependencies between actors involved in the implementation. To examine the model correctness, NISTIR 7628—de facto smart grid standard—was used to provide insights into how the model would be used for requirements implementation tracking. The structure of individual requirements was analyzed to detect the building blocks and extract relevant parts that can be mapped to the model components. Further, all requirements were classified into one of the defined domains to provide the basis for referencing similar requirements from different standards. Finally, one arbitrary requirement was used to demonstrate model usage, and depict all available information that can be provided to the users in a custom-made scenario where the need arises to have simultaneous alignment with three standards—NISTIR 7628, NIST 800-53, and IEC 62443-3-3.
format	article
author	Milan Stojkov Nikola Dalčeković Branko Markoski Branko Milosavljević Goran Sladić
author_facet	Milan Stojkov Nikola Dalčeković Branko Markoski Branko Milosavljević Goran Sladić
author_sort	Milan Stojkov
title	Towards Cross-Standard Compliance Readiness: Security Requirements Model for Smart Grid
title_short	Towards Cross-Standard Compliance Readiness: Security Requirements Model for Smart Grid
title_full	Towards Cross-Standard Compliance Readiness: Security Requirements Model for Smart Grid
title_fullStr	Towards Cross-Standard Compliance Readiness: Security Requirements Model for Smart Grid
title_full_unstemmed	Towards Cross-Standard Compliance Readiness: Security Requirements Model for Smart Grid
title_sort	towards cross-standard compliance readiness: security requirements model for smart grid
publisher	MDPI AG
publishDate	2021
url	https://doaj.org/article/46f7e67820df49c399cbb0898f3fe9c5
work_keys_str_mv	AT milanstojkov towardscrossstandardcompliancereadinesssecurityrequirementsmodelforsmartgrid AT nikoladalcekovic towardscrossstandardcompliancereadinesssecurityrequirementsmodelforsmartgrid AT brankomarkoski towardscrossstandardcompliancereadinesssecurityrequirementsmodelforsmartgrid AT brankomilosavljevic towardscrossstandardcompliancereadinesssecurityrequirementsmodelforsmartgrid AT goransladic towardscrossstandardcompliancereadinesssecurityrequirementsmodelforsmartgrid
_version_	1718434081265418240

Towards Cross-Standard Compliance Readiness: Security Requirements Model for Smart Grid

Ejemplares similares