4 results
Now showing1 - 4 of 4
- Some of the metrics are blocked by yourconsent settings
Item type:Publication, Access status: with files , Simultaneous treatment of risk and resiliencePurpose: Supply chain management has a clear focus on risk management, but recent developments have shown that it is also important to pay attention to resilience. This paper introduces a systematic approach to simultaneously treat the two correlated quantities and can incorporate various notations of risk and resilience. Methodology: A game theoretic model that allows simultaneous risk minimization and resilience maximation is proposed. Integration of existing supply chain risk and resilience measures is described to show its applicability. The intrinsic uncertainty of consequences of actions is explicitly taken into account by probabilistic payoffs. Findings: The model provides a set of actions that provide optimal protection, depending the weight put on risk vs. resilience (i.e., how much weight is put on which of the two goals). The problem of putting such theoretical results into practice is discussed and illustrated with an example. Originality: This work aims at improving existing best practice techniques to increase resilience by providing a systematic optimization method. It allows integration of existing resilience measures and is thus flexible to use.Publicationtype: Conference Paper80 164 - Some of the metrics are blocked by yourconsent settings
Item type:Publication, Access status: with files , Improving risk assessment for interdependent urban critical infrastructuresPurpose: Urban critical infrastructures are highly interdependent not only due to their vicinity but also due to the increasing digitalization. In case of a security inci-dent, both the dynamics inside each infrastructure and interdependencies between them need to be considered to estimate the overall impact on a city. Methodology: An existing high-level model of dependencies between critical infra-structures is extended by incorporating more details on the individual infrastruc-ture's behavior. To this end, a literature review on existing models for specific sectors is conducted with a special focus on machine learning models such as neural net-works. Findings: Existing models for the dynamics of specific urban infrastructures are re-viewed and integration in an existing dependency model is discussed. A special focus lies on simulation models since the extended model should be used to evaluate con-sequences of a security incident in a city. Originality: Existing risk assessment approaches typically focus on one type of criti-cal infrastructures rather than on an entire network of interdependent infrastruc-tures. However due to the increasing number of interdependencies, a more holistic view is necessary while the dynamics inside each infrastructure should also be con-sidered.Publicationtype: Conference Paper217 179 - Some of the metrics are blocked by yourconsent settings
Item type:Publication, Access status: with files , Cyber-attack impact estimation for a portPurpose: We investigate consequences of a cyber-attack on a port through a simulation model. Motivated by the impact of NotPetya on the container company A.P. Møller-Maersk and the entire supply chain we propose a method to estimate the consequences. Such estimation is a first step towards the identification of protection measures. Methodology: We represent a port as a network of interdependent cyber and physical assets. The operational state of each component is measured on a 3-tier scale and may change due to external problems. The components reaction on security incidents is modeled using Mealy automata. Findings: An implementation of the model as a network of coupled Mealy automata allows simulation of the dynamics after a security incident. This gives an overview on the expected condition of each component over time. The results can be visualized to identify parts that are particularly at danger. Originality: The approach takes into account different kind of information on the cyber and physical system but also learns from past incidents. The automata simulation model provides estimate on the future behavior. Existing data may be used for validation.Publicationtype: Conference Paper360 238 - Some of the metrics are blocked by yourconsent settings
Item type:Publication, Access status: with files , An adaptive supply chain cyber risk management methodology(epubli, 2017-10); ; ; ; Maritime information infrastructures have developed to highly interrelated cyber ecosystems, where ports as well as their partners are connected in dynamic Information and Communication Technology (ICT)-based maritime supply chains. This makes them open and vulnerable to the rapidly changing ICT threat landscape. Hence, attacks on a seemingly isolated system of one business partner may propagate through the whole supply chain, causing cascading effects and resulting in large-scale impacts. In this article, we want to present a novel risk management methodology to assess the risk level of an entire maritime supply chain. This methodology builds upon publicly available information, well-defined mathematical approaches and best practices to automatically identify and assess vulnerabilities and potential threats of the involved cyber assets. This leads to a constantly updated risk evaluation of each business partner’s cyber assets together with their cyber interconnections with other business partners. The presented risk management methodology is based on qualitative risk scales, which makes the assessment as well as the results more intuitive. Furthermore, it enables a holistic view on all of the integrated ICT-systems as well as their interdependencies and thus can increase the security level of both a whole supply chain and every participating business partner.Publicationtype: Conference Paper1115 607