please check the resources related to your topic

http://informationsecurity.report/Resources/Whitepapers/20f1cd45-fc89-4387-9bb8-a9e0168cb9ab_erw.pdf

thank you so much nirmala for your help

Hi Parves

I attach a list of papers from my collection that are likely to be interesting for you. They cover a diverse range of different SCADA systems.

Regards

Bob

Hello Bob;

thank you for your reply.

i was looking for paper related to measuring metrics for risk assessing SCADA system

i made taxonomy where i found the vulnerabiltities.

now i want to quantify them to analyze. may be mathemetical equation or table or graph.

can you help.

thank you for your help

parves

Hi Parves

I have to say you have the right approach, in wanting to develop measuring metrics for SCADA risk. I strongly believe that measuring and monitoring systems is a vital part of ensuring strong security can be achieved. While this is something that is on my todo list, it is not part of the short term plan. However, I will make sure to see what I can dig up, and will pass on anything of relevance that might help you.

When developing any kind of measuring and monitoring system, you need to take specific account of the sector in which you wish to understand what is happening. This necessarily means you need to trawl through a variety of sectors before you are sure of which area you want to specifically target. Once you know which sector will capture your interest, you can then start to dig deep.

You will also need to consider more than just risks of SCADA systems. For example, most SCADA systems are now connected through the internet, due to the cost savings involved in not having to send a man on a long journey to manually collect data and adjust settings. Early connection of SCADA systems, which were originally never designed to be connected this way, resulted in serious weaknesses on the security front. Later systems, which are sometimes connected via Internet of Things components, present more serious risks, due to cheapness of components, in-built security weaknesses, and the use of the internet.

This means there a lot of factors to take into account, and therefore you will need to widen your approach a little.

Proper measure is a fundamental component of business budgeting. Managers need to understand their business processes in order to know what likely costs they will incur, which will allow them to prepare a budget. The budget is the target (which can also be viewed as a risk valuation tool) which they are seeking to achieve. Then, real work goes on, and they start spending money as business progresses. The payments are measured and monitored as they go along. Then, by comparing the payments against the budget (the original plan), they can instantly see how well they are doing. The same is true for risk management of anything. First you must understand what the company does, what impact the sector has on what they do, and you need to understand fully what the risk sare. Once you have a really good grasp on those things, measureing and monitoring are relatively straightforward. Without the knowledge, your hands are tied behind your back.

Having found the vulnerabilities, you now need to find out whether you have found all the vulnerabilities. Please feel free to download the papers in my ResearchGate page. The majority are geared towards cloud security and privacy, but you should be able to pick up from them a huge number of weaknesses that you may not have thought of.

If you do that, please feel free to discuss any points that arise with me.

Regards

Bob