Abstract:
In the current age, cyber security is an essential element of any information system. A key aspect is in the critical information infrastructure, where information security has become a top priority for information and network security experts. The interoperability of an ICT infrastructure with other components of it is an important aspect of its life cycle. Because Supervisory Control and Data Acquisition (SCADA) systems form part of the critical infrastructure, their cyber protection is particularly important in strategically important industrial and infrastructure sites — power plants, refineries, oil pipelines, treatment plants, manufacturing facilities, communications and transportation infrastructures. Along with the advancement of technology, the increasing number of Scada devices available online, the vulnerability of the sectors controlled by them has also increased. In the world of Internet of things (everything), the end devices cause a new wave of possible vulnerabilities in SCADA. They become the new places for attacks and breaches trough wich the system may be accessed or even compromised. There are a number of critical infrastructures in the Community whose disruption or destruction would have significant cross-border implications for more than one sector as a result of the interdependence of interconnected infrastructures. Such European critical infrastructures have been established and launched under a common procedure developed by the European Commission, with security requirements assessed according to a common minimum approach.
The present article exposes and examines the critical infrastructures of the European Union and Bulgaria. Trough presenting the structure of a Scada system the vulnerabilities and the various possibilities of attacking it were analised. As an example, a specific case based on trees has been considered, and the obtained results were summarized and visualized. The consequences were analized and respecctive conclusion was done.
Keywords:critical infrastructure, SCADA, attack tree, cyber security, network and information security.