Human Factors Challenges in Developing Cyber-Informed Risk Assessment for Critical Infrastructure

摘要

Research efforts in the security of cyber physical systems often focus solely on technological aspects of security and ignore the human contributions to risk and resilience. However, ask any IT security admin what the greatest threat to their system is and they'll quickly tell you, "the user." While the threat of users is well established, humans are involved in the security of systems to a much larger degree. Humans interact with these systems at every stage of their lifecycle, from initial design to end-of-life: Humans design the components and structures of the physical system, they construct the facility, design the control logic, configure the networks and security controls, maintain the equipment, and operate the system. Ignoring the humans in the system means ignoring your largest source of risk. This paper describes the ways in which humans can contribute to risk using the electric grid as an example.