Abstract
The industrial manufacturing sector is a rapidly growing and highly technical industry undergoing significant change. These changes are being driven by the growing emphasis on sustainability, the need to streamline production processes, cost-cutting pressures and the demand for safer working environments. This is further exacerbated by the growing threat of cyber-attacks on control systems. Whilst the convergence of Operational and Informational Technology becomes essential, the traditional security approach has proven inadequate in addressing the unique challenges faced by such industries. As a result, Cyber Resilience is rapidly gaining momentum.The idea of resilience and its successful attribution in other disciplines has ignited research in the cyber domain. However, the confusion around the application of Cyber Resilience, along with its various definitions and scope of meanings, has triggered debate in literature. Emerging as a topic of government discussion over a decade ago, resilience metrics have since been a key objective for the research community. Although developments are being made towards Cyber Resilience, the metrics and approaches available are not yet suitable for specific cases such as in a critical manufacturing system (e.g., metrics that are essential for evaluating production impact during a cyber-attack). Consequently, this thesis offers an approach that enables an objective, quantitative measurement of a critical manufacturing systems Cyber Resilience.
The research presented in this thesis provides two case study evaluations, performed at real-world manufacturing plants, a comprehensive description of an experimental method and physical test bed that were specifically designed to acquire resilience-related data from a manufacturing system. The testbed composition closely mirrors those systems identified during the case studies. A remote cyber-attack is described and Cyber Resilience metrics have been proposed and modelled to assess the impact of a successful cyber-attack, before and after resilience enhancements were applied.The findings uncover specific attributes and parameters that stood out from the experimental data, revealing which attributes serve as a practical and meaningful quantitative indicator of a system’s Cyber Resilience. The improvements made to the testbed significantly increased the system’s ability to endure and recover from a successful cyber-attack. Interestingly, the experiments demonstrated that, when designed in accordance with secure control practices, the inherent resilience mechanisms that exist in a safety-critical system exhibited the highest single success rate in maintaining nominal performance relative to other enhancement measures. Where enhancement measures are combined, the system was able to absorb and withstand the disruption.
The outcomes of this research suggest that a combination of security, system and safety engineering practice is critical to enhancing Cyber Resilience. The findings exemplify how Cyber Resilience can help address the emerging complexities with respect to safety-critical complex systems. Results show that development of a universal metric that applies to all manufacturing systems is unrealistic.
| Date of Award | 2023 |
|---|---|
| Original language | English |
| Sponsors | KESSII & Thales |
| Supervisor | Ian Wilson (Supervisor) & Eric Llewellyn (Supervisor) |