Kritik Altyapılarda Siber Risk Analizi ve Yönetimi

Öz

İşlevini kısmen veya tamamen yerine getiremediğinde çevrenin, toplumsal düzenin ve kamu hizmetlerinin yürütülmesinin olumsuz etkilenmesi neticesinde, vatandaşların sağlık, güvenlik ve ekonomisi üzerinde ciddi etkiler oluşturacak ağ, varlık, sistem ve yapıların bütünü kritik altyapı olarak değerlendirmektedir. Bahse konu yapıların hayati önemi nedeniyle korunması ve korunabilmesi için de öncelikle değerinin bilinmesi ve hangi risklere maruz olduğunun tespiti gereklidir. Bu kapsamda yapılacak çalışmalar risk analizi olarak değerlendirilmekte olup, risk analizi kritik altyapının bozulmasının ya da yıkımının olası etkileri ile zayıf noktalarını değerlendirebilmek için ilgili tehdit senaryolarının göz önünde bulundurulmasıdır. Konunun öneminin gün geçtikçe artması nedeniyle hem ülkeler hem de uluslararası kuruluşlar tarafından standartların belirlenmesi, koruma çerçeveleri oluşturulması çalışmaları hız kazanmıştır. Bu çalışmada uluslararası standart ve çerçevelerden faydalanarak kritik altyapıların korunması, risk analizi ve yönetiminin yapılmasına yönelik bir çatı önerilmiştir.

Anahtar Kelimeler

• Risk Analizi
• Kritik Altyapılar
• Katmanlı Mimari
• Senaryo Tabanlı Yaklaşım
• Risk Yönetim Standartları
• Perspektif Risk Yaklaşımı

Cyber Risk Analysis and Management for Critical Infrastructures

Öz

As a result of the negative impact of the environment, the social order and the public services when it fails to fulfill its function partially or completely, it considers the network, assets, systems and structures that will have a serious impact on the health, safety and economy of the citizens as a critical infrastructure. In order to protect these buildings due to their vital importance, it is necessary to know the value and to determine which risks they are exposed to. The studies to be carried out in this scope are considered as risk analysis that is to take into account the related threat scenarios in order to evaluate the possible effects and weaknesses of the degradation or destruction of the critical infrastructure. As the importance of the issue has increased day by day, efforts have been accelerated by both countries and international organizations to set standards and to establish protection frameworks. In this work, a framework is proposed to form for the protection of critical infrastructures, risk analysis and management by making use of international standards and frameworks.

Anahtar Kelimeler

• Risk Analysis
• Critical Infrastructures
• Layered Architecture
• Scenario-Based Approach
• Risk Management Standards
• Perspective Risk Approach

Kaynakça

1. Gandhi R., Sharma A., Mahoney W., Sousan W., Zhu Q, Laplante P., Dimensions of Cyber-Attacks, IEEE Technology and Society Magazine, vol.30, issue.1, pp.28-38, Spring 2011.
2. CEC, 2004, Critical Infrastructure Protection in the Fight Against Terrorism, Commission of the European Communities.
3. BTK, 2011, Kritik Altyapıların Korunması Belgesi, Bilgi Teknolojileri ve İletişim Kurumu.
4. UDHB, 2015, 2016-2019 Ulusal Siber Güvenlik Strateji Belgesi, Ulaştırma Denizcilik ve Haberleşme Bakanlığı.
5. AFAD, 2014, 2014-2023 Kritik Altyapıların Korunması Yol Haritası Belgesi, Afet ve Acil Durum Yönetimi Başkanlığı.
6. Beggs P., Securing the Nation’s Critical Cyber Infrastructure, US Department of Homeland Security, February 2010.
7. Jung-Ho E., Nam-Uk K., Sung-Hwan K., Tai-Myoung C., Cyber Military Strategy for Cyberspace Superiority in Cyber Warfare, International Conference on Cyber Security, Cyber Warfare and Digital Forensic, 2012.
8. OECD, 2008, Working Party on Information Security and Privacy, Recommendations of the Council on the Protection of Critical Information Infrastructures, Organisation for Economic Co-operation and Development.

9. TSE, 2002, Bilgi Teknoloji-Bilgi Güvenliği Yönetimi İçin Uygulama Prensipleri, TS ISO/IEC 17799, Türk Standartları Enstitüsü.
10. ISO, 2005, 27001 Information Security Management System, International Organization for Standardization.
11. ISO, 2009, 31010 Risk Assessment Techniques, International Organization for Standardization.
12. ANSI, 2011, Z690.3 Risk Assessment Techniques, American National Standards Institute.
13. Security Service on behalf of the UK Government, CRAMM Management Guide, first published April 1996.
14. C&A System Security Limited. COBRA consultant products for Windows. Evaluation & User Guide, 2000.
15. Soğukpınar İ., Karabacak B., ISRAM: information security risk analysis method, Elsevier Computer & Security, vol. 24, issue.2, pp. 147-159, March 2005.
16. Christopher Alberts, Audree Dorofee, CarolWoody_Carnegie Mellon University, Introduction to the OCTAVE Approach, is sponsored by the Department of Defense, August 2003.
17. [Kailey MP, Jarratt P. RAMEX: a prototype expert system for computer security risk analysis and management. Computers& Security, 14(5):449-63, 1995.
18. Bilbao A. TUAR. A model of risk analysis in the security field, CH3119-5/92.IEEE, 1992.
19. Paulina J., Marek P., “Designing a Security Policy According to BS 7799 Using the OCTAVE Methodology”, Second International Conference on Availability, Reliability and Security (ARES’07), 2007.
20. Yong Q, Long X. Qianmu L., Information security risk assessment method based on CORAS frame, International Conference on Computer Science and Software Engineering, 12-14 December 2008.
21. Sarkheyli A., Ithnin N.B., Improving the current risk analysis techniques by study of their process and using the human body’s Immune System”, 5th International Symposium on Telecommunications, 4-6 December 2010.
22. ISO, 2009, 31000 Risk Management – Principles and Guidelines, International Organization for Standardization.
23. ISO, 2011, 27005 Information Security Risk Management, International Organization for Standardization.
24. NIST, 2011, 800-39 Managing Information Security Risk, National Institute of Standards and Technology.
25. Bagheri E., Ghorbani A.A., Risk Analysis in Critical Infrastructure Systems based on the Astrolabe Methodology, Fifth Annual Conference on Communication Networks and Services Research, 2007.
26. Romanowski C., Schneider J., Critical Infrastructure protection and risk analysis in the mid-size city, IEEE Conference on Technologies for Homeland Security, 13-15 November 2012.
27. Chen K.Y., Heckel-Jones C.A.C., Maupin N.G., Rubin S.M., Bogdanor J.M., Guo Z., Haimes Y.Y., Risk Analysis of GPS-Dependent Critical Infrastructure System of Systems, Systems and Information Engineering Design Symposium, 25 April 2014.
28. Giannopoulos G., Filippini R, Schimmer M., Theocharidou M., Risk Assessment Methodologies for Critical Infrastructure Protection, European Commission Joint Research Centre Institute for Protection and Security of the Citizen, Part – I EUR 25286 EN – 2012, Part – II EUR 27332 EN – 2015.
29. Kumaş E., Birgören B., E-Devlet Kapısı Projesi Bilgi Güvenliği ve Risk Yönetimi: Türkiye Uygulaması, Bilişim Teknolojileri Dergisi, Cilt.3, Sayı.2, Sayfa.29-36, Mayıs 2010.
30. Feglar T., Levy J.K., Protecting Cyber Critical Infrastructure (CCI): Integrating Information Security Risk Analysis and Environmental Vulnerability Analysis, IEEE International Engineering Management Conference, 18-21 October 2004.
31. Heo J., Shin J.W., Lee W., Won Y., Risk Analysis Methodology for New Critical Information Infrastructure, Third International Conference on Systems and Networks Communications, 26-31 October 2008.
32. Sierla S., Hurkala M., Charitoudi K., Security Risk Analysis for Smart Grid Automation, IEEE 23rd International Symposium on Industrial Electronics, 1-4 June 2014.
33. Yasakethu S.L.P., Jiang J., Graziano A., Intelligent Risk Detection and Analysis Tools for Critical Infrastructure Protection, IEEE Eurocon, 1-4 July 2013.
34. Guzman A., Ishida S., Choi E., Aoyama A., Artificial Intelligence Improving Safety and Risk Analysis: A Comparative Analysis for Critical Infrastructure, IEEE International Conference on Industrial Engineering and Engineering Management, 4-7 December 2016.
35. NIST, 2014, Framework for Improving Critical Infrastructure Cyber Security, National Institute of Standards and Technology.
36. Arno R.G., Stoyas E., Schuerger R., Risk Analysis for NEC Article 708 Critical Operations Power Systems, IEEE Industry Applications Society Annual Meeting, 4-8 October 2009.
37. Hua J., Bapna S., The Economic Impact of Cyber Terrorism, Elsevier The Journal of Strategic Information Systems, vol.22, issue.2, pp.175-186, June 2013.
38. Park W.H., Risk Analysis and Damage Assessment of Financial Institutions in Cyber Attacks between Nations, Elsevier Mathematical and Computer Modelling, vol.58, issue.11-12, pp.1845, December 2013.