Quantitatively Assessing and Visualising Industrial System Attack Surfaces

CHAPTER 5. CONCLUSION 49
5.3 Criticality is dependent on context
When examining this data, a natural question is ‘how many of these data points are really
critical?’ This is an important but difficult question.
Clearly, not all of them are critical to national systems, and some of them may even be
demo systems with a legitimate reason to be Internet facing. However, some of these
systems may be critical to a nation or at the very least the business that operates them.
While it is difficult to quantitatively answer the question posed, we do not wish to avoid
it.
So in return we ask for refinement in the definition of criticality. Are we interested in
the global economy, or a nation state, or a business critical operation? We might very
well discover that a global economy means that a critical system to one nation resides
in another nation. For example, 80% of Ireland’s natural gas is supplied by the UK
wholesale market, and comes to Bord Gáis
Éireann from three sub sea pipelines across
the Irish sea. Thus the pressure pumps in Scotland and Wales could be considered critical
infrastructure to Ireland’s gas supply.
We also point out that criticality can have temporal variance. In the example above, if
Ireland has enough gas stored to ride-out shortages induced by temporary loss of those
sub sea pipelines, then their criticality is reduced for short duration outages.
To truly tackle this well-intentioned but poorly framed question, we must shift from a
quantitative approach to a qualitative one. Analysis must be done on the data presented
in the hope that it answers the question for a particular data point and in a particular
context. This involves investigating each individual point hoping that clues from whois
queries, hostnames, geolocation, logos on webservers, and other semi-reliable information
can allow us to derive at least the company name of the asset owner. Then it is down to
a querent to determine in conjunction with the owning organisation the criticality with
respect to a given context.
Criticality is a combination of dependency, process context, and risk. Additionally, there
is no convenient tag for criticality. Only the users of a system have a notional concept of
the utility of a system. Even then, they may not know that the system itself depends on
services such as DNS for its daily functionality. Thus while we do not wish to dodge the
question, we must admit we cannot with any confidence answer it for every single data
point in this data set.
Only further investigation can determine the answer for each data point on a case by case
basis, with respect to the context or interests of a particular organisation.