An Industrial Control Systems incident response decision framework

The integration of Industrial Control Systems (ICS) with Information and Communication Technologies (ICT) systems has resulted in tremendous increase in the number of ICS security incidents. Current ICS incident response practices can hardly be applied into ICS directly as the two systems are fundamentally different in terms of system complexity, criticality, flexibility and dependability. This paper addresses this challenges by proposing an ICS incident response decision framework. It is based on decision-making theory and has descriptive, predictive and prescriptive models that particularly address ICS incident response decision-making. This framework is implemented using a service-oriented architecture (SOA) that provides incident response decision making as services and offers standardized interfaces to integrate with existing incident management systems.