Development of Threat Modeling and Risk Management Tool in Automated Process Control System for Gas Producing Enterprise

The paper describes the development of a software complex based on the method of assessing information security (IS) risks of automated process control systems (APCS) at enterprises of the gas industry, which make it possible to increase the efficiency and control of the technological process. These enterprises are hazardous production facilities; their operation may include emergencies caused by insufficient security of the industrial control system. The proposed method considers the specific features of typical gas production enterprises, allowing identifying current threats and vulnerabilities in the system. Considering the characteristic requirements of providing IS of automation systems for gas production enterprises, actual classes of solutions for providing IS were considered, the most appropriate class was selected, and modern representatives of this class were considered. None of the listed solutions fully satisfied the requirements of providing IS for APCS of gas-producing enterprises. Consequently, a software complex was developed for hazard modeling and IS risk assessment that meets the specified requirements; the interface of the software is described.