Leveraging NIST’s Risk Management Framework (RMF) Implemented using Model-Based System’s Engineering (MBSE)
Open Access DepositedCybersecurity landscapes are constantly changing as exploits and vulnerabilities become more sophisticated in evolving digital environments. This requires organizations to become more resilient and adapt to the emerging threats aimed at compromising their assets. By leveraging the NIST Risk Management Framework (RMF), cybersecurity professionals and system engineers have implemented cybersecurity controls as a vital protection for industrial control and automation systems. However, there have been unique challenges when implementing RMF, causing real-time operating environments to operate without appropriate authorizations and to be non-compliant with standards and regulations. The current RMF implementation is inadequate, exposing organizations to cyberthreats, leading to the compromise of their operations, data, and essential infrastructure information. Addressing these challenges, this dissertation proposes research implementing Model-Based Systems Engineering (MBSE) to enforce the cybersecurity standards for Operational Technology and ICS environments. The study focuses on integrating the RMF process with other standards to achieve the most efficient implementation of cybersecurity risk and assessment. It introduces an improved NIST RMF framework with an MBSE methodology implementation specifically for real-time operating environments. The model is focused on the practical application of MBSE implementation for industrial controls and automation systems. The research successfully created a model that integrated the NIST RMF and CCI into the requirements of an operational technology system, selecting security controls specific to the component and subgroup operation. The research identifies that MBSE is a more effective strategy for the implementation of cybersecurity controls for industrial control and automation systems.
- All rights reserved
Notice to Authors
If you are the author of this work and you have any questions about the information on this page, please use the Contact form to get in touch with us.