A Context-Centred Research Approach to Phishing and Operational Technology in Industrial Control Systems

Abstract:

Advanced persistent threats that leverage phishing against OT are cyberattacks that endanger critical infrastructure assets nationwide. Today phishing, a human focused exploit, constitutes 91%  of successful attack vectors against federal assets. This means Human-Introduced Cyber Vulnerabilities (HICV) are the weakest cyber link. The success of these attacks also suggests HICV are neither well understood nor mitigated. To characterise HICV and provide the necessary context in which they exist, this paper introduces a research approach derived from the mature science of social ecology. The desired end result of this research is an HICV-focused risk assessment framework.


AUTHORS

Photo of Dr. Terry Merz

National Security Directorate, Computational Analytics Division Pacific Northwest National Laboratory Richland, Washington, 
United States

Dr. Terry Merz is a Senior Research Scientist at PNNL. She holds a doctorate and a master’s in Computer Science, with a concentration in Information Assurance from Colorado Technical University, and a Bachelor of Science in Information Management from the University of Maryland. Dr. Merz has 20+ years of cybersecurity experience in the areas of systems and cybersecurity engineering, research, cybersecurity testing (Blue/Red Team testing), and management. From 2014 onward, her specific area of research became the study of APT’s and the life cycle thereof. While conducting applied research on APT’s and specifically Zero-Day attacks, Dr. Merz included Behavioral INFOSEC into her research areas.

Photo of Dr. Cory Fallon

National Security Directorate, Computational Analytics Division Pacific Northwest National Laboratory Richland, Washington, 
United States

Dr. Cory Fallon is a Human Factors Psychologist with expertise in experimentation and cognitive systems engineering. His research focus is on human-machine interaction with a particular emphasis on trust in technology.

Photo of Aleksandra Scalco

United States Navy Data Science & Analytics Competency, Enterprise Data Science/Cyber Readiness Naval Information Warfare Center –Atlantic Norfolk, Virginia,
United States

Aleksandra Scalco is an Engineer with the Naval Information Warfare Center (NIWC) Atlantic. She is working towards a Systems Engineering Ph.D. at Colorado State University (CSU). Her research field is cyber resilience for Operational Technology (OT). She earned a master’s degree in Engineering from Iowa State University in 2012, and a master’s degree in Business Administration (MBA) in 2009. She is a member of the Defense Acquisition Corps in engineering. Ms. Scalco is Defense Acquisition Workforce Improvement Act (DAWIA) career certified Level 3 Engineering, Level 1 Science & Technology, and Level 1 Program Management. She holds ITIL Intermediate Certifications. Before joining NIWC Atlantic Ms. Scalco was a member of the National Security Agency (NSA) workforce as an Information System Security Designer (ISSD). As an ISSD, she provided technical expertise to clients on cyber assurance to advance the state of cybersecurity solutions to harden the National Security Enterprise against adversarial threats.

Journal of Information Warfare

The definitive publication for the best and latest research and analysis on information warfare, information operations, and cyber crime. Available in traditional hard copy or online.

Quick Links

View the latest issue of JIW.

Latest Edition

Purchase a subscription to JIW.

Subscribe

Keywords

C

C2
C2S
CDX
CIA
CIP
CPS

I

IA
ICS

S

SOA

X

XRY

Quill Logo

The definitive publication for the best and latest research and analysis on information warfare, information operations, and cyber crime. Available in traditional hard copy or online.

SUBSCRIBE NOW

Get in touch

  • Journal of Information Warfare
    114 Ballard Street
    Yorktown, VA
    23690
  • 757.871.3949
  • jiw@gbpts.com