Information technology in control

A procedure for assessing security updates in industrial systems

K. V. Semenkov, V. G. Promyslov

Trapeznikov Institute of Control Sciences, Russian Academy of Sciences, Moscow, Russia

Abstract: This paper is devoted to the problem of applying cybersecurity updates (patches) for the software of instrumentation and control systems (ICS) with a long lifecycle. The problem is considered for the system operation stage. The main focus is on the large number of vulnerabilities found in software, the complexity of analyzing the impact of a vulnerability on system security, and the requirements for testing the compatibility of updates and software certification after changes have been made. Based on the Failure Mode and Effects Analysis (FMEA), a procedure is proposed to simplify the analysis of the impact of a vulnerability on cybersecurity. This procedure considers a smaller set of attack scenarios rather than each vulnerability separately. The analysis of attack scenarios also covers the effect of security measures. The procedure includes simple criteria for applying security updates based on the analysis results. An example of vulnerability analysis using this procedure is provided.

Keywords: vulnerability, patch, risk assessment, instrumentation and control system (ICS), cybersecurity, criterion.

UDC: 004.056

Received: 06.06.2024
Revised: 18.03.2025
Accepted: 28.04.2025

 English version: Control Sciences, 2025:2, 49–61 (PDF, 1766 kB)