Application TRIKE Methodology When Modeling Threats to APCs Information Security

In the modern world automation technologies of industrial processes have found wide application. Automated process control systems have become an important part of enterprises that operate in different economic fields and life support facilities all over the world. Nevertheless, the high growth of automation means raises the acute problem of providing APCs information security from external and internal threats. There are systematic reports in the media about new critical vulnerabilities in industrial equipment and attacks based on the exploitation of such vulnerabilities. When designing such systems it is necessary to estimate possible information security threats that already exist in the system or that are predicted to appear. That is why threat modeling is an important part of providing information security at industrial facilities using automation. In this work the author investigates the methodology of estimating threats to software security TRIKE. The research is aimed at finding general approaches to determine threat sources, tactics, and techniques for making implementation scenarios of threats to software information security, for applying them to provide cyber security of automated process control systems. In the frameworks of the subject mainstreaming, the research gives a description of cyber-attacks at big industrial facilities, and their basic vulnerabilities are emphasized. In the article the analysis of TRIKE methodology has been done. It is aimed at determining basic threat modeling stages applicable to industrial automation systems. The approach of TRIKE methodology to generating a list of threats to information security is formalized. To achieve the aims the author constructs DFD data flow diagrams with the decomposition of peculiar elements of the algorithm for modeling threats to information security of automated process control systems using TRIKE methodology.