Metodologia para Avaliação de Maturidade de CiberSegurança em Infraestruturas de Serviços Críticos
Antunes, Fernando Jorge da Silva
MSc Thesis · 2023 · University of Coimbra
Supervisor: Tiago José dos Santos Martins da Cruz
Abstract
The dependence on computational and infrastructure resources allowing for a quick, effective, and permanent response to society's needs has been growing and diversifying over the past years. In fact, the criticality of an infrastructure increases with the number of services and consumers that rely on it, with the associated risks also increasing proportionally, requiring greater visibility and control. This concern has grown over the past two decades, especially when these infrastructures began to leverage the open protocols and the internet as a means to expand their reach and effectiveness, becoming accessible from small devices with internet connections.The infrastructures that support essential services in various sectors of activity are thus required to be permanently available, moreover given their cross-domain utilization that often transcends national boundaries. This dependence necessarily translates into a concern that extends beyond the scope of the entities and organizations responsible for providing and maintaining these services. From this perspective, the involvement of bodies such as the European Commission has been notable, providing guidance to its member states to protect these infrastructures and creating specific legislation for this purpose, to be transposed for the local/national domains by each member state. In this way, each country is responsible for enforcing laws and monitor their applicability, thus ensuring that citizens are not deprived of these essential services, whose inhibition may impact a large number of people and interdependent services, potentially creating a ripple effect. With the rising tide of cyberattacks against critical infrastructures that the world has witnessed in recent years, as well as conflicts between countries that are themselves providers of essential services (but often have a strong history of involvement in cyberattacks against other nations), the need to enhance security and resilience in critical infrastructures is a mandatory and urgent requirement that must be safeguarded, considering the impact it would have if these infrastructures were compromised.Throughout this work, we will propose the development of a methodology that can assess the maturity level of critical service infrastructures by validating the effectiveness of key controls associated with specific cybersecurity domains. To achieve this goal, we will consider the most relevant domains for this type of infrastructure, especially those with a lower maturity level and a higher exposure to the risk of compromise, which would have a more significant impact on the normal functioning of the entire infrastructure.