Assessing Cyberworthiness of Complex System Capabilities Using the Cyber Evaluation and Management Toolkit (Cemt)

Abstract

Cyberworthiness, as it is termed in Australian Defence, is a necessary feature of modern complex systems that are required to operate in a hostile cyber environment. To evaluate the cyberworthiness of complex systems or system-of-systems, the researchers developed a Cyber Evaluation and Management Toolkit (CEMT) which leverages model-based systems engineering techniques to examine a cyber-physical system’s vulnerability to, and risk of, cyber-attacks. This assessment method addresses the cyber attack surface and threat kill chains, including supply chains and supporting infrastructure. Our previous research developing the CEMT is summarised and the research results of an implementation trial on a naval capability are presented. CEMT is novel to other similar assessment approaches articulated in the literature research by being threat-led and using visualisations tailored to inform decision-makers without specific cyber expertise. The results of the research trial are promising and provide strong justification for the continued application of the CEMT when evaluating and assessing the cyberworthiness of complex cyber-physical systems.

Keywords: cyberworthiness, cybersecurity, Model-Based Systems Engineering, Complex Cyber-Physical Systems, Case Study, Operational Evaluation