Högskolan i Skövde

Critical infrastructures (CIs) distributing water, oil, gas, electricity, etc., to community residents and businesses, leverage cyber-physical systems (CPSs) to supervise and control the physical processes that these services entail. Over recent decades, these systems have moved to implement more modern IT-resembling solutions using Supervisory Control and Data Acquisition Systems (SCADA) for increased reliability, scalability, and remote connectivity. This change exposes these highly critical systems to new threats and vulnerabilities. One approach to mitigate the risks faced by these systems is to perform analysis on digital representations in the form of digital models or digital shadows of the CPSs. However, this is not a trivial task in practice. These practical issues are explored in this design science research through the development of a guidance process to perform the data collection necessary to create a static digital model of a small-scale power grid CPS in Sweden. The results show that it is possible to gather information on the CPS components through the four approaches: SCADA system exports, documentation information, CLI scripting, and network scanning. While the artefact presented in this report demonstrates these results, challenges still remain such as a lack of SCADA export tools, reaching the SCADA network with scanning tools in a responsible manner, and accessing insights into the complete documentation held by the organisations. The researcher suggests these topics for future research directions.