S4 in Florida (USA) is the world's largest conference for OT security. Many new ideas and major innovations are presented there for the first time. One of these ideas this year was a free, freely available web application that security decision-makers can use to penetrate technical systems in just a few steps and find the most important security measures. As a result, they receive a “Cyber Decision Diagram” that shows the most important system function, the worst possible event, the most likely attack vector and the most relevant security measures on one page in a way that is easy to understand.
The Cyber Decision Diagrams are developed, provided and maintained by the German cybersecurity company admeritia. They are a result of the BMBF-funded research project “IDEAS” on security by design in automation technology, which was completed last year. The project was also the basis for the dissertation “Cybersecurity Decision Diagrams” by Sarah Fluchs, IDEAS project manager and CTO of admeritia.
Structured decision-making for industrial cybersecurity
The Cyber Decision Diagrams guide users to their own diagram in five steps:
- Identify the worst possible event in their organization,
- define the cyber component where this event manifests itself,
- Model the most influential function of this cyber component,
- draw the most likely attack path and
- mark the most relevant security requirements in the diagram.
The application provides templates and examples for all steps.
A core idea of the cyber diagrams is the visual, function-based approach to modeling the system to be protected. “This is very useful for engineers who are used to thinking in terms of functions and technical drawings,” explains Sarah Fluchs, ”they can efficiently pour their valuable knowledge into diagrams that are easy for everyone to understand.” This means that the engineering knowledge required for informed OT security decisions can be made accessible to security teams.
Web-based, free and practice-validated
The Cyber Decision Diagrams are designed as a freely accessible web application. They run directly in the browser and store all data exclusively locally in the cache, without tracking user activities or storing information on external servers. Results can be exported as PDF files. These are also not saved and users can store them locally.
The Cyber Decision Diagrams can be created at cyber-decision-diagrams.com, and your own diagram can also be downloaded as a PDF and used freely. “Dear Cybersecurity Community: this is for you”, said Fluchs at S4 when she announced the tool - and the community seems to be taking to it well. “We've had initial feedback that the diagrams have been used successfully in cybersecurity training sessions and decision-maker meetings,” she says enthusiastically. “I'm really happy about every email we receive with experiences and drawings created.”
For companies seeking deeper integration into existing cybersecurity strategies, admeritia offers the Security Engineering Tool (SET) as a commercial solution based on the Cyber Decision Diagrams.
Further information and free access to the application can be found at cyber-decision-diagrams.com.
