SICIA Security Indicators for Critical Infrastructure Analysis

In the SICIA project, a procedure is developed with which operators of critical infrastructures can determine the current state of IT security in their facilities.This type of assessment is already required in many industry-specific guidelines as a prerequisite for the continuous improvement of security-relevant IT processes. However, a concrete approach that allows differentiated evaluation even of complex infrastructures down to the device level is not yet available.
 In contrast to existing assessment methods, the analysis developed in the SICIA project dispenses with the consideration of hardly determinable, hardly quantifiable threats. Above all, the developed safety indicators consolidate technical parameters into numerical values ​​in order to make the actual IT security visible to operators.
 The comparison of the identified security indicators at the system and device level then allows the detection of vulnerabilities and a prioritization of improvement measures in complex infrastructures. A tool is being developed to support the assessment of potential improvement actions. This allows an automated determination of parameters, their compression and a simulation of the effects of potential improvement measures. Particularly effective measures become visible and can be selected by the operator.