Security evaluation of IT systems underlying critical networked infrastructures

Critical infrastructures have become highly dependent on information and communication technology (ICT). The drawback of this situation is that the consequences of disturbances of the underlying ICT networks may be serious as cascading effects can occur. This raises a high demand for security assurance, with a high importance assigned to security evaluations. In this paper we present an experiment-centric approach for the characterisation and assessment of security threats to information systems of industrial critical infrastructures. The description of the approach is followed with a presentation of the supporting hardware and software architecture.