Prioritizing Obstacles to Industrial Control Systems Security Management Implementation, using Interpretive Structural Modeling (ISM) Approach

Although information system security has been developed extensively, industrial control systems (ICS) security is a newly developed concept and is still unknown to some organizations. Increasing the access to ICS and the related networks, has increased the challenges their security is facing. On the other hand, to those organizations which are aware of the importance of this issue, the roadmap is vague. In this article, we prioritize the obstacles to implementation of ICS security management, using the interpretive structural modeling (ISM). Mobarakeh Steel Company is studied as a case here. The identified barriers, are           investigated by expert staff in the form of pair wise comparison matrices, and the results are prioritized. Also, by using Matriced’ Impacts Croise’s Multiplication Applique´e a UN Classement (MICMAC) analysis method, the barriers effectiveness and dependencies are obtained. Analyzing the results indicates the "unawareness and lack of knowledge of staff" as the most fundamental obstacle, and "non-native plans"  and "lack of the security supervisor in the organization" as the elements that should be considered while the     organization is dealing with cyber security. At the end, the correlation relation between the obstacles’    significance level and their dependencies is studied using Spearman correlation coefficient method,        revealing strong inverse relation between those two elements. This shows that less dependent obstacles have effects which are stronger and in the more fundamental level.