The problem real time-based incident response in industrial control system

The cybernetic approach to the analysis of control systems is based on the components comprising the system: the control hardware, forward (and reverse) communication channels, and the interface with the controlled object. The flow of control information to the controlled object and information about its status constitute the control cycle. Control of a multi-component system is carried out through a set of communication devices connected to the system and a corresponding number of control cycles. Failure and/or malfunction of the technical components of control loops leads to a loss (or reduction) in control quality. One of the primary functions of critical infrastructure facilities is the real-time management of technological processes. The use of the Internet to establish direct (two-way) communication channels poses a risk of unauthorized interference in the form of a cyberattack. A cyber incident response specialist must promptly detect, analyze, contain, and mitigate cyberattacks, as well as restore the normal operation of the process control system in real time. Currently, the existing scientific framework does not meet practical requirements, which poses a scientific challenge. This paper proposes an adaptation of a decision-support methodology for operational personnel of real-time process control systems. What is novel about this approach is the distinction between situations of system failure and malfunctions of technical equipment caused by the consequences of a cyberattack. Factors have been identified to assess the duration of the time interval from the detection of the first signs to the full manifestation of a cyberattack.