Digital twin architecture for cybersecurity incident response in instrumentation and control systems

The Security Operations Centre (SOC) of a Nuclear Power Plant (NPP) is tasked with triaging and responding to a large volume of cybersecurity-related information during Incident Response (IR). While Security Information and Event Management (SIEM) solutions aim to address this issue, previous studies highlight that one of the biggest challenges in IR is contextualizing secu-rity data and decisions. In complex critical infrastructures, there can be added barriers in carrying out response strategies, as safety and availability are two of the most highly valued attributes of critical infrastructures. This paper proposes that Digital Twins (DTs) - virtual representations of real-world systems - can provide this context and automate response strategies. The majority of existing DT research focuses on non-cybersecurity tasks, such as predictive maintenance and increasing operational efficiency, and the work that does address cybersecurity often focuses on a single aspect within IR, such as anomaly detection. There are even fewer works that demonstrate DT-aided IR in practice. This paper proposes and describes an implementation of an architecture for a DT platform to support IR in NPPs. The architecture leverages several modelling and anal-ysis methods for assisting the SOC as they ask context-related questions about the system state. Furthermore, the proposed DT architecture considers the input and requirements from stakehold-ers outside the SOC to adjust the level of response automation and system intervention of the DT platform. This preserves system safety and availability, and provides assurance in the of this new, emerging technology. Preliminary results from a proof-of-concept implementation-utilising a application hardware-in-the-loop testbed with a simulated Pressurized Water Reactor (PWR) as the real world system - and the platform's effectiveness in providing context during an intervention are discussed.