Towards Linking Indicators of Compromise to Operational Resilience and Safety Requirements

Critical National Infrastructures (CNIs) face unique challenges in cybersecurity, as they must remain operational even during attacks, making traditional Anomaly Detection approaches and Intrusion Detection Systems (IDSs) insufficient. This paper introduces a novel approach that links Indicators of Compromise (IoCs) to the safety and resilient states of CNIs using Incident Fault Trees (IFTs). IFTs model disruptive events and the conditions necessary for their occurrence, allowing us to assess potential attack paths and formulate mitigating actions without affecting CNI operations. By leveraging real-time network traffic modelling and a well-established framework for attacks, our method enhances detection and response capabilities while ensuring operational resilience. We discuss the feasibility of automating this approach and outline future work focused on applying it to physical systems in our laboratory to validate its effectiveness in maintaining continuous CNI operations under cyber threats.