A model of artificial intelligence in cyber security of scada to enhance public safety in UAE - Alhashmi, Omar (2023)
The dependence of industrial systems, including Supervisory Control and Data Acquisition (SCADA) systems, on AI technology is growing rapidly. Given the mandate of AI to achieve efficient and effective industrial supervisory systems, the pertinent threats resulting from both internal malfunctions and external cyber sabotage, and the defence mechanisms often installed internal and external to the systems, the time seems right for an all-inclusive model of AI critical evaluation threat-resilience model. This futuristic model places AI as the main actor and regresses the role of humans into a supportive position. The aim of the study is to critically examine the threat-resilience of AI-SCADA systems in ensuring improved public safety to arrive at critical implications to UAE cybersecurity governance. To address the research questions outlined, the study employs an explanatory sequential mixed methods design (Creswell & Plano Clark, 2011). The explanatory sequential mixed methods design encompasses the collection and analysis of quantitative data followed by qualitative data. The first stage of the study involves qualitative research, The first stage of this study involves a qualitative exploration followed by Qualitative findings informed the development of a survey instrument that was used to collect data from a larger population. The qualitative survey research employed empirical data from the three main groups of stakeholders: the regulators of key SCADA sectors, SCADA operators in the UAE, and clients of SCADA Systems. Critical attention is paid to the utility and oil and gas sectors as central to the use of SCADA systems in a context where public safety is most vulnerable. A sample of 380 SCADA-related project managers is considered sufficient to generalise the results to the study population, even though 219 were considered useful for empirical analysis after data cleansing. While for the Qualitative research, data were collected with the help of interviews, document analysis and observation. This phase involved the top 2 SCADA operators who control approximately 60% of all non-law enforcement-related systems and their respective clients. The Qualitative research was implemented in a leading role, whilst the qualitative survey research was applied to support the study findings in this regard. Findings from the Qualitative study and survey research are largely complementary. Exploratory evidence revealed three key security operationalisation areas: risk management, physical and environmental management, and user access management. Findings show that risk management of AI-based SCADA systems is optimal in both the utility and oil and gas sectors. However, physical and environmental management in the utility sector is at optimal levels even though the oil and gas sector is mainly lagging in system governance. Also, user access management in both the utility and oil and gas sectors is lagging in terms of governance and external defence systems. As part of the survey, findings reveal that human governance is a valid mediator of the model, whilst defence systems also significantly moderate the relationship between attack resilience and public safety. Evidence also shows that the utility and oil and gas sectors differ significantly in the operationalisation of the research model; moreover, the AI threat-resilience model was validated among the operational levels of the sector organisations. It is recommended that cybersecurity ii governance be made a mandatory policy for oil and gas companies, utility companies, and organisations that use AI-based SCADA systems.