# A Methodological Approach to Securing Cyber-Physical Systems for Critical Infrastructures
## 5 Proposed Approaches and Solutions
### Instantiating the Monitoring Component
#### 5.1.2 Monitoring Component  
Figure 3 provides an instantiation of the monitoring component of Figure 1 considering the Mobile Control Panel as a (sub-)target system. In particular, due to the extensibility and adaptability of the proposed architecture, to address the previously mentioned vulnerability, three specific components are included and showcased in Figure 3:  
* **Access Control Engine** manages the Mobile Control Panel access and enforces specific security policies defined by the Business Managers and Administrators. This component interacts with the monitoring component to send the proper authorization decision. * **Monitoring** provides a dynamic and flexible solution to transparent access control network execution or a specific sensor. It works in synergy with the Reaction component for sending notifications to specific security or performance constraints in case of violations. Such constraints are not mandatorily specified at system startup. Still, they can be automatically set via the rule engines at runtime by injecting new rules on the event processors. The monitoring component is responsible for the motion control panel, the complex event processing, and for the Access Control Engine, actuators, and sensors. It is also able to manage the generation of access control request. Figure 3: MCP abstract architectural view. * **A Firewall and Message Broker:** This component collaborates with the monitoring by collecting performance and traffic figures to detect anomalies that can be mitigated by reconfiguring in real-time (parts of) the TS, e.g., active network devices in particular, like firewalls, as thoroughly addressed in Section Firewall Reconfiguration. The instantiation also has the peculiarities of decoupling sensor management activities from resource usage and alarm administration. This eases the defining of new primitive events generated by (new/updated) sensors. Further, it renders the inference of events completely independent of the access and usage control rules. In addition, it allows for a quick update of the general resource access and usage regulations. Finally, by leveraging the specific sensor network, it leads to plane-specific corrective actions when resource violations occur and alarms are activated. Delving into technical details, in the considered instantiation, the Message Broker runs on top of an Enterprise Service Bus and it handles all communications among the monitoring components. Different solutions, like SSL certificates (self-signed certificates), can be considered to improve communication security. The sensor nodes can monitor power consumption, detect indoor movements like Passive Infrared Sensors (PIR-based motion sensors), detect environmental noise, and measure temperature and relative humidity. To satisfy the access control security issues in the current instantiation, each Mobile Control Panel user has a Bluetooth Low Energy (BLE) periodically sending a message to identify and locate the user. Considering the Access Control Engine represented in Figure 3, in the considered implementation (a subset), different control rules can be instantaneously activated or inhibited, but also (re)defined following runtime organization needs. This leaves the factory organization manager the freedom to select/define, at any specific time, the more appropriate control rules. Specific features are included for directly specifying the appropriate control rules or selecting the most suitable ones from a set of frequently adopted rules. Considering the monitoring component presented in Figure 3, a dedicated complex event processor instance is responsible for managing the frequent updates of the rule set, with the need to check the correctness and compliance of the new rules. This includes the possibility of overriding the active rules set with a new one, with no impact on the overall factory management.