A Data Processing Pipeline for Cyber-Physical Risk Assessments of Municipal Supply Chains

Smart city technologies promise reduced congestion by optimizing transportation movements. Increased connectivity, however, may increase the attack surface of a municipality's critical functions. Increased supply chain attacks (up nearly 80 % in 2019) and municipal ransomware attacks (up 60 % in 2019) motivate the need for holistic approaches to risk assessment. Therefore, we present a methodology to quantify the degree to which supply-chain movements may be observed or disrupted via compromised smart-city devices. Our data-processing pipeline uses publicly available datasets to model intermodal commodity flows within and surrounding a municipality. Using a hierarchy tree to adaptively sample spatial networks within geographic regions of interest, we bridge the gap between grid-and network-based risk assessment frameworks. Results based on fieldwork for the Jack Voltaic exercises sponsored by the Army Cyber Institute demonstrate our approach on intermodal movements through Charleston, SC and San Diego, CA.