An Automated Risk-Based Critical Security Control Selection Approach for Research Infrastructures

Abstract

Research infrastructures (RIs) face increasing cybersecurity challenges due to their growing reliance on digital and intelligent technologies. The expanding attack surface, limited security resources, and the inherent conflict between open scientific collaboration and strict security isolation contribute to these challenges. While security controls are essential for ensuring reliable system operation, existing mainstream cybersecurity frameworks have several limitations in control selection. They inadequately address RI-specific risks, incur high implementation costs, and lack systematic methods for selecting optimal control subsets. This paper presents a risk-based method for security control selection and evaluation. The method leverages large language models (LLMs) to automatically extract and structure RI cybersecurity risks from unstructured text. It then simulates adversary attack paths by integrating organization-specific risk profiles with the MITRE ATT&CK framework. Risk-relevant security controls are identified through threat-informed mitigation mapping. The selected controls serve as evaluation benchmarks to quantitatively assess mainstream frameworks. Experimental results demonstrate that the CIS Critical Security Controls (CIS Controls) offer stronger practical operability compared to the highly abstract NIST Cybersecurity Framework (CSF) in realistic threat scenarios. A case study conducted at a Large-Scale Research Facility (LSRF) shows that 92.9% of the identified controls align with expert security consulting recommendations, indicating strong applicability in complex research environments.