Bayesian Business Continuity Analytics for Cyber-Disrupted Industrial Process Workflows
Main article
Abstract
Cyberattacks against industrial process environments increasingly disrupt business workflows rather than only technical assets. A compromised sensor, a delayed control command, or a suppressed alarm can propagate into production interruption, rework, delayed customer fulfillment, and contractual service-level penalties. This article develops a Bayesian business continuity analytics framework for cyber-disrupted industrial process workflows. The framework translates cyber and control-system evidence into workflow-level continuity states and estimates the posterior probability of normal operation, degraded operation, interruption, and recovery. It integrates workflow decomposition, cyber-physical evidence mapping, Bayesian network reasoning, and business impact analysis in a single decision-oriented structure. A simulated industrial fractionation workflow is used to demonstrate the approach across five cyber-disruption scenarios, including sensor spoofing, PLC command denial, alarm suppression, historian compromise, and a multi-vector attack. Results show that technical events have sharply different continuity consequences depending on their location in the workflow, the availability of manual fallback, and the delay before recovery. In the most severe multi-vector scenario, the posterior probability of interruption rises to 0.50, while the expected continuity loss exceeds the baseline fault scenario by more than four times. Sensitivity analysis identifies recovery delay, alarm suppression, PLC command loss, and sensor spoofing as the most influential continuity drivers. The study contributes to business data analytics by connecting cyber-physical risk evidence with probabilistic continuity metrics that managers can use for prioritizing resilience investment, redesigning workflow controls, and communicating operational risk in financial terms.
