Prioritisation and cost / benefit analysis of cyber security controls within existing operational technology environments

摘要

Protection and control (P&C) systems are critical to the operation of electricity transmission and distribution networks. The digitisation of the P&C systems has unlocked many new efficiencies and capabilities but has also brought with it new risks with respect to cyber security. The critical role these devices play in interfacing between the ‘cyber world’ and the ‘physical world’ makes them a target for threats for those who want to cause the greatest interruptions to a nation's electricity supplies. A cyber risk methodology using event trees is proposed to understand the benefits of different cyber security controls within existing substation environments. This moves the industry from a maturity driven and checklist based approach towards a risk driven one based on an understanding of cyber security threats; and allowing organisations to produce a cost benefit assessment which may support planned investment as well as providing a justified position when deciding not to invest in particular areas.