Cyber security assessment of a power plant

Abstract

Relevant results from long lasting work on C(I)IP will be tangibleWith the tenth ECN issue the articles move from awareness to case studies, results of C(I)IP research and conceptual innovations. C(I)IP is now discussed for years at policy and conceptual levels. The policy actors have completed fundamental studies and start to take action. About this IssueAndrea Servida highlights the background on which an EU policy initiative on Critical Communication and Information Infrastructure Protection (C(I)IP) may grow and gives inside into the action points of this initiative. Two articles on the Integrated Risk Reduction of Information-based Infrastructure Systems "IRRIIS" project follow:• An overview on IRRIIS is given, pointing out the SimCIP simulation and the four components of the middleware improved technology MIT.• Functional principle of MIT middleware improved technology and its four main component give insights on the tool.The EUropean Risk Assessment Methodology project EURAM integrates with the same yardstick risk assessment form corporate level up up to European level. The elaborated results are presented and an outlook for the successor project EURACOM is given. A report on The First Dutch Process Control Security Event is given by EricLuiijf pointing out the strong need for actions in securing PCS. Three general recommendation discussed during the Event are disclosed to the reader.The Royal Academy of Engineering published its report Dilemmas of Privacy and Surveillance in March 2007. In spite of all securing measures this report demonstrates how to consider urgent demands of our privacy.Today's risks to the financial sector discloses that "Financial Industry Sector" lost its e-innocence: New e-risk factors have appeared. As a result, the financial sector has to deal with e-espionage, identity theft and the problems of international terrorism. Cyber Security Assessment of a PowerPlant analyses in a true corporate environment the risk of attacking the power process control environment. The results are presented in text and graphs. , will be to enhance the level of CIIP preparedness and response across the European Union. To achieve this aim, the initiative will build on national and private sector activities and will involve relevant public and private stakeholders in ensuring that adequate and consistent levels of preventive, detection, emergency and recovery measures are put into operation to ensure a high level of security and resilience of critical communication and information infrastructures as well as to guarantee the continuity of services. Governance and Risk Management in a globally integrated Ecosystem The preparatory stepsTo prepare the initiative on CIIP, the Directorate General Information Society and Media of the European Commission has launched a number of studies and consultations.The first study was launched in 2006 to assess the on availability and reliability of electronic communication infrastructures. The study, which is called ARECI and was carried out by Alcatel-Lucent, has iden...

A Security Assessment Model for Electrical Power Grid SCADA System

“…A typical electrical power grid includes several control centres to manage the generation, transmission, and distribution of power throughout the grid [24]. Therefore, the electric power critical infrastructure is highly interconnected, consisting of several utilities and distributed substations.…”

A Development Framework for Software Security in Nuclear Safety Systems: Integrating Secure Development and System Security Activities

“…The framework includes processes for a security risk and vulnerability assessment. As efforts in the nuclear industries, Nai Fovino I [12] presented the outcome of information and communication technology (ICT) security assessment targeting an operational power plant. The results show that the vulnerability of a plant to malicious attacks is severe.…”

Robustness of Optimal Investment Decisions in Mixed Insurance/Investment Cyber Risk Management

“…(). Specific attention has been paid in the literature to power systems (see, e.g., the papers by Ericsson, ; Fovino, Guidi, Masera, & Stefanini, ; Onyeji, Bazilian, & Bronk, ; Sun, Hahn, & Liu, ), industrial control systems (dealt with in the papers by Cherdantseva et al., ; Ralston, Graham, & Hieb, ), and nuclear plants (as in the papers by Park, Suh, & Park, ; Shin, Son, & Heo, ). Whatever the specific infrastructure, securing it requires an investment in cybersecurity tools and policies.…”

“…Cyber risks represent a major source of concern for several utility and industrial infrastructures, due to both the risk arising in individual infrastructures and that deriving from the interconnections and interdependencies among them, as shown in the papers by Kröger (2008) and by Maglaras et al (2018). Specific attention has been paid in the literature to power systems (see, e.g., the papers by Ericsson, 2010;Fovino, Guidi, Masera, & Stefanini, 2011;Onyeji, Bazilian, & Bronk, 2014;Sun, Hahn, & Liu, 2018), industrial control systems (dealt with in the papers by Cherdantseva et al, 2016;Ralston, Graham, & Hieb, 2007), and nuclear plants (as in the papers by Park, Suh, & Park, 2016;Shin, Son, & Heo, 2017). Whatever the specific infrastructure, securing it requires an investment in cybersecurity tools and policies.…”