The article shows that the transition of the electricity industry to technological innovation based on the new paradigm - Smart Grid - leads to an increase in cyber threats. The dependence of operational risks in the electric power company on information security risks was identified, taking into account direct and indirect losses from the implementation of cyber threats. The classification of cyber risks is carried out, approaches to their assessment are investigated, and the interaction of the structural units of the company in the implementation of cyber threats, the assessment of cyber risks and taking countermeasures is considered. It was proposed that power companies include cybersecurity among strategic priorities and report on cybersecurity risks along with information on operational risks. The study noted that for the smart grid, cybersecurity is a strategic priority, and in this regard, it was proposed to ensure proper internal control of the cyber risk management processes, provide stakeholders with full information on cybersecurity incidents to respond appropriately. The authors have proposed to ensure the filling of a vacuum between the leading link operating in terms of business processes and operational risks, and the technical link operating in terms of cyber risks and technical and organizational means of protection against them.
Currently, in Russia, in the conditions of digitalization of the economy, there is a certain interest in the actively developing worldwide in the last decade, the direction of the transformation of the electric power industry based on the concept of Smart Grid. Smart Grid is interpreted as the concept of modernization of the electric power industry, as it * is based on the revision of a number of existing basic rules and principles of modernization of the industry.
The principles of developing smart grids are defined through the Smart Grid
European Technology Platform [
The introduction of the Smart Grid concept provides for the development of smart grid technology and means a fundamental technological reorganization of the electric power industry. A network operating on the basis of the Smart Grid concept is capable of identifying the damaged area itself, de-energizing it and automatically powering consumers who are briefly left without electricity. Controllers with freely programmable logic implement algorithms for configuring consumer power circuits in various emergency situations and provide network automation. However, by providing great opportunities, a smart energy network carries great risks for consumers and owners, which is due to the size of the company and the high cost of risk-prone assets.
Energy companies are characterized by both general risks and specific to one or
another type of activity, depending on the scope of their functioning. In the information
systems of network companies, risks can be identified and enhanced at any point in the
life cycle of these systems, from the decision to develop a system to the commissioning
of the system for commercial operation. However, the methods of creating information
systems cannot be separated from the main goals of entrepreneurial activity and cannot
be unrelated to environmental influences and limitations [
The purpose of this article: 1. to investigate in the electric power company the processes of integrating information security (IS) risks (cyber risks) into operational risks (OR); 2. to study the interaction of the departments of the electric power company in the process of risk management during the implementation of cyber threats; 3. define the management of cyber risks as a priority strategic direction for the development of the electric power company in its transition to the new paradigm - Smart Grid. 2
Information systems are created in order to prevent the operational risks of the
electricity company. This risk may be in the form of an increase in the cost of services provided,
a decrease in income. Information systems of electric companies should reduce these
risks, increasing the effectiveness of managers' actions, based on mathematical models
for optimizing risks and methods for managing cyber risks at various levels: enterprise,
regional, federal [
However, information systems that are designed to prevent operational risks independently carry the risks of increasing cash costs for the system and the deterioration of the company’s work associated with putting the system into operation. Figure 1 shows a diagram of the risk flows in various fields that affect the information system of a network company.
Operational risk includes information security risk. The risk of information security includes cyber risk and other risks of information systems.
Cybersecurity should be part of the corporate philosophy, and for this, it should at
least be integrated into the business development strategy and the business risk
management system (operational risks), by analogy with the approach to managing
operational risks in the banking sector (BASEL III) [
Key terms in this area are [
In this case, the assessment of cyber risks is carried out using: ─ expert assessments (directly (explicitly) or indirectly - using special software and hardware, the logic of which contains some knowledge base about the dependence of a measure of cyber risk on the observed conditions); ─ historical information about the likelihood of the vulnerability and damage from its implementation (the disadvantages of the method are the need for a sufficiently large amount of historical data (and for some threats they may simply not exist) and the inability to accurately assess the trend in the event of a changing situation, which we observe in almost all areas of cybersecurity); ─ analytical approaches (which are mostly in academic development), for example, with the construction of weighted transition graphs to determine the magnitude of the damage from the implementation of the vulnerability.
Measures aimed at countering cyber risk (reducing the overall risk of an organization)
include:
─ passive actions:
o adoption of cyber risk (decision on the acceptability of the observed level of a
given cyber risk without any countermeasures);
o evasion of cyber risk (decision on the transformation of activities that would
entail a given level of cyber risk);
─ active actions:
o limitation or reduction of a specific cyber risk (consists of a set of
organizational and technical measures that we are used to taking as measures to ensure
information security);
o risk transfer (insurance) is still a rather rare procedure, which gradually gains
recognition;
─ a set of measures for internal audit and internal and external monitoring of the state
of cyber resistance (cybersecurity). First of all, they check the quality of the
implementation of measures to reduce cyber risks, their adequacy, their performance of
the target function in the course of internal changes in the company, and only then
they assess the changing external environment (the emergence of new types of
threats and new ways of implementing the already known). In all cases, if a
significant discrepancy is found between the current situation and the measures taken, the
monitoring subsystem should initiate a partial or full review of the company’s policy
regarding information security measures [
The power company Federal Grid Company of Unified Energy System (FGC UES,
PJSC) provides half of Russia's total energy consumption due to the electricity
transmitted through its networks. FGC UES, PJSC is one of the largest enterprises in the
electric power industry, rendering services in the transmission and distribution of
electric energy, in connection to electric networks and in the collection, transmission, and
processing of technological information, including measurement and accounting data.
This company implements certain elements of the Smart Grid concept. This electric
power company has an operational risk management system (hereinafter referred to as
the “ORMS”). The goal of the ORMS is to ensure sustainable continuous operation and
development of the company by timely identification, assessment and effective
management of risks that pose a threat to the effective conduct of business activities and the
company's reputation, the health of employees, the environment, and the property
interests of shareholders and investors [
For the initial analysis of cyber risks, the following approaches can be used
[
For a more in-depth analysis of cyber risks, the following can be used [
Electricity company regarding the assessment of risk indicators: ─ determines quantitative and qualitative indicators of the propensity for OR for the planned annual period, including IS risk (risk appetite for OR and IS); ─ sets the target levels of these indicators: signal (acceptable) level and control (limit) level; ─ calculates and substantiates the signal and control values of risk appetite indicators when approving a risk and capital management strategy.
The FGC UES approved a register of 19 key operational risks, assesses their impact on the achievement of the Company's performance targets, annually updates the materiality level and takes measures to manage risks.
The company uses three methods of responding to risks: risk avoidance; risk-taking; reduction or transfer of risk (Fig. 2). The choice of risk response method depends on the significance of the risks. Risks of a critical level are unacceptable for the company and are subject to priority management. Risks with a critical level include “The risk of deviation in the volume of electricity transmission services compared to the set value in the business plan”, “The risk of deviation in the volume of overdue receivables from the amount set in the business plan”.
Risks with a significant level include “The risk of deviations in volumes of technological connections compared to the value set in the business plan”, “The risk of not reaching the level of reliability of electricity transmission services established in tariff regulation”. Risks of a significant level are not critical, but have a significant impact on the activities of the company and are subject to management.
Risks of a moderate level do not significantly affect the company's activities but are
subject to periodic monitoring. Risks with a moderate level include “The risk of not
achieving the level of quality of services established by tariff regulation”, “The risk of
deviation from the value of the indicator of labor productivity increase established in
the business plan” [
The operational risk management system in an electric power company consists of the following elements: 1. a specialized unit of the organization that performs operational risk management procedures - operational risk management services (ORMS); 2. a specialized unit of the organization that performs IS risk management procedures (IS service); 3. divisions - owners of the company's business processes and divisions providing the organization's business processes (hereinafter referred to as competence centers), using information technologies and carrying out risk identification, collecting information and informing about the identified risk, assessing the identified risks inherent in the processes of competence centers (in within its competence), the development and implementation of measures aimed at reducing the negative impact of operational risks and IS risks, as well as monitoring the level of operational risk and IS risk in their processes; 4. classifiers used in the operational risk and information security management system; 5. an event database containing information on events of operational risk and IS risk and losses from all types of risks; 6. benchmarks of the electric power company and a system of measures aimed at improving the quality of the information security management system and reducing the negative impact of risks; 7. an automated information system, the volume, and functionality of which is determined by the nature and scale of the operations and current processes of the electricity company.
Cyber risk integration processes in the operational risk management system can be
represented as follows:
1. The information security service ensures the identification of IS incidents (IS risk
events) and the identification of sources, threats, and vulnerabilities of the threat
(attack) implementation, the identification of business processes, systems affected
by the incident, produces an immediate response to the incident in accordance with
the procedure established by the company and transmits information about the
incident to the business unit and to the ORMS.
2. Units of the electric power company respond to the incident: they suspend business
processes, block accounts, etc. and transmit the consequences of the incident to the
ORMS.
3. The operational risk management system determines the extent and degree of impact
of the incident (IS risk event) on other risks and business processes, classifies the
incident according to the operational risk methodology and reflects it in the event
database.
4. The operational risk management system, together with the business units and the
operational risk management system, determines incident losses (IS risk events);
defines measures to minimize other risks depending on the realized risk of information
security.
5. The business unit provides information on losses in the information security system.
6. The information security system determines the effectiveness of measures to ensure
an immediate response to an incident (IS risk event).
7. The ORMS, structural units and the information security service organize events
aimed at minimizing the consequences of the implementation of IS risk (cyber risk)
and other types of risk.
8. The information security service evaluates the effectiveness of measures to minimize
the risk of information security (cybersecurity risk) and the level of residual risk.
To implement the processes of integrating cybersecurity into the company's operational
risk management system, the bow-tie method can be used [
Analysis of the threats and measures to reduce the probability of an event Danger and threat
Measures to reduce the probability of
an event
Threat No. 1 (description) Risk of Measure No. 1. Administrative mechabreach of nisms to contain, prevent, detect, and confiden- mitigate risks (staff training, data entiality, un- cryption, system testing, polygraph author- testing, knowledge of the Criminal ized ac- Code) cess Measure 2. Technical and logical mechanisms for containing, preventing, detecting, and neutralizing risks (password system, system log, public key infrastructure, secure protocol, secure OS) Measure 3. Physical protective equipment (physical barriers screens and means of access) Impact analysis and mitigation measures
Effects
Prevention and mitigation measures
Is the barrier new or existing? C B B Barrier Performance:
B high
The responsible party for the reliability of this
barrier Department of Internal Control and Risk Management Department of Internal Control and Risk Management Department of Internal Control and Risk Management The responsible party for the reliability of this barrier Consequence No. 1: (description) Violation of the confidentiality of the system, unauthorized access to the system, the consequences of which is the implementation of the operational risk of deviation of the volume of electricity transmission services in comparison with the set value in the business plan
Measure 1. Implementation of measures aimed at minimizing the consequences of the implementation of IS risk (cyber risk): administrative, technical, logical recovery mechanisms procedures for the quick recovery of system files, antivirus tools, etc.
Measure No. 2 Ensuring the functioning of the system for responding to a violation of the confidentiality of the system, unauthorized access: taking action against employees who committed a cybersecurity incident, entering the incident in the event database Measure No. 3 Implementation of measures aimed at minimizing the consequences of the implementation of a new IS risk (cyber risk) in the business unit of the electric power company (the consequences of deviating the volume of electricity transmission services compared to the set value in the business plan) or existing? C C B Department of Internal Control and Risk Management, Information Security Service Department of Internal Control and Risk Management, Information Security Service
The main advantages of using the “bow-tie” method are the ability to understand the reasons for the onset of risks and the consequences of their implementation. This method makes you think of ways to manage operational risk, taking into account the cyber risks that make up their composition and helps determine the factors for subsequent mathematical modeling of the company's operational risks. A bow-tie analysis is used to study risk based on a demonstration of a range of possible causes and consequences.
The input to the method is information on the causes of hazardous events, barriers and controls that can prevent them.
The output of the method is a table showing the main consequences of dangerous events and the barriers established to minimize and mitigate undesirable consequences.
1. Among the sectors of the electric power industry, one of the highest values of the risk indicator has information security risk (including cyber risk). 2. Electricity companies do not include cybersecurity among strategic priorities.
There is no information on cybersecurity risks in their reports. In general, the share of companies that do not consider ensuring cybersecurity a strategic task, according to the survey, is 82%. And for the smartwatch, cybersecurity is a strategic priority. 3. Lack of proper internal control over the cyber risk management processes leads to the fact that cybersecurity incidents are not properly recorded in the cyber risk events database, stakeholders do not have full information, and appropriate measures are not taken. 4. For the electricity industry, operating on the basis of the smart grid concept, by analogy with the banking sector (Basel III), it is necessary to integrate cyber risk management into the company's operational risk management system. 5. This will make it possible to reflect the share of losses from cyber risks in the smart grid in the total structure of losses from operational risks in the reports of electric power companies and to establish the statistical dependence of operational risks on cyber risks. 6. Integration of cybersecurity will also help to better organize the interaction of structural units of the company for risk management, taking into account the fact that cyber risk manifests itself in a computer network, and its economic evaluation is carried out in a functional unit based on the results of operations. 7. The operational risk management system of the electricity company operates at strategic, tactical and operational levels. Therefore, cybersecurity should be integrated into the business development strategy at all levels of management, to make it part of the corporate philosophy. 8. The integration of cyber risk management into the company's operational risk management system requires a scientific synthesis of the systematization and optimization of cyber risk management processes according to internal capital adequacy assessment procedures (ICAAP) in case of their economic feasibility (Basel II). In this case, mandatory internal processes are implemented: significant risks are identified, risk appetite is established, economic capital is calculated, daily, monthly, quarterly and annual reports are compiled (indicating the volumes of significant risks), stress testing is carried out and the organization of the functioning of the risk management service is specified with ensuring the full implementation of the functions of risk policy and risk reporting. 9. It is necessary to organize proper internal control of the cyber risk management processes, in which all cybersecurity incidents are properly recorded in the cyber risk event database, stakeholders receive full information and take appropriate measures. 10. To implement the processes of integrating cybersecurity into a company’s operational risk management system, the “bow-tie” method can be used, which makes you think of ways to manage operational risk taking into account the cyber risks included in it, and helps determine factors for the subsequent mathematical modeling of operational and information risks electricity company.