An approach to scenario-based cybersecurity assessment of critical infrastructure facilities of the electric power sector of Ukraine

Abstract

Protecting energy infrastructure from cyber-physical threats is a pressing issue worldwide, especially given the current state of martial law in Ukraine. Currently, Ukraine employs the Methodology for Assessing the State and Practices of Cybersecurity in Critical Electrical Grid Infrastructure, which is based on the C2M2 cybersecurity capability maturity assessment model. This model evaluates general cybersecurity processes but does not address specific threat scenarios. An approach to potentially expanding the application of the C2M2 model by combining the assessment of an organization’s maturity with scenario-based threat analysis is proposed and examined. The approach involves integrating the C2M2, MADS/MOSAR, and GE/McKinsey Matrix models. Their integration is viewed as a two-stage process. At the first stage, a slightly generalized McKinsey matrix with scenario-dependent weighting coefficients is used for a rough scenario analysis. For this matrix, the «external» threats axis is determined through expert assessment, while for the  «internal» axis of the ability to counter threats, the MIL values of the C2M2 domains serve as the direct metric. This approach relies on data already collected in C2M2, provides rapid results for scenario prioritization, and establishes an architecture into which MOSAR can be integrated at the next stage. The standalone utility of the matrix lies in its ability to rapidly allocate defense resources in cases of critical need. At the second stage, MOSAR is integrated as a tool for in-depth, labor-intensive analysis of scenarios from the highest-priority zone of the matrix, with the possible subsequent integration of NIST SP 800-53 standards, which will provide resource-intensive and detailed technical specifications. The typical processes of the first and second stages, the shortcomings and limitations of the approach, and ways to potentially compensate for these shortcomings are justified and examined. For the practical implementation of the first stage, a corresponding pilot project should be carried out for several critical facilities; if the results are positive, the second stage can be initiated. Tabl.: 1. Fig.: 1. Refs.: 11 titles.