Cyber Security Architecture Methodology for the Electric Sector, Version 1.0 (co-author)
For grid modernization, increased interconnection in electric sector devices is required, and this will result in a larger attack surface that may be exploited by potential adversaries such as nation-states, terrorist organizations, malicious contractors, and disgruntled employees. A security architecture methodology is an important tool in a utility’s cyber security risk management strategy and a reference cyber security architecture may be used to support utility situational awareness.
Typically, an enterprise architecture does not address cyber security – specifically, the overall attack surface, attack vectors, potential vulnerabilities, and applicable response strategies. The challenge is to develop a security architecture methodology that augments, rather than replaces, current enterprise architecture methodologies and is at a level that is useful to utilities. This report includes the first version of a cyber security architecture methodology that may be used by utilities for existing and planned system architectures. The objective is to provide a common methodology that may be used by utilities of all sizes, from large investor owned utilities to smaller cooperatives and municipalities.