IEEE Power & Energy Magazine - September/October 2016 - 55

has yet to be an industry standard for operational, physical
asset, and OT-based compromise. While conventional databreach cyberincidents are suspected of being widely underreported, reporting ICS physical-breach cyberincidents is even
rarer, perhaps due to the difficulty to characterize events in
addition to the lack of standard industry reporting protocols
and requirements. Immaturity in ICS cyber insurance may
also be related to the fact that damage done to a utility's physical plant has typically been a property and casualty policy
concern. If an incident is attributed to cyber, physical damage
may or may not be covered. Until years of case law is established through the insurance coverage adjudication process,
the responsibility for complex "third-party" claims will surely
remain uncertain. There is also uncertainty for insurers with
respect to declaring a prudent level of business interruption
coverage capacity to offer insureds until stronger risk-mitigation practices are implemented and accurate loss-quantification tools are available. Of greater certainty is the impact of
an electric utility's outage that subsequently causes a service
outage to a commercial customer. This very likely will trigger claims on the commercial customers' business interruption and/or service interruption insurance policies, potentially
creating large-scale losses for insurers and the potential for
equally large-scale and expensive liability litigation, based on
risk accumulation.
Successful cyberattacks on utility equipment, such as
major power generation stations or large transformers, may
not only result in major capital losses but may also have the
potential to extend outages for long periods of time. Utilities and insurers may well be advised to coordinate the
development of appropriate OT cybersecurity metrics and
begin assessing physical damage and long-term service
outages caused by ICS cyber risk, rather than labor under
the provisions and assumptions underlying conventional IT
data-breach only scenarios.
Who else cares about OT cybersecurity risk? The credit
rating agencies (such as Moody's, S&P, and Fitch)! Publicly

Vulnerability
Planning

Policy and
Procedures

Tra
ini
ng
g
rillin
dD
an

I.D
.A

devices, and networks must be conducted, in essence a major
enterprise asset management "inventory relook" exercise.
Understanding the asset base; what is electronically connected and what versions of hardware, software, and patching
are installed; and what versions of control system communication protocols are being used is an important step for inventorying and developing equipment risk spectrums. A robust
risk assessment program can then serve the double duty of
cybersecurity and system reliability objectives. A tactical program should also prepare not only for intentional intrusions but
also for unintentional incidents. See Figure 3.
The development, documentation, and implementation of ICS cybersecurity policies and procedures that are
compatible with IT security, physical security, and business
continuity policies must be effectively introduced. Companies must assess their in-house capabilities, skill sets, and
likelihood to succeed. Hiring or bringing experts on board
to address gaps, both resource and knowledge based, is prudent. A representative team including OT, security, and IT
should determine security technologies, standards, and riskprioritized implementation plans. This goes well beyond the
simple implementation of firewalls and antivirus software.
Additionally, cybersecurity considerations must be incorporated into procurement activities, not just for material purchases but also proactively guarding against potential risks
borne through suppliers, partners, and contractors through
their systems or personnel access. Specifications and bidding
processes should incorporate cybersecurity requirements so
they are properly communicated as requisites to suppliers for
designing, manufacturing, testing, and supplying materials.
There are additional organizational strategies that can help
mitigate risk. One notable challenge with respect to protecting
ICSs and related equipment has been the lack of organizational
coordination between IT, operations technology, security,
safety and emergency management, risk management and crisis management functions. ICS cybersecurity may be harder to
coordinate because of this separation of IT and OT in organizational silos, but that can be addressed
once recognized. Traditionally, IT
cybersecurity has focused on data
breach, customer and intellectual
property, and data privacy protecets
ss
tion, while the OT side of cybersecurity has been focused on NERC
CIP compliance. The result is the
potential for gaps in an effective and
holistic approach to cybersecurity
risk management.
pr

ti o

IT and ICS Cybersecurity Flow

The insurance market also faces
a challenge as IT-related policies
dominate the cybersecurity area.
OT-oriented cyber policies are far
less common partly because there
september/october 2016

Are We Covered?

Analysis

Measurement

cu
Do

figure 3. IT and ICS cybersecurity planning and implementation must be performed
together, and it is an iterative process.
ieee power & energy magazine

Table of Contents for the Digital Edition of IEEE Power & Energy Magazine - September/October 2016