CPS: Medium: Collaborative Research: An Actuarial Framework of Cyber Risk Management for Power Grids

正如最近针对乌克兰电网的网络攻击所证明的那样，攻击策略已经先进，新的恶意软件代理将继续出现。目前审计电力基础设施关键网络资产的措施没有提供可用于改进安全保护的定量指导。对网络安全保护的投资通常仅限于基于可靠性标准的合规执行。审计人员和投资者必须了解网络攻击可能导致的最坏情况，以及它们将如何影响电网。该项目旨在建立一个精算框架，以制定针对广域电网新出现的网络攻击的对策的技术改进战略。通过建立一个评估和管理网络风险的精算框架，该项目将促进能源基础设施的自我维持生态系统，最终有助于提高整体社会福利。网络保险的进步将刺激处理极端网络事件的精算研究。此外，将通过教育下一代劳动力和传播研究成果，促进关键能源基础设施的网络安全和网络保险相关研究和实践。该项目的目标是开发电网网络安全风险管理的精算框架。它涉及将保险作为当代电网网络风险管理工具的变革性研究。从提取的安全日志和网络引发的可靠性退化分析中生成全面的漏洞和基于可靠性的知识，可以为电力公司建立风险组合，以提高其保护电力基础设施免受网络威胁的准备。该项目的主要重点是：1)开发一种方法来量化电网中的网络风险，并确定缓解方案如何影响对广泛不稳定的级联后果；2)通过概率网络风险评估，全面研究假设的网络攻击场景对电网可靠性的影响；3)利用前两次研究结果构建精算模型。将评估电力设施可能遭受的网络攻击造成的损失，在此基础上设计保险政策，并探索相关的资本市场。

As evidenced by the recent cyberattacks against Ukrainian power grids, attack strategies have advanced and new malware agents will continue to emerge. The current measures to audit the critical cyber assets of the electric power infrastructure do not provide a quantitative guidance that can be used to address security protection improvement. Investing in cybersecurity protection is often limited to compliance enforcement based on reliability standards. Auditors and investors must understand the implications of hypothetical worst case scenarios due to cyberattacks and how they could affect the power grids. This project aims to establish an actuarial framework for strategizing technological improvements of countermeasures against emerging cyberattacks on wide-area power networks. By establishing an actuarial framework to evaluate and manage cyber risks, this project will promote a self-sustaining ecosystem for the energy infrastructure, which will eventually help to improve overall social welfare. The advances in cyber insurance will stimulate actuarial research in handling extreme cyber events. In addition, the research and practice related to cybersecurity and cyber insurance for the critical energy infrastructure will be promoted by educating the next generation of the workforce and disseminating the research results. The objective of this project is to develop an actuarial framework of risk management for power grid cybersecurity. It involves transformative research on using insurance as a cyber risk management instrument for contemporary power grids. The generation of comprehensive vulnerabilities and reliability-based knowledge from extracted security logs and cyber-induced reliability degradation analysis can enable the establishment of risk portfolios for electric utilities to improve their preparedness in protecting the power infrastructure against cyber threats. The major thrusts of this project are: 1) developing an approach to quantifying cyber risks in power grids and determining how mitigation schemes could affect the cascading consequences to widespread instability; 2) studying comprehensively how hypothesized cyberattack scenarios would impact the grid reliability by performing a probabilistic cyber risk assessment; and 3) using the findings from the first two thrusts to construct actuarial models. Potential cyberattack-induced losses on electric utilities will be assessed, based on which insurance policies will be designed and the associated capital market will be explored.