CPS: Medium: Collaborative Research: An Actuarial Framework of Cyber Risk Management for Power Grids

正如最近针对乌克兰电网的网络攻击所证明的那样，攻击策略已经取得了进展，新的恶意软件代理将继续出现。目前对电力基础设施的关键网络资产进行审计的措施没有提供可用于解决安全保护改进的定量指导。对网络安全保护的投资通常仅限于基于可靠性标准的合规执行。审计人员和投资者必须了解网络攻击所造成的假设最坏情况的影响，以及它们如何影响电网。该项目旨在建立一个精算框架，为应对广域电网上新出现的网络攻击的对策制定战略技术改进。通过建立一个评估和管理网络风险的精算框架，该项目将促进能源基础设施的自我维持生态系统，最终有助于改善整体社会福利。网络保险的进步将刺激精算研究，以处理极端的网络事件。此外，将通过教育下一代劳动力和传播研究成果，促进与关键能源基础设施的网络安全和网络保险有关的研究和实践。该项目的目标是为电网网络安全制定一个风险管理的精算框架。它涉及使用保险作为当代电网网络风险管理工具的变革性研究。从提取的安全日志和网络引起的可靠性降级分析中生成全面的漏洞和基于可靠性的知识，可以为电力公司建立风险组合，以提高其在保护电力基础设施免受网络威胁方面的准备。该项目的主要目标是：1）开发一种方法来量化电网中的网络风险，并确定缓解方案如何影响广泛不稳定的级联后果; 2）通过执行概率网络风险评估，全面研究假设的网络攻击场景如何影响电网可靠性; 3）使用前两个目标的结果来构建精算模型。将评估网络攻击对电力公司造成的潜在损失，并在此基础上设计保险政策，探索相关的资本市场。

As evidenced by the recent cyberattacks against Ukrainian power grids, attack strategies have advanced and new malware agents will continue to emerge. The current measures to audit the critical cyber assets of the electric power infrastructure do not provide a quantitative guidance that can be used to address security protection improvement. Investing in cybersecurity protection is often limited to compliance enforcement based on reliability standards. Auditors and investors must understand the implications of hypothetical worst case scenarios due to cyberattacks and how they could affect the power grids. This project aims to establish an actuarial framework for strategizing technological improvements of countermeasures against emerging cyberattacks on wide-area power networks. By establishing an actuarial framework to evaluate and manage cyber risks, this project will promote a self-sustaining ecosystem for the energy infrastructure, which will eventually help to improve overall social welfare. The advances in cyber insurance will stimulate actuarial research in handling extreme cyber events. In addition, the research and practice related to cybersecurity and cyber insurance for the critical energy infrastructure will be promoted by educating the next generation of the workforce and disseminating the research results. The objective of this project is to develop an actuarial framework of risk management for power grid cybersecurity. It involves transformative research on using insurance as a cyber risk management instrument for contemporary power grids. The generation of comprehensive vulnerabilities and reliability-based knowledge from extracted security logs and cyber-induced reliability degradation analysis can enable the establishment of risk portfolios for electric utilities to improve their preparedness in protecting the power infrastructure against cyber threats. The major thrusts of this project are: 1) developing an approach to quantifying cyber risks in power grids and determining how mitigation schemes could affect the cascading consequences to widespread instability; 2) studying comprehensively how hypothesized cyberattack scenarios would impact the grid reliability by performing a probabilistic cyber risk assessment; and 3) using the findings from the first two thrusts to construct actuarial models. Potential cyberattack-induced losses on electric utilities will be assessed, based on which insurance policies will be designed and the associated capital market will be explored.