Читать книгу Building an Effective Security Program for Distributed Energy Resources and Systems - Mariana Hentea - Страница 78

In the past, before Internet technologies became the mainstream technology, there were few risks and limited definitions for security and security expertise. Security evolved from protecting a file, an application, or a computer to protecting a larger area that comprises many computers, networks, organizations, and people.

The security field evolved from an obscure term known initially only to military and governments to include organizations of all kinds, the public, and the globe. For some time, few professionals were involved in security matters. Today organizations and governments are continuously searching for better security professionals to protect their information and their other resources. A review of the terms and definitions for cybersecurity is well documented in [Bay 2016].

Security definitions evolved from simple terms like computer security, IT security, and information security to more recent terms identified as cyber security or cybersecurity, the last term winning, although the cyber security term is still used in some publications [Franscella 2013].

As we observed earlier, security terms are differently defined in many books and guidances; therefore we use the terms security, cybersecurity, and information security in this book based on the well‐known standards. We acknowledge that there are subtleties in these definitions. NIST guidelines for the Smart Grid use the term cybersecurity (e.g. [NISTIR 7628], [NISTIR 7628r1]). However, we discuss the information security based on definitions included in standards. The ISO/IEC definition is as preservation of information attributes such as confidentiality, integrity, availability, authenticity, accountability, non‐repudiation, and reliability [ISO/IEC 27000]. Another defines security as a property of a system by which confidentiality, integrity, availability, accountability, authenticity, and reliability are achieved [ISO 15443].

We also discuss security in the context of an environment determining the setting and circumstances of all interactions and influences with the system of interest [ISO/IEC 42010]. Other issues that need to be understood and managed include the interdependence of cybersecurity and reliability of the power grid.

A cyber attack on devices that protect and control the power grid could result in power disruption or damaged equipment. Similarly, physical attacks on power equipment or cyber infrastructure may impact the information, energy system, and energy services. Security is a system condition that results from the establishment and maintenance of measures to protect the system [RFC 4949]. Therefore, the installation of security controls should avoid interfering with critical energy delivery functions.

Although safety is defined as freedom from risk that is not tolerable [ISO/IEC 51] and safety issues are being the objective of dedicated departments within an organization, we need to discuss it in the context of cybersecurity. Safety is the condition of the system operating without causing unacceptable risk of physical injury or damage to the health of people, either directly or indirectly as a result of damage to property or to the environment [IIC 2015]. For example, inappropriate security controls (e.g. electronic locks to computer facilities without capabilities to open doors or windows) may harm people (working in these facilities) that need to escape when there is a natural disaster, a power down, or a fire.

Smart Grid cybersecurity must address not only deliberate attacks, such as from disgruntled employees, industrial espionage, and terrorists, but also inadvertent compromises of the information infrastructure due to user errors, equipment failures, and natural disasters.