ExSol: Collaboratively Assessing Cybersecurity Risks for Protecting Energy Delivery Systems

No longer just prophesized about, cyber-attacks to Energy Delivery Systems (EDS), e.g., the power grid, gas and oil industries, are now very real dangers, resulting in non-trivial economical losses and an erosion of the public's confidence in EDS infrastructures. In such a context, performing risk analysis for EDS is difficult due to their innate diversity and interdependencies, along with an always-increasing threatscape and attack vectors. With this in mind, this paper presents ExSol, a collaborative, real-time, requirements-based risk assessment framework that features an approach for modeling real-life EDS infrastructures, a technique that retrieves well-defined security requirements from an EDS ontology, and a methodology for calculating risk for a single asset and for an entire system. In addition, we also provide experimental evidence that includes several attack case scenarios, which showcase the effectiveness of our proposed approach for being fully deployed in practice.