A study of resilience within information security in the power industry

Smart grids is the next big evolutionary step for the power industry. It is a modernization of power distribution systems, and the introduction of information and communication technologies (ICT) is one of the means. Consequences include larger integration and larger connectivity, which lead to the power automation systems facing a whole new set of information security threats than before. It will be impossible to prevent all possible incidents from occurring. Therefore, the ability to appropriately prepare for, detect, and respond to, information security incidents, is of great importance. As a critical infrastructure the power industry is an attractive target for hackers. The threats are ever-changing, hence the industry needs to be prepared for the unexpected. Resilience engineering concerns adaptation to changes and disturbances and offers valuable principles and practices to the power industry in managing the unexpected. This paper investigates to which degree the power industry aligns with the principles of resilience engineering and suggests future steps to be taken in order to improve resilience towards information security incidents. It is based on a case study where several large distribution system operators have been interviewed regarding their information security incident management process.