Trial for Automating Cyber Risk Analysis

Ofgem wishes to reduce the cyber risk of disruption to essential services within its regulatory sector. The ability of Ofgem and the Operators of Essential Services (OESs) to drive reduction in cyber risks is constrained by the level of knowledge of the security of the Cyber-Physical Systems (CPS) through which the essential services are delivered. The security of the CPSs depends upon many factors including the design of the physical system, the security architecture of the cyber elements (IT and Operational Technology),the low level configuration of both the cyber & physical components and the level of protective monitoring. Typically, no individual has a full understanding of all aspects but the CPS security depends upon how they integrate together. New tools and techniques are emerging to model complex systems from a cyber security perspective. Good models can capture more system security details than one person can absorb and through automated analysis of the model provide new insights to system security. These can include understanding of the most vulnerable attack paths and the best options for protecting them. Good models also provide a way of capturing system information such that it is retained within a security team even as the team members change over time. Models can also support constructive debate between OESs and regulators on the level of system security and how best to reduce cyber risk. Ofgem therefore wishes to trial the latest system modelling tools and techniques on an OES CPS. If the trial evidences that cost effective risk reduction can be achieved through system modelling then Ofgem will encourage adoption more widely across its sector.