Overview and Improvement of Procedures and Practices of Electricity Transmission System Operators in South East Europe to Mitigate Cybersecurity Threats

Abstract

The implementation of information and communication technologies (ICT) in power systems increases the risks of cybersecurity threats, requiring protection measures that should reflect the multi-actor environment of the contemporary power systems. This paper provides a critical assessment of the cybersecurity practices of the transmission system operators (TSOs) from South East Europe (SEE) and the implementation of obligations for TSOs emerging from the complex set of cybersecurity and electricity legislation. The analyses of TSO cybersecurity practices are based on a survey conducted with the TSOs from SEE and show there is a lack of consistent cybersecurity policy at the TSO level. These analyses demonstrate that the differences between TSOs from the SEE region are not very significant with regards to implementation of technical protection and defense measures for critical infrastructures (CIs) and assets. The comprehensive analyses of electricity and cybersecurity legislation uncover the obligations of TSOs emerging from legislation and relate them to current TSO cybersecurity practices, confirming the necessity to boost existing practices. Considering the analyzed legislation and implemented practices, this paper presents a proposal for a cybersecurity framework for TSOs that should improve their organizational and operational response to the evolving cybersecurity challenges.

importance of cyber protection in the power grid in the face of an uncertain future

“…Undoubtedly, the hypothesis test ratifies the results obtained, evidencing a high exposure to cyber-attacks in the national electricity system without an information security policy. Krkoleva-Mateska et al (2021) mention that the lack of implementations, maintenance, and updates of technologies in the electricity system exponentially increases the risk of a possible cyber-attack, thus becoming the critical path of the industry. Coffey et al (2018) mention that the implementation of Supervisory Control And Data Acquisition (SCADA) or Industrial Control Systems (ICS) in industrial systems allows preventive management of the network, but when consulting experts, 46.2% possessed essential or no knowledge about the use of this operational technology.…”