Risk mitigation in electric power systems: Where to start?

Abstract

Power grids are becoming increasingly intelligent. In this regard, they benefit considerably from the information technology (IT) networks coupled with their underlying operational technology (OT) networks. While IT networks provide sufficient controllability and observability of power grid assets such as voltage and reactive power controllers, distributed energy resources, among others, they make those critical assets vulnerable to cyber threats and risks. In such systems, however, several technical and economic factors can significantly affect the patching and upgrading decisions of their components including, but not limited to, limited time and budget as well as legal constraints. Thus, resolving all vulnerabilities at once could seem like an insuperable hurdle. To figure out where to start, an involved decision maker (e.g. a security team) has to prudently prioritize the possible vulnerability remediation actions. The key objective of prioritization is to efficiently reduce the inherent security risk to which the system in question is exposed. Due to the critical role of power systems, their decision makers tend to enhance the system resilience against extreme events. Thus, they seek to avoid decision options associated with likely severe risks. Practically, this risk attitude guides the decision-making process in such critical organizations and hence the sought-after prioritization as well. Therefore, the contribution of this work is to provide an integrated risk-based decisionsupport methodology for prioritizing possible remediation activities. It leverages the Time-To-Compromise security metric to quantitatively assess the risk of compromise. The developed risk estimator considers several factors including: i) the inherent assessment uncertainty, ii) interdependencies between the network components, iii) different adversary skill levels, and iv) public vulnerability and exploit information. Additionally, our methodology employs game theory principles to support the strategic decision-making process by constructing a chain of security games. Technically, the remediation actions are prioritized through successively playing a set of dependent zero-sum games. The underlying game-theoretical model considers carefully the stochastic nature of risk assessments and the specific risk attitude of the decision makers involved in the patch management process across electric power organizations.

Bayesian Optimization and Hierarchical Forecasting of Non-Weather-Related Electric Power Outages

“…These outage events can result in substantial financial losses [5][6][7], such as food spoilage [8,9] or a serious health emergency in a health facility [10], especially when back-up sources of generation fail [11]. Developing a robust outage risk mitigation strategy [12,13] is important for utility managers to formulate protective and preventive measures that reduce the occurrence of electric outages. Outage forecasting models are a useful tool for uncovering historical and future trends of outage events and can, therefore, guide outage preventive and mitigation strategies [14].…”

Remarks on the tail order on moment sequences

“…The aim of these papers was to lay the foundations for a theory of games with probability distributions as payoffs. This theory was further developed in [6] and has found applications in the literature related to energy distribution networks, [7,8].…”