Energy Reports (Nov 2021)
Valuing the cyber-attacks budget in high voltage power substations to increase cyber-security; providing a method based on Fuzzy Analytical Hierarchy Process
Abstract
The level of protection of high voltage power substations depends on the considerations of the electricity company, the level of threats and the value of their assets. On the other hand, the level of countermeasures or defenses for an acceptable level of risk depends on the number of defense equipment at the substation level. Therefore, the number of these countermeasures should be estimated according to the status of each substation and the rate of investment and its importance. In addition, appropriate defense methods depending on their type and condition, as well as how the design and position of the substation can identify system security vulnerabilities. The aim of this paper is to investigate and determine the importance of protecting high voltage power substations against cyber-attacks. For this purpose, power substations are examined in four different groups: geostrategic, industrial strategy, automation and control systems, and vulnerable. According to the decision-making method of Fuzzy Analytical Hierarchy Process (FAHP), the defense cost function is presented in each substation, which includes hardware and software equipment and optimal routing of data transmission cables and cable shield. In addition, decisions are made simultaneously between the defender and the attacker. It was found that, from the proposed defense methods, the optimal path for communication cables and hardware equipment used in the power substations was more important than other cases. In addition, by shifting the weights of the criteria of substations 2 and 4, the strategy 3 ranks first in the need for defense budgets among other strategies, accounting for about 49.5% of the total defense budget, and it needs 11.2% more defense budget than the strategy S4. Furthermore, sensitivity analysis is provided to examine the impact of various factors as well as to confirm the accuracy of the results.
