Risk-based Decision-Support for Vulnerability Remediation in Electric Power Networks

Power grids are becoming increasingly intelligent. However, the boundaries between their operational technology (OT) environments and the (vulnerable) IT networks tend to dissolve. In such systems, several technical and economic factors can significantly affect the upgrading decisions. These factors include, just to name a few, limited time and budget as well as legal constraints. To cope with these challenges, an involved decision maker has to prudently prioritize the possible vulnerability remediation actions. The key objective of prioritization decisions is to efficiently reduce the inherent security risk to which the system in question is exposed. Due to the critical role of power systems, their decision makers tend to enhance the system resilience against extreme events. That is, they seek to avoid decision options associated with extreme (adverse) consequences. Therefore, we propose an integrated risk-based decision-support methodology for prioritizing risk remediation activities. It leverages (i) the Time-To-Compromise (TTC) metric to quantitatively assess the security risk, and (ii) a game-theoretical model to support the decision-making process. The game model considers carefully the specific risk attitude of the decision makers involved in the patch management process across electric power organizations.