Problems of implementing new approaches to information security in the energy industry

Golikov S.E.

UDC 004.046, 004.056
DOI: 10.26102/2310-6018/2020.28.1

Abstract
List of references
About authors

The quality of life of a modern society directly depends on the functioning of the energy sector. Despite the measures taken to protect the energy infrastructure, statistics of information security incidents indicate significant shortcomings in the applied security architecture that are of systematic nature. The likelihood of malicious software penetrating the computer systems of energy companies has increased significantly in recent years, which could have a strong impact on the availability, integrity and confidentiality of technological network systems. In the article analyzed information security (IS) incidents, shown the vulnerability of power facilities not only to well-planned attacks, but also to ordinary malicious software. The features of using the principles of information security in the energy sector are identified, the landscape of existing threats and vulnerabilities is described, the shortcomings of the applied security model are identified. The author gives a generalized characteristic of the “zero trust” model, which is proposed to be used at power supply facilities, and provides a comparative analysis of two approaches to information security. The application of the developed roadmap for the implementation of a new information security concept, supplemented by a description of ways to minimize operational risks, can significantly improve the quality of services provided for critical business applications, provide reliable protection against modern information security threats and data leaks, and improve harmonization with the requirements of the legislation for safety.

1. . Palei L. Kiberbezopasnost v energetike – zadacha gosudarstvennogo urovnja. Dostupno po adresu:http://lib.itsec.ru/articles2/focus/kiberbezopasnost-v-energetike-zadachagosudarstvennogo-urovnya (data obrashcheniya 20.02.2020 g.).

2. Informatsionnaja bezopasnost energetiki Rossii. Realnost I perspektivi. Materialy Smart Energy Summit 2018. Dostupno po adresu: http://smartenergysummit.ru/novosti/informaczionnaya-bezopasnost-energetiki-rossii.- realnost-i-perspektivyi (data obrashcheniya 20.02.2020 g.).

3. Melkich A.A., Mikova S.Y., Oladko V.S. Issledovaniya problem informatsionnoy bezopasnosti ASKYE. Universum: Technischeskie nauki. 2016;6(27). Dostupno po adresu: http://7universum.com/ru/tech/archive/item/3307 (data obrashcheniya 20.02.2020 g.).

4. NCCIC/ICS-CERT Year in Review FY 2015, US Department of Homeland Security. Dostupno po adresu: https://ics-cert.uscert.gov/sites/default/files/Annual_Reports/Year_in_Review_FY2015_Final_S508C.pdf (data obrashcheniya 20.02.2020 g.).

5. SANS-ICS, E-ISAC. TLP: White. Analysis of the Cyber Attack on the Ukrainian Power Grid. Defense Use Case. Dostupno po adresu: https://ics.sans.org/media/EISAC_SANS_Ukraine_DUC_5.pdf (data obrashcheniya 20.02.2020 g.).

6. Detektion von Büro-Schadsoftware an mehreren Rechnern 25.04.2016. Dostupno po adresu: http://www.kkw-gundremmingen.de/presse.php?id=571 (data obrashcheniya 20.02.2020 g.).

7. V Venesuele proizoshlo masshtabnoye otklucheniye sveta. Dostupno po adresu: https://ria.ru/20190325/1552099798.html (data obrashcheniya 20.02.2020 g.).

8. Kaspersky ICS Sert. Landshaft ugroz dlya system promyshlennoi avtomatizazii. Pervoye polugodiye 2019. Dostupno po adresu: https://icscert.kaspersky.ru/reports/2019/09/30/threat-landscape-for-industrial-automation-systemsh1-2019/ (data obrashcheniya 20.02.2020 g.).

9. German nuclear plant infected with computer viruses, operator says. REUTERS. Dostupno po adresu: http://www.reuters.com/article/us-nuclearpower-cyber-germanyidUSKCN0XN2OS (data obrashcheniya 20.02.2020 g.).

10. Phederalniy zakon "O bezopasnosti kriticheskoi infrastrukturi Rossiiskoi Federazii" ot 26.07.2017 N 187-ФЗ. Dostupno po adresu: http://www.consultant.ru/document/cons_doc_LAW_220885/ (data obrashcheniya 20.02.2020 g.).

11. Kindervag John, Balaouras Stephanie, Mak,Josh Blackborow Kelley. No More Chewy Centers: The Zero Trust Model Of Information Security. Dostupno po adresu: https://www.forrester.com/report/No+More+Chewy+Centers+The+Zero+Trust+Model+O f+Information+Security/-/E-RES56682(data obrashcheniya 20.02.2020 g.).

12. Cunningham Chase. The Forrester Wave™: Zero Trust eXtended (ZTX) Ecosystem Providers. FOR SECURITY & RISK PROFESSIONALS. 2018(4). Dostupno po adresu: https://www.em360tech.com/wp-content/uploads/2019/04/The-ForresterWave%E2%84%A2_-Zero-Trust-eXtended-ZTX-Ecosystem-Providers-Q4-2018-1- 1.pdf(data obrashcheniya 20.02.2020 g.).

13. Gilman Evan, Barth Doug. Zero Trust Networks. Sebastopol: O’Reilly Media, Inc., 2017.

Golikov Sergei Evgenievich

Email: kcl@mail.ru

Federal State Autonomous Educational Institution of Higher Education "Sevastopol State University", Sevastopol

Sevastopol, Russian Federation

Keywords: information security in the energy sector, the concept of zero trust, information security threats, information security incidents, information security models, vulnerability management, minimum privileges

For citation: Golikov S.E. Problems of implementing new approaches to information security in the energy industry. Modeling, Optimization and Information Technology. 2020;8(1). Available from: https://moit.vivt.ru/wp-content/uploads/2020/02/Golikov_1_20_1.pdf DOI: 10.26102/2310-6018/2020.28.1 (In Russ).

857

Full text in PDF