🤖 AI Summary
This study addresses the growing complexity of cyber threats to hydropower systems driven by increasing software integration, which renders traditional risk assessment methods inadequate for identifying compound risks arising from coordinated attacks. The work proposes a novel two-stage framework that integrates HAZOP with Bow-Tie analysis for cybersecurity risk assessment in hydropower systems. By extending HAZOP deviation analysis, it identifies 18 classes of potential deviations and incorporates cyber-induced threat scenarios. Coupled with the Bow-Tie barrier model, the approach reveals that shared network infrastructure undermines defense-in-depth and enables adversaries to cooperatively trigger multiple deviations to bypass protective measures. The findings demonstrate that conventional assumptions of deviation independence and barrier isolation no longer hold under cyber attack conditions, and the proposed framework significantly enhances the identification and modeling of compound cyber risks.
📝 Abstract
With the widespread use of software systems in critical infrastructures such as hydropower plants has brought many advantages, yet it has exposed these systems to cyber threats. Cyber risk assessment & mitigation is important to identify cyber threats and protect these systems from unwanted incidents. This paper evaluates and compares the two risk assessment methodologies namely Hazard and Operability Study (HAZOP) and BowTie analysis for identifying cyber induced threats in hydropower systems. We selected these two methodologies because they offer a complementary perspective for cyber-safety risk assessment. Each method is first applied in traditional form to identify hazards, barriers, and threat scenarios arising from accidental causes, then extended to examine how findings change under cyber-induced causation. The traditional HAZOP identifies 18 deviations across five control parameters; the cyber extension shows how an adversary can coordinate multiple deviations to produce outcomes that conventional safeguards cannot detect. The BowTie analysis maps preventive and mitigation barriers around a top event; the cyber extension reveals that barriers appearing independently can share network infrastructure a single attacker could compromise, challenging the defense-in-depth assumption. Together, the two methods provide complementary coverage: HAZOP systematically enumerates what can go wrong, while BowTie shows how barriers provide layered protection. The cyber extension applied to both exposes assumptions, independent causes in HAZOP and independent barriers in BowTie, that do not hold against a coordinated adversary. As a result of this study, this paper highlights a practical two-stage approach to adapt established safety methods to identify cybersecurity challenges in hydropower control systems, provides pros and cons of these methodologies, and shows area of applicability.