Abel Sanchez - 2019 ICT Conference

SAFFRON is a risk modeling and data analytics tool that allows energy delivery OT operators to better understand the risks associated with cyber threats. At present they do not have the capability to fully understand the risks associated with the cyber threats of today and tomorrow – risks that will continue to grow as Information Technology (IT) and Operations Technology (OT) networks increasingly integrate. It is important to have a better understanding of these risks, costs, and potential consequences. This aggregation of risk data will inform EDS OT operators in understanding how risk changes as the software deployed changes, and support actions (i.e., identify corrective actions that reduce the risk.) Similarly, risk computation will support operators in equipment replacement and procurement by quantifying device risk and impact on the network. SAFFRON has developed a risk model and data analytics tool, along with the necessary algorithms that identify risk tolerance and strategy for assessing, responding to, and monitoring cyber security risks. Foundational validated research is presingly neededed to develop risk models and visual analytics that are understandable to OT operators and leads to or even suggests corrective action. The tool uses a simulation model of the physical/IT system and acts as a proxy for the physical infrastructure.