{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,28]],"date-time":"2026-07-28T19:12:01Z","timestamp":1785265921657,"version":"3.55.0"},"reference-count":24,"publisher":"Association for Computing Machinery (ACM)","issue":"3","license":[{"start":{"date-parts":[[2021,6,8]],"date-time":"2021-06-08T00:00:00Z","timestamp":1623110400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["Digital Threats"],"published-print":{"date-parts":[[2021,9,30]]},"abstract":"<jats:p>\n            No longer just prophesied about, cyber-attacks to Energy Delivery Systems (EDS) (e.g., the power grid, gas and oil industries) are now very real dangers that result in non-trivial economical losses and inconveniences to modern societies. In such a context, risk analysis has been proposed as a valuable way to identify, analyze, and mitigate potential vulnerabilities, threats, and attack vectors. However, performing risk analysis for EDS is difficult due to their innate structural diversity and interdependencies, along with an always-increasing threatscape. Therefore, there is a need for a methodology to evaluate the current system state, identify vulnerabilities, and qualify risk at multiple granularities in a collaborative manner among different actors in the context of EDS. With this in mind, this article presents\n            <jats:italic>ExSol<\/jats:italic>\n            , a collaborative, real-time, risk assessment ecosystem that features an approach for modeling real-life EDS infrastructures, an ontology traversal technique that retrieves well-defined security requirements from well-reputed documents on cyber-protection for EDS infrastructures, as well as a methodology for calculating risk for a single asset and for an entire system. Moreover, we also provide experimental evidence involving a series of attack scenarios in both simulated and real-world EDS environments, which ultimately encourage the adoption of\n            <jats:italic>ExSol<\/jats:italic>\n            in practice.\n          <\/jats:p>","DOI":"10.1145\/3428156","type":"journal-article","created":{"date-parts":[[2021,6,8]],"date-time":"2021-06-08T16:12:15Z","timestamp":1623168735000},"page":"1-23","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":2,"title":["<i>ExSol<\/i>"],"prefix":"10.1145","volume":"2","author":[{"given":"Josephine","family":"Lamp","sequence":"first","affiliation":[{"name":"University of Virginia, Virginia, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Carlos E.","family":"Rubio-Medrano","sequence":"additional","affiliation":[{"name":"Texas A&amp;M University\u2013Corpus Christi, Corpus Christi, Texas, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Ziming","family":"Zhao","sequence":"additional","affiliation":[{"name":"The University at Buffalo, Buffalo, New York, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Gail-Joon","family":"Ahn","sequence":"additional","affiliation":[{"name":"Arizona State University and Samsung Research, Tempe, Arizona, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2021,6,8]]},"reference":[{"key":"e_1_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1109\/COMPENG.2010.28"},{"key":"e_1_2_1_2_1","doi-asserted-by":"crossref","first-page":"205","DOI":"10.1515\/jaiscr-2015-0029","article-title":"Risk assessment for industrial control systems quantifying availability using mean failure cost (MFC)","volume":"5","author":"Chen Qian","year":"2015","unstructured":"Qian Chen , Robert K. Abercrombie , and Frederick T. Sheldon . 2015 . Risk assessment for industrial control systems quantifying availability using mean failure cost (MFC) . Journal of Artificial Intelligence and Soft Computing Research 5 , 3 (2015), 205 \u2013 220 . Qian Chen, Robert K. Abercrombie, and Frederick T. Sheldon. 2015. Risk assessment for industrial control systems quantifying availability using mean failure cost (MFC). Journal of Artificial Intelligence and Soft Computing Research 5, 3 (2015), 205\u2013220.","journal-title":"Journal of Artificial Intelligence and Soft Computing Research"},{"key":"e_1_2_1_3_1","volume-title":"Proceedings of the 13th European Conference on Cyber Warfare and Security. 59","author":"Cruz T.","unstructured":"T. Cruz , J. Proen\u00e7a , P. Sim\u00f5es , M. Aubigny , M. Ouedraogo , A. Graziano , and L. Yasakhetu . 2014. Improving cyber-security awareness on industrial control systems: The CockpitCI approach . In Proceedings of the 13th European Conference on Cyber Warfare and Security. 59 . T. Cruz, J. Proen\u00e7a, P. Sim\u00f5es, M. Aubigny, M. Ouedraogo, A. Graziano, and L. Yasakhetu. 2014. Improving cyber-security awareness on industrial control systems: The CockpitCI approach. In Proceedings of the 13th European Conference on Cyber Warfare and Security. 59."},{"key":"e_1_2_1_4_1","volume-title":"Retrieved","author":"Dragos Inc.","year":"2017","unstructured":"Dragos Inc. 2017 . CRASHOVERRIDE Analysis of the Threat to Electric Grid Operations . Retrieved March 24, 2021 from https:\/\/dragos.com\/blog\/crashoverride\/CrashOverride-01.pdf. Dragos Inc. 2017. CRASHOVERRIDE Analysis of the Threat to Electric Grid Operations. Retrieved March 24, 2021 from https:\/\/dragos.com\/blog\/crashoverride\/CrashOverride-01.pdf."},{"key":"e_1_2_1_5_1","unstructured":"Energy Sector Control Systems Working Group (ESCSWG). 2014. Cybersecurity Procurement Language for Energy Delivery Systems. https:\/\/www.energy.gov\/ceser\/downloads\/cybersecurity-procurement-language-energy-deliveryapril-2014.  Energy Sector Control Systems Working Group (ESCSWG). 2014. Cybersecurity Procurement Language for Energy Delivery Systems. https:\/\/www.energy.gov\/ceser\/downloads\/cybersecurity-procurement-language-energy-deliveryapril-2014."},{"key":"e_1_2_1_6_1","volume-title":"Measuring and Managing Information Risk: A FAIR Approach. Butterworth-Heinemann","author":"Freund Jack","unstructured":"Jack Freund and Jack Jones . 2015. Basic risk concepts . In Measuring and Managing Information Risk: A FAIR Approach. Butterworth-Heinemann , Boston, MA , 13\u201323. Jack Freund and Jack Jones. 2015. Basic risk concepts. In Measuring and Managing Information Risk: A FAIR Approach. Butterworth-Heinemann, Boston, MA, 13\u201323."},{"key":"e_1_2_1_7_1","unstructured":"Energy Sector Control Systems Working Group. 2011. Roadmap to achieve energy delivery systems cybersecurity. https:\/\/www.energy.gov\/sites\/prod\/files\/Energy%20Delivery%20Systems%20Cybersecurity%20Roadmap_finalweb.pdf.  Energy Sector Control Systems Working Group. 2011. Roadmap to achieve energy delivery systems cybersecurity. https:\/\/www.energy.gov\/sites\/prod\/files\/Energy%20Delivery%20Systems%20Cybersecurity%20Roadmap_finalweb.pdf."},{"key":"e_1_2_1_8_1","volume-title":"Retrieved","author":"IEEE.","year":"2017","unstructured":"IEEE. 2017 . C37.118.1-2011 \u2013 IEEE Standard for Synchrophasor Measurements for Power Systems . Retrieved March 24, 2021 from https:\/\/standards.ieee.org\/findstds\/standard\/C37.118.1a-2014.html. IEEE. 2017. C37.118.1-2011 \u2013 IEEE Standard for Synchrophasor Measurements for Power Systems. Retrieved March 24, 2021 from https:\/\/standards.ieee.org\/findstds\/standard\/C37.118.1a-2014.html."},{"key":"e_1_2_1_9_1","volume-title":"Retrieved","author":"International Electrotechnical Commission (IEC).","year":"2017","unstructured":"International Electrotechnical Commission (IEC). 2017 . Core IEC Standards . Retrieved March 24, 2021 from http:\/\/www.iec.ch\/. International Electrotechnical Commission (IEC). 2017. Core IEC Standards. Retrieved March 24, 2021 from http:\/\/www.iec.ch\/."},{"key":"e_1_2_1_10_1","doi-asserted-by":"crossref","unstructured":"M. Jamei A. Scaglione C. N. Roberts E. Stewart S. Peisert C. McParland and A. McEachern. 2016. Automated anomaly detection in distribution grids using muPMU measurements. arXiv:1610.01107  M. Jamei A. Scaglione C. N. Roberts E. Stewart S. Peisert C. McParland and A. McEachern. 2016. Automated anomaly detection in distribution grids using muPMU measurements. arXiv:1610.01107","DOI":"10.24251\/HICSS.2017.388"},{"key":"e_1_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.ijcip.2015.02.002"},{"key":"e_1_2_1_12_1","volume-title":"Common Cyber Security Vulnerabilities Observed in Control System Assessments by the INL NSTB Program","author":"Kuipers D.","unstructured":"D. Kuipers . 2008. Common Cyber Security Vulnerabilities Observed in Control System Assessments by the INL NSTB Program . Technical Report. Idaho National Lab, Idaho Falls, ID. D. Kuipers. 2008. Common Cyber Security Vulnerabilities Observed in Control System Assessments by the INL NSTB Program. Technical Report. Idaho National Lab, Idaho Falls, ID."},{"key":"e_1_2_1_13_1","volume-title":"Proceedings of the 3rd International Conference on Collaboration and Internet Computing (CIC\u201917)","author":"Lamp J.","year":"2017","unstructured":"J. Lamp , C. E. Rubio-Medrano , Z. Zhao , and G.-J. Ahn . 2017 . OntoEDS: Protecting energy delivery systems by collaboratively analyzing security requirements . In Proceedings of the 3rd International Conference on Collaboration and Internet Computing (CIC\u201917) . IEEE, Los Alamitos, CA, 1\u201310. J. Lamp, C. E. Rubio-Medrano, Z. Zhao, and G.-J. Ahn. 2017. OntoEDS: Protecting energy delivery systems by collaboratively analyzing security requirements. In Proceedings of the 3rd International Conference on Collaboration and Internet Computing (CIC\u201917). IEEE, Los Alamitos, CA, 1\u201310."},{"key":"e_1_2_1_14_1","volume-title":"TLP: White Paper. SANS ICS.","author":"Lee R. M","year":"2016","unstructured":"R. M Lee , M. J. Assante , and T. Conway . 2016 . Analysis of the Cyber Attack on the Ukrainian Power Grid . TLP: White Paper. SANS ICS. R. M Lee, M. J. Assante, and T. Conway. 2016. Analysis of the Cyber Attack on the Ukrainian Power Grid. TLP: White Paper. SANS ICS."},{"key":"e_1_2_1_15_1","volume-title":"Proceedings of the 12th Asia-Pacific Software Engineering Conference (APSEC\u201905)","author":"Lee Seok Won","unstructured":"Seok Won Lee and Robin A. Gandhi . 2005. Ontology-based active requirements engineering framework . In Proceedings of the 12th Asia-Pacific Software Engineering Conference (APSEC\u201905) . IEEE, Los Alamitos, CA, 481\u2013490. Seok Won Lee and Robin A. Gandhi. 2005. Ontology-based active requirements engineering framework. In Proceedings of the 12th Asia-Pacific Software Engineering Conference (APSEC\u201905). IEEE, Los Alamitos, CA, 481\u2013490."},{"key":"e_1_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1002\/spip.313"},{"key":"e_1_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2005.98"},{"key":"e_1_2_1_18_1","volume-title":"Retrieved","author":"NERC.","year":"2017","unstructured":"NERC. 2017 . CIP Standards . Retrieved March 24, 2021 from www.nerc.com\/pa\/Stand\/Pages\/CIPStandards.aspx. NERC. 2017. CIP Standards. Retrieved March 24, 2021 from www.nerc.com\/pa\/Stand\/Pages\/CIPStandards.aspx."},{"key":"e_1_2_1_19_1","unstructured":"S. Peisert R. Gentz J. Boverhof C. McParland S. Engle A. Elbashandy and D. Gunter. 2017. LBNL Open Power Data. LBNL Technical Report. Lawrence Berkeley National Laboratory.  S. Peisert R. Gentz J. Boverhof C. McParland S. Engle A. Elbashandy and D. Gunter. 2017. LBNL Open Power Data. LBNL Technical Report. Lawrence Berkeley National Laboratory."},{"key":"e_1_2_1_20_1","volume-title":"Introduction to NISTIR 7628 Guidelines for Smart Grid Cyber Security. NIST Special Publication 154","author":"Smart Grid Interoperability Panel Cyber Security Working Group. 2010.","unstructured":"Smart Grid Interoperability Panel Cyber Security Working Group. 2010. Introduction to NISTIR 7628 Guidelines for Smart Grid Cyber Security. NIST Special Publication 154 . National Institute of Standards and Technology , Gaithersburg, MD . Smart Grid Interoperability Panel Cyber Security Working Group. 2010. Introduction to NISTIR 7628 Guidelines for Smart Grid Cyber Security. NIST Special Publication 154. National Institute of Standards and Technology, Gaithersburg, MD."},{"key":"e_1_2_1_21_1","unstructured":"K. Stouffer S. Lightman V. Pillitteri M. Abrams and A. Hahn. 2014. NIST Special Publication 800-82 Revision 2. National Institute of Standards and Technology Gaithersburg MD.  K. Stouffer S. Lightman V. Pillitteri M. Abrams and A. Hahn. 2014. NIST Special Publication 800-82 Revision 2. National Institute of Standards and Technology Gaithersburg MD."},{"key":"e_1_2_1_22_1","unstructured":"US Department of Energy. 2017. Quadrennial Energy Review Transforming the Nation\u2019s Electricity System: The Second Installment of the QER. US Department of Energy.  US Department of Energy. 2017. Quadrennial Energy Review Transforming the Nation\u2019s Electricity System: The Second Installment of the QER. US Department of Energy."},{"key":"e_1_2_1_23_1","volume-title":"Proceedings of the 36th Annual Hawaii International Conference on System Sciences. IEEE","author":"Vaughn R. B.","unstructured":"R. B. Vaughn , R. Henning , and A. Siraj . 2003. Information assurance measures and metrics\u2014State of practice and proposed taxonomy . In Proceedings of the 36th Annual Hawaii International Conference on System Sciences. IEEE , Los Alamitos, CA, 10\u201316. R. B. Vaughn, R. Henning, and A. Siraj. 2003. Information assurance measures and metrics\u2014State of practice and proposed taxonomy. In Proceedings of the 36th Annual Hawaii International Conference on System Sciences. IEEE, Los Alamitos, CA, 10\u201316."},{"key":"e_1_2_1_24_1","volume-title":"Proceedings of the 2018 IEEE Conference on Communications and Network Security (CNS \u201918)","author":"Yang H.","unstructured":"H. Yang , L. Cheng , and M. C. Chuah . 2018. Detecting payload attacks on programmable logic controllers (PLCs) . In Proceedings of the 2018 IEEE Conference on Communications and Network Security (CNS \u201918) . 1\u20139. H. Yang, L. Cheng, and M. C. Chuah. 2018. Detecting payload attacks on programmable logic controllers (PLCs). In Proceedings of the 2018 IEEE Conference on Communications and Network Security (CNS \u201918). 1\u20139."}],"container-title":["Digital Threats: Research and Practice"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3428156","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3428156","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T21:24:23Z","timestamp":1750195463000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3428156"}},"subtitle":["Collaboratively Assessing Cybersecurity Risks for Protecting Energy Delivery Systems"],"short-title":[],"issued":{"date-parts":[[2021,6,8]]},"references-count":24,"journal-issue":{"issue":"3","published-print":{"date-parts":[[2021,9,30]]}},"alternative-id":["10.1145\/3428156"],"URL":"https:\/\/doi.org\/10.1145\/3428156","relation":{},"ISSN":["2692-1626","2576-5337"],"issn-type":[{"value":"2692-1626","type":"print"},{"value":"2576-5337","type":"electronic"}],"subject":[],"published":{"date-parts":[[2021,6,8]]},"assertion":[{"value":"2019-08-01","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2020-10-01","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2021-06-08","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}