Mapping IEC 62443-3-3 achieved security levels to CVSS v3.x environmental metrics for smart grid vulnerability prioritization

Vulnerability management is an essential part of modern cybersecurity, as well as a cornerstone of the IEC 62443 standard. However, vulnerability management of Operational Technology (OT) systems is less than trivial due to factors such as legacy systems, a wide range of suppliers and stakeholders, and business continuity requirements. To investigate how asset owners of power plants and substations in smart grids can consider existing security measures when prioritizing vulnerabilities, we based our proposal on de facto standards and frameworks, e.g. the Purdue reference model, IEC 62443 and the Common Vulnerability Scoring System (CVSS). Through a systematic content analysis, our main contribution is the mapping suggestion between the security levels of IEC 62443-3-3 system requirements to the values of the Environmental metrics of the CVSS v3.x framework. The mapping proposal was applied to a Programmable Logic Controller (PLC) as a proof of concept due to its criticality in smart grid systems, and also to a set of Windows-based Operator Stations (OS). The proposed approach is scalable in the sense that similar assets can be assessed together, and the procedure is intended to be applicable to asset types across Purdue levels, although this paper evaluates only selected examples. The proof of concept with a PLC and Windows-based Operator Stations illustrates how considering existing security measures can change the Environmental score, thus the prioritization.