Portfolio optimization of cyber controls in public utilities

Public utilities have to operate under strict budgets, reliability requirements and regulatory requirements, and are simultaneously hit with a growing threat of cyber-attacks.The study suggests a multi-objective cyber-control portfolio optimization framework to choose the cost-effective safeguards for critical infrastructure in the utility sector.It combines the criticality of the asset, the likelihood of a threat to occur, the severity of a vulnerability, the cost of controls, the effectiveness of the risk reduction provided by controls, and the contribution to resilience in a cost-constrained optimization model.A hybrid approach to selecting risks by the Pareto principle and a risk-scoring strategy optimizes security enhancement, operational continuity and investment efficiency.Optimized portfolio is shown to attain 38.6% reduction in residual cyber risk, 24.3% in become more resilient, and 17.8% in control expenditure as compared with conventional priority-based selection via scenario-based evaluation.A framework gives the utility managers a clear, scalable and evidence-based decision support mechanism system.