Cybersecurity in Bulk Electric Systems: Enhancing Access Management through IT Audits

The article analyzes the existing legal mechanisms for managing critical information infrastructure in Ukraine. The instruments for their improvement are proposing in this article. An important component of critical infrastructure is its information component – a critical information infrastructure. The sphere of protection of critical information infrastructure in Ukraine is at the initial stage of formation. The current legislation defines only certain objects of socio-economic sphere, in which extraordinary events can lead to socially dangerous consequences. In view of the fact, that the term “critical information infrastructure” does not having a consistent interpretation in different countries, we propose our opinion. “Critical information infrastructure is a system of information management of critical facilities and information and communication networks that provide defense capabilities and security of public and private institutions, whose operation may flow to the national security of Ukraine” (KII). In the KII we can identified information and network components. Information environment of KII is a system for information management of critical objects, including computing and information resources that form automated control systems (ACS). The network component of KII consists of a set of telecommunication devices, communication lines and network equipment, systems of open protocols for the exchange of information between elecommunication devices, global system of digital addresses and digital identifiers, software. The Internet network can be considered as a technological add-on over a telecommunication network that provides the provision of data transmission and processing services (e-mail, teleconferencing, file transfer, access to computing and information systems in local area networks). The main threat to the safety of ACS of critical information infrastructure objects is targeted actions on information systems, information and telecommunication networks by software and hardware. KII legal security include two main components – national and international. The national component may be forming by a set of principles, legal institutions and norms, which are enshrined in the national legislation regulating public relations in Ukraine in the area of counteracting the security threats of the ACS of critical objects. In order to protect the most important objects of KII, it is necessary to identify these objects. The current legislation defines such categories of objects, for which special conditions for ensuring their protection and functioning are established. Some of them, in whole or in part, may be classifying as objects of critical infrastructure. The specificity of providing information security was reflecting in such Ukraine laws like “On the Fundamentals of National Security of Ukraine”, “On the Concept of the National Program of Informatization”, “On the National Program of Informatization”. As well as the Concept of Development of the Security and Defense Sector of Ukraine, the National Security Strategy of Ukraine, the Strategy of Cybersecurity Of Ukraine. The National Security Strategy identifies actual threats to national security and sets priorities for information security, cyber security and security of information resources and critical infrastructure. At the same time, the implementation of the state policy in the field of security of KII requires the further development of legal principles and norms governing the relevant social relations, that is, the national component of the legal security of KII. Ukraine should ensure the establishment of a nationwide system for assessing risks and threats to critical infrastructure, and after the legislative definition of the main terms, the implementation of the Identification of Critical Information Infrastructure objects. Identification of objects of critical information infrastructure can be accomplishing by introducing the certification of objects of critical information infrastructure. Such passports must contain general data about the facility, data on the main sources of danger, data on hazardous natural conditions, technological processes and response to threats. The international component of the legal security of KII provides for the regulation of a set of principles and norms defined by international treaties and recognized by the state, regulating issues of international cooperation in this area. Ukraine has signed the Convention on Cybercrime together with the member states of the Council of Europe and other States. It is aiming at stopping actions against the confidentiality, integrity and availability of computer systems, networks and computer data, as well as abusing such systems, networks and data by installing the criminal responsibility for such behavior, the provision of powers sufficient to combat criminal offenses, and the conclusion of agreements on rapid and reliable international cooperation. In addition, the plan of measures for 2017 on implementation of the Cybersecurity Strategy of Ukraine provides for the implementation of Directive 2008/114/EC on the protection of critical infrastructure, in particular on cybersecurity and cyber defense of critical infrastructure objects. Development of the system of international information security, the following main groups of international relations that requirenormative legal regulation within the framework of the legal security of KII: definition of the boundaries of the national KII in the global information and communication infrastructure and fixing signs of computer incidents in the control system of critical objects information infrastructure. The absence of generally recognized borders of state sovereignty of States in this space is a significant obstacle to the application of international law to the actions of other states. In particular, this impedes the establishment of limits of responsibility of states for violating the security of the KII and organizing international cooperation in the field of countering computer crime. The urgency of the legislative consolidation of signs of computer incidents in the automated control system of critical information infrastructure objects suggests the widespread use of the concept of “incident” in international law. An incident in cyberspace usually associated with a violation of the functioning of the components of cyberspace – an electronic collection environment and automated processing of information that determines the processes of the implementation of these operations, as well as information systems and automated control systems. The essence of the general definition of the “international incident” in the field of KII will be determining, firstly, by the nature of international relations between states that are violating by the “incident”. This event may be the result of unforeseen actions of the state, including actions that harm the interests of public bodies of one or more states, or, conversely, be one of many intentional but minor provocations carried out by agents of one state against another state. Given that international relations in the field of incidents in the field of KII are not regulating by international treaties, the main and, in fact, the only source of international law in this case serves as an international custom, however, its application to the sphere of KII is accompanying by considerable difficulties. For Ukraine, it is possible to introduce the positive experience of other states in the security of the KII. In particular, the problem of security of information technologies has been enshrined in the international standard ISO / IEC 15408 “General criteria for assessing the safety of information technology”.

Cybersecurity governance is increasingly recognized as a cornerstone of national security, especially in protecting critical infrastructure sectors such as energy, healthcare, finance, telecommunications, and transportation. This study investigates how governance frameworks, IT auditing, and risk management practices collectively reduce cyber threats and enhance the resilience of essential services. Using data from CISA, GAO audit reports, Verizon DBIR, and the World Economic Forum, the study assesses governance effectiveness through a combination of statistical techniques, including regression analysis, survival modeling, and data reduction methods. Findings reveal that organizations adopting both the NIST Cybersecurity Framework and ISO 27001 report a 75.8% reduction in cyber exploits, while IT audits lead to a 38–45% decrease in identified vulnerabilities. Additionally, proactive risk management strategies significantly delay the occurrence of cyber incidents, extending the average time to breach by over 260 days. These results underscore the critical importance of structured cybersecurity governance in minimizing threats and ensuring the continuity of national infrastructure. However, the study also highlights several implementation challenges, including regulatory inconsistencies, budget constraints, and a shortage of skilled cybersecurity professionals. These obstacles vary by region and sector, with under-resourced public institutions and developing economies facing the most significant barriers to effective governance. Recommendations include regulatory harmonization, mandating regular cybersecurity audits, and increasing investments in cybersecurity training and threat intelligence particularly in regions with fragmented oversight. The study offers valuable guidance for policymakers, regulators, and industry leaders seeking to strengthen national resilience in an evolving cyber threat landscape.

Critical infrastructures support essential services across various sectors, including finance, energy, healthcare, and public administration. However, their increasing exposure to the internet, combined with insecure communication protocols, weak authentication mechanisms, and misconfigurations, makes them prime targets for cyber threats. To address these risks, this paper presents a novel cybersecurity methodology tailored for Industrial Control Systems (ICS), leveraging the Shodan search engine for systematic vulnerability identification. The proposed approach integrates six key phases: IP discovery (1), DNS verification (2), port, protocol and service identification (3), operating system profiling (4), web application analysis (5), and comprehensive risk assessment using a customized risk matrix (6). This study contributes by (1) conducting a systematic literature review to identify gaps in existing ICS security frameworks, (2) developing a structured methodology for risk assessment across different ICS lifecycle phases, (3) applying the methodology to a real-world case study to validate its effectiveness, and (4) demonstrating its capability to systematically identify vulnerabilities, quantify risks, and provide actionable security insights. The results reveal critical security gaps, such as outdated software and unencrypted communication channels, emphasizing the need for improved security controls. By quantifying the attack surface and assessing risk levels, the proposed model enables stakeholders to prioritize remediation efforts effectively. The findings highlight the urgent need for proactive security measures in ICS environments, reinforcing the importance of continuous monitoring and risk mitigation strategies to enhance the resilience of critical infrastructures against evolving cyber threats.

A special legislation on criminal liability for offences against critical infrastructure objects is currently under development in Ukraine. The Cabinet of Ministers of Ukraine adopted the Concept for the development of a state system for critical infrastructure protection. The paper considers this legal area with regard to objects in the nuclear industry in the general context of critical infrastructure protection. It provides the current state in the legal regulation of fundamentals of criminal liability for offences against the critical infrastructure objects in the nuclear industry. The issue on the sufficiency and appropriateness of the existing level of such a liability is discussed further. The paper presents the list of some main critical infrastructure objects in accordance with the regulatory documents in the sphere of critical infrastructure protection and their classification. In addition, such concepts as “critical infrastructure” (relatively new notion in the national legislation), “unlawful intrusion”, “computer crimes”, “critical information infrastructure” and other concepts important to the nuclear industry were considered in this research. The notions presented in different regulatory documents were analyzed. The paper emphasizes that the legislation of Ukraine does not currently present special (separate) standards on the criminal liability for offences against critical infrastructure objects. Some promising issues related to fundamentals of the criminal liability and protection of critical infrastructure objects in the nuclear industry were also considered. The research involves the prospect of further development of a special law to define the area for improving relevant legislation on general regulation of these issues. The paper also stresses on the need to introduce some changes to the Criminal Code of Ukraine with respect to certain articles of section XIV.

In 2008, a new principle of spatial planning was added to the German Federal Spatial Planning Act. It demands critical infrastructure protection (CIP) be taken into account in all spatial planning activities. Since the term 'critical infrastructure' is quite young, this problem has not yet been explicitly treated in spatial planning activities. This paper presents results from a qualitative analysis of available regional spatial structure plans and from a survey of all regional spatial planning authorities in Germany. It shows that regional spatial planning has marginally dealt with CIP related questions like infrastructure reliability and spatial exposure in the past. However, the CIP concept, in addition to regional spatial planning methods and procedures, needs comprehensive efforts to approach and synchronise both public functions.

Critical Infrastructures (CIs) are vital backbones of modern societies and are increasingly depending on Information Technology (IT) and communication networks. Due to the increasing IT penetration, CIs are more and more connected with each other, with advantages and disadvantages. Due to this interconnection, CIs can provide their services more cost-efficiently. On the other hand, in case of disturbances, their behaviour cannot ever be mastered, as the large blackouts in the USA and Europe have shown. The increasing complexity and manifold conventional and emerging threats jeopardise the system of mutually dependent CIs. Critical Infrastructure Protection (CIP) attracts notice more and more from the public. Modelling and Simulation (M&S) expand now into the analysis and planning of processes and procedures of infrastructures. This paper gives an overview of the recent research in the field of CIP, where the EU project Integrated Risk Reduction of Information-based Infrastructure Systems (IRRIIS) is used as a role model.

Nearly 2 decades ago, James Woolsey ~later to become Director of the CIA! and Robert Kupperman ~then Senior Advisor to the Center for Strategic and International Studies—CSIS! warned that this nation’s infrastructures were unexpectedly and alarmingly vulnerable to terrorist attack, and they suggested efforts to protect them. Although their main focus was on the electric power infrastructure, their work and conclusions were of broader scope. However, no one paid much attention. In the mid 1990s, President Bill Clinton established the President’s Commission on Critical Infrastructure Protection ~PCCIP! under the chairmanship of retired Air Force General Robert T. Marsh. In its 15 months of work, the PCCIP examined threats to eight critical infrastructures, examined their vulnerabilities, designed a national strategy for critical infrastructure assurance, and developed a plan to implement the strategy. This time the Administration was listening. Clinton signed Presidential Decision Directive 63 ~PDD 63! in May, 1998, which set in motion an extensive multiagency program, coordinated by the White House, to pursue PCCIP’s recommended actions, but Congress failed to see the urgency and funded only bits and pieces of the program. September 11, 2001 focused everyone’s attention on critical infrastructure. We now have a bevy of presidential decisions and orders, as well as several key pieces of legislation dealing at least in part with our critical infrastructures. Most recently, we have a new Department of Homeland Security, although its name may change, and the commitment of substantial budgetary resources. The stage is now set for actually improving the security of these critical infrastructures. The PCCIP had identified a set of objectives to be met in protecting our critical infrastructures. The Administration accepted them. Congress also has, at least implicitly, accepted them. Are we achieving them? Here’s a summary of where we stand on some of the most important elements, as of this writing. There is no attempt at complete and comprehensive coverage. Many important efforts are not mentioned, simply to keep the paper within manageable proportions.

Modern society cannot evolve and operate without critical infrastructures, most of which have become dependent of internet connectivity for a variety of information management, communications, and control functions. In many cases, information and communications technology has become all-embracing, connecting other infrastructures referred to as critical information infrastructure. The increased interdependency has made critical infrastructure particularly vulnerable to natural hazards, technical problems, cyber-attacks, and terrorism. The topic of critical information infrastructure protection thus is attracting increasing attention and is progressively considered to be an integral part of national sustainability strategies. This publication delivers best practices on this topic derived from case studies and the status quo in the region and proposes recommendations for the further development of a delineated framework.

Private security is increasingly a key element in modern society, as it faces challenges that include growing threats to the security of individuals, organizations and property. In a world that is increasingly connected by technology in which violence, theft and other types of crime are increasingly common, the role of private security services is becoming increasingly important. Private security encompasses a wide range of services, from the physical security of facilities to the application of advanced technologies for the protection of data and systems. In addition, private security agencies often play a key role in the protection of prominent figures, organizations and specialized facilities, and after the adoption of the law on critical infrastructure, and the protection of critical infrastructure by providing a safe environment in which people can do business and live without hindrance. As a special security activity of the state, and through a possible public-private partnership, the protection of critical infrastructure appears. Critical infrastructure consists of various facilities and spaces without which the normal functioning of state bodies, the process of agricultural and industrial production and the lives of citizens is unthinkable

Besides its function to maintain the social and economic well-being of a nation, operating critical infrastructure serves as a proof of the ability of the state to provide protection to its citizens. Hence, a successful terrorist attack targeting critical infrastructure - in addition to generating fear and panic in the ranks of society undermines the operational character of the state. In recent years, several terrorist incidents in Europe have highlighted the vulnerability of critical infrastructure and, consequently, the importance of protecting it. Bearing this in mind, the protection of critical infrastructure has become a high priority for Western states, in parallel with the growing trend of risks, challenges and threats posed by international terrorism. Recently Europe has seen an increase in terrorist attacks against members of law enforcement as well as the armed forces. This paper argues that such attacks should also be considered as attacks on critical infrastructure, as it is ultimately the human resources being responsible for the well-functioning of those agencies. Further, the paper aims to examine the religious justification of Jihadist terrorist attacks against critical infrastructure.

Critical infrastructure must withstand cyber and physical assaults in today's interconnected world. This study explores innovative strategies to shield these systems from cyber-physical threats. As networks become more connected, cyberattacks grow more sophisticated, making it imperative to safeguard sectors like transportation, energy, water, and information. The paper analyzes the present and future threat landscape, identifying vulnerabilities within critical infrastructures and proposing targeted mitigation strategies to enhance security. The research leverages AI and machine learning to develop detection tools that identify and predict cyber-physical attacks, enhancing response times and preventive measures. Additionally, resilience engineering and architecture are crucial in fortifying infrastructure, enabling it to withstand and recover from attacks while maintaining essential functions. The study also reviews legislation and policies surrounding infrastructure protection, pinpointing shortcomings and recommending improvements to bolster national security. Effective countermeasures against cyber-physical threats require collaboration and information sharing among government bodies, industry stakeholders, and educational institutions. These partnerships facilitate the exchange of knowledge, best practices, and tools to address threats efficiently. Furthermore, the paper highlights the importance of training programs that equip professionals with skills to integrate cyber and physical security defenses. Exploring the integration of blockchain, IoT, and autonomous technologies could further enhance the resilience of critical systems. These technologies foster secure communications and automated responses to incidents. Lastly, community awareness initiatives play a vital role in preparing for and mitigating cyber-physical attacks, ensuring that public readiness and resilience are maintained. This comprehensive approach aims to fortify critical infrastructure against evolving cyber threats, ensuring continuous operation and security.

The article examines approaches to solving the terminological problem of defining the concept and content of “countering criminal offenses”, which is used in the context of the activities of the Security Service of Ukraine at critical infrastructure facilities. According to the results of the analysis of the scientific achievements related to the author’s subject, based on fundamental developments, the laws of logic and methods of cognition, the concept of the term and its meaning are formulated, the ways of solving the specified problem are determined, and the directions of further investigations are also proposed. The author, in particular, proved that the terms “fighting criminal offenses”, “crime”, “criminal misdemeanor”, “fighting crime”, “fighting crime”, “fighting crimes” are dialectically interrelated, but they are not identical its essence The fight against crime at the objects of critical infrastructure of Ukraine is a type of social activity, one of the main tasks of which is to combat criminal offenses. It is proposed to consolidate the definition of the term “counteraction to criminal offenses” in the context of the activity of the Security Service of Ukraine at critical infrastructure objects, as an object of social management, which is a specific activity of the special service in interaction and coordination with other subjects of the national system of critical infrastructure protection in Ukraine with the use of special forces, means, types, forms and methods of activity provided for by the legislation, which is organized on the basis, within the limits of authority, competence and in the manner provided for by the Constitution and laws of Ukraine, in the form of a task performance system: warning; detection; termination; disclosure of criminal offenses aimed at finding ways, means and other possibilities of effective influence on criminal offenses in order to reduce the intensity of the processes of their determination at all levels and stages, as well as to neutralize the effect of their consequences, while ensuring the protection of critical infrastructure. It is indicated that the content of the counteraction of the Security Service of Ukraine to criminal offenses at critical infrastructure facilities is the activity of the special service regulated by law with the use of special forces, means, types, forms and methods, which is aimed at the fulfillment of tasks: prevention, detection, termination and disclosure of criminal offenses at critical infrastructure projects of Ukraine, in order to ensure the protection of critical infrastructure.

Lithuania’s national security and economic stability rely on the resilience of its critical infrastructures (CIs), which face increasing threats from hybrid warfare and technological complexity. The article analyses Lithuania’s evolving approach to strengthening critical infrastructure (CI), shifting from traditional Critical Infrastructure Protection (CIP) to Critical Infrastructure Resilience (CIR). While CIP focuses on preventing risks and safeguarding assets, CIR emphasizes the ability of systems to anticipate, absorb, and recover from disruptions—especially in the face of hybrid threats and increasing technological complexity. This transition involves proactive policies, integrated risk assessments, and resilience-by-design principles in infrastructure planning. The article points out the foundational role of CI in national security. These systems—ranging from energy and transport to health and ICT—are essential for public safety, economic stability, and societal well-being. Their interdependence with national security sectors underlines the importance of robust protection and resilience frameworks. The article discusses key megatrends impacting CIP in Lithuania, including digital transformation, regulatory shifts, and growing system interconnectivity. These trends necessitate more dynamic and adaptive strategies as infrastructures face both traditional and emerging threats. The author of the article proposes the roadmap that includes seven key steps: adopting a resilience mindset, conducting comprehensive risk assessments, embedding resilience in infrastructure development, enhancing cybersecurity, fostering public–private collaboration, engaging communities, and implementing continuous monitoring and improvement mechanisms. The article concludes by recommending initiatives for further enhancement of the resilience of critical infrastructure.

One of the key concepts of Construction 4.0 is cyber-physical systems. The construction industry is increasingly creating valuable digital assets, but it is also gradually using digital technology to plan, design, build, monitor, and control the physical ones. This makes construction sites and operations vulnerable to cyber-attacks. While the damage to digital assets can have financial implications, attacks on digitally-controlled physical assets may impact people’s well-being and, in worst-case scenarios, result in casualties. The problem is amplified by the emerging cyber-physical nature of the systems, where the human checks may be left out. The construction industry could draw inspiration from the work done in critical infrastructures (CI). Construction is the prelude of any socio-technical asset tagged as a CI. While most assets may not be critical in the CI sense, they are essential to a business’ operations and the people directly or indirectly associated with them. This study presents a literature review on the previous CI protection (CIP) efforts and construction cybersecurity studies to show their synergy. Recommendations based on well-established CIP processes to make construction more cyber-secure are provided. It is expected that this study will create awareness about cybersecurity practices within the construction industry. Ongoing work includes understanding where construction stands and developing a framework to address cybersecurity throughout the different project phases.

The presented ongoing research project focuses on the challenges concerning the protection of critical infrastructures. Since critical infrastructures become more and more cross-linked a single breakdown can cause serious cascading effects on other infrastructures. Interdependencies of critical infrastructures are boundaryspanning and therefore public authorities, operating companies and other stakeholders (e.g. German Federal Agency for technical relief, Red Cross) as well as stakeholders of neighbouring states must have access to a solution which enables the urgently needed cooperation of all parties involved. The aim of the project is to develop an online platform to facilitate knowledge exchange among stakeholders, an online tool to analyse the interdependencies and to design a sustainable and effective knowledge management. This platform will allow registered members to find and make use of the information about the stakeholders and their competencies concerning the protection of critical infrastructures.