# An Integrated Cyber Security Risk Management Approach for a Cyber-Physical System
## 6 Discussion
### Applicability of the Approach  
Several observations have been identified in regards to the applicability of the approach. The activities presented in the process are functional and acceptable. The integrated risk management approach provides the basics for identifying critical assets, assessing their vulnerabilities and potential threats, and the possible risk that could disrupt the business operations. This approach has made stakeholders aware of the possible threats that could impact their critical functions and business operations, therefore taking the necessary actions to control threats and risk events from occurring. Furthermore, understanding the current risk management practice within Disco, rating it, and proposing improvements certainly created awareness at the overall organizational level. The management of Disco planned to achieve tier 2 (risk informed) from tier 1 (partial) by implementing the integrated risk management process in a proactive manner, prioritizing cyber security activities,  
\begin{table}
\begin{tabular}{c c} \hline
**Scenario** & **Controls** \\ \hline \multirow{4}{*}{Scenario 1} & C1.1 User training is required \\  & C1.2 Strong and secure firewall configuration \\  & C1.3 Advanced control access for data provided to ensure limited access to assets \\  & C1.4 Strong combination of password and username \\  & C1.5 Regular vulnerability assessments should be carried out \\  & C1.6 Encryption of data at all times and restricted access. \\ \hline \multirow{4}{*}{Scenario 2} & C2.1 Notification of events relating to occurrences is sent to customers when a power \\  & outage occurs or likely to occur \\ \cline{1-1}  & C2.2 IT personnel security awareness programs should be I place every 6 months or yearly \\ \cline{1-1}  & C2.3 Electricity suppresses should not go out of business \\ \cline{1-1}  & C2.4 Necessary testing to confirm that the service, control process, alarm handling are \\ \cline{1-1}  & functioning and protected from risk. \\ \hline \multirow{4}{*}{Scenario 3} & C3.1 Volation will lead to a legal penalty \\ \cline{1-1}  & C3.2 Monitoring users pattern and history \\ \cline{1-1}  & C3.3 Reset the default password by the provider \\ \cline{1-1}  & C3.4 Monitoring systems \\ \cline{1-1}  & C3.5 Procedure to reset passwords for the smart meter after every 6 months. \\ \cline{1-1}  & C3.6 Sign agreement with the customers \\ \cline{1-1}  & C3.7 Accurate customer usage estimation \\ \cline{1-1}  & C3.8 Tools to monitor usage of electricity accurately. \\ \hline \end{tabular}
\end{table}
Table 8: Security controls.  
\begin{table}
\begin{tabular}{c c c c} \hline
**Risk Name** & **Attack Scenario** & **Affected Asset** & **Likelihood** \\ \hline Unavailability of the & Scenario 1 & Communication systems & Likely \\ \cline{1-1} \cline{3-4} \cline{  
sharing information an informal basis, and involving all departments and collaboration with external stakeholders.  
The approach is a systematic process that integrates all areas from a holistic perspective of identifying risk which includes the stakeholders, risk types, frameworks, and the organization. It evaluates the impact of a cyber-attack on business values, organizational functions, operations, and other technical areas of the power grid system. There are three cyber security attack scenarios considered from seven assets and 18 controls, that are proposed, which is comprehensive compared to Disco's previous risk management results. However, some of the risks that could disrupt organizations operations include denial of service attack and unprotected communication lines. In order to understand the risk level, the approach can assess vulnerabilities and the impact level of an attack on the organization, using a semi-quantitative risk analysis technique.