Application of EBIOS for the risk assessment of ICT use in electrical distribution sub-stations

This paper addresses the challenge of applying an Information System risk assessment technique in the context of an Industrial Control System, specifically the electrical distribution network. This paper describes the application of the technique EBIOS (Expression des Besoins et Identification des Objectifs de Sécurité) to evaluate the risk associated with use of supporting Information and Communication Technologies (ICT) within distribution substations operation. The paper highlights the detailed and rigorous nature of the approach in addition to identifying some limitations of the approach notably the difficulties of representing both the interdependency between the electrical distribution network and its supporting ICT and the evolving risk profile of dynamic system. Consequently, the paper will also highlight ongoing work aimed at addressing these limitations.