Mitigating Cyberattack Risks in Digital Substations Using a Cybersecurity Model

A baseline risk assessment was conducted by mapping assets, threats, vulnerabilities, and controls, resulting in a pre-mitigation risk matrix with four high-risk scenarios: false data injection (FDI) on GOOSE messages, denial of service (DoS) on time synchronization, unauthorized remote SCADA access, and manipulation of sampled values (SV). For validation, a selected subset of controls was implemented. The post-mitigation analysis showed a reduction to a single Moderate risk scenario, representing a 75% decrease in high-risk exposures. These results demonstrate the model’s effectiveness in enhancing operational resilience, even when implemented only partially.

This research contributes a validated, standards-aligned methodology for assessing and mitigating cyber risks in IEC 61850 substations, offering both practical implementation guidance and quantitative evidence of its impact. The findings provide a foundation for scaling the model to production environments and integrating it into broader cybersecurity strategies for critical infrastructure.