Reference no: EM133269846

"C-Energy Systems is a small-scale energy company with about 60 - 100 staff who manage the power supply to a small cluster of 50 smart buildings. The company's operators that maintain the mini-power grid have a secure, encrypted VPN (Virtual Private Network) tunnel that enables them to remotely monitor the smart buildings' power status. They use monitoring tools like HMIs (Human Machine Interfaces), PLCs (Programmable Logic Controllers), and sensors. The HMI monitors the power status of the smart buildings and gives the operators the ability to turn on or shut down the power supply to the grid for maintenance purposes.

A malicious threat actor has gotten access to the industrial network using the credentials of one of the operators gotten through a successful spear phishing campaign. The attacker, now inside the network, has access to the controllers and is able to shut off power to the smart buildings - leaving occupants in the dark and without any air conditioning. More critically, the attacker has successfully disrupted the communication between the operators' HMI and the smart buildings' controllers - effectively locking them out and unable to restore power."

Questions:-

Identify 3-4 Threats

Do Quantitative Risk Analysis, thus identifying the most pertinent risk

Do Quantitative analysis to identify best control.