Information Security Incident Management Training Program

The power industry is currently facing the evolution of smart grids, which may imply major technological, operational, and procedural changes. Information security challenges arise due to these changes, which is why this industry makes a valuable case for this research project. Technological changes might introduce new threats that need to be addressed, and being prepared to handle these threats are of utmost importance in order to succeed with smart grids. Preparing for information security incident man agement requires training. Well documented procedures and clear definitions of roles and responsibilities are among the basic structures that need to be in place, but when an incident occurs, there is usually no time to study documentation in order to fig ure out the most appropriate response strategies; the involved personnel needs to be well trained and well experienced, and hence able to make the right decisions under pressure. Wrong decisions may cause the incident to escalate, leading to more severe c onsequences than necessary. The main objective of the mobility project is to develop a training program that will support Norwegian distribution system operators in improving their information security incident management process. The research activitie s include a literature review on incident management and a feasibility study in order to evaluate the training program. This evaluation will be done in close cooperation with the Norwegian power industry after the research visit. In addition to a trainin g program and an evaluation of this, the results will include two scientific papers and presentations at both scientific conferences and venues where the industry meet.