Um Scorecard Operacional para Métricas de Segurança e Resiliência em Sistemas de Energia Baseados em IoT
Resumo
A digitalização dos sistemas energéticos amplia a superfície de ataque e a dependência de componentes IoT/OT, ao mesmo tempo em que requisitos regulatórios como NIS2, CRA, LGPD e PNCiber, conjugados a exigências operacionais, demandam medições comparáveis e auditáveis de segurança e resiliência. Para responder a essa necessidade, este trabalho propõe um scorecard operacional composto por 15 submétricas distribuídas em 7 dimensões orquertradas por regras de gating que tornam dimensões críticas não compensáveis. A metodologia é validada em três cenários contrastantes derivados de premissas explícitas, a saber, um sistema doméstico de gerenciamento de energia, uma plataforma de comunidade de energia renovável e uma microrrede hospitalar, avaliados sob quatro perfis de ponderação. Os scores resultantes evidenciam capacidade discriminativa ao longo de todo o espectro de maturidade das aplicações, e a metodologia mantém-se robusta a variações dos pesos.Referências
Abreu Jr., V., Santin, A. O., Viegas, E. K., Vicentini, C. J. A., and da Silva, M. N. (2021). Gestão de identidade e acesso para dispositivos IoT na Smart Grid. In Simpósio Brasileiro de Segurança da Informação e de Sistemas Computacionais (SBSeg 2021), pages 1–14, Belém, PA.
Achaal, B., Adda, M., and Berger, M. (2024). Study of smart grid cyber-security, examining architectures, communication networks, cyber-attacks, countermeasure techniques, and challenges. Cybersecurity, 7(1).
Aghazadeh Ardebili, A. et al. (2025). IoT-driven resilience monitoring: Case study of a cyber-physical system. Applied Sciences, 15(1):55.
Coppolino, L., D’Antonio, S., Mazzeo, G., and Romano, L. (2023). Building cyber-resilient smart grids with digital twins and data spaces. Applied Sciences, 13(24):13060.
Da Silva, G. F. P., Costa, D. G., and De Jesus, T. C. (2023). A secure OTA approach for flexible operation of emergency detection units in smart cities. In 2023 IEEE International Smart Cities Conference (ISC2), pages 01–07.
Ebad, S. A. (2023). Quantifying IoT security parameters: An assessment framework. IEEE Access, 11:101087–101097.
ENISA (2011). Resilience metrics and measurements: Technical report. Technical report, European Network and Information Security Agency, Heraklion, Greece.
Fagan, M., Marron, J., Brady, K., Cuthill, B., Megas, K., and Herold, R. (2021). IoT device cybersecurity guidance for the federal government: Establishing IoT device cybersecurity requirements. NIST Special Publication 800-213, National Institute of Standards and Technology, Gaithersburg, MD.
FIRST.org (2019). Common Vulnerability Scoring System v3.1: Specification Document. Forum of Incident Response and Security Teams.
Horálek, J. and Sobeslav, V. (2023). Security baseline for substation automation systems. Sensors, 23(16):7125.
International Electrotechnical Commission (2007–2024). IEC 62351 — Power Systems Management and Associated Information Exchange: Data and Communications Security. IEC TC57 WG15.
ISA/IEC (2018–2024). ISA/IEC 62443 — Security for Industrial Automation and Control Systems. ISA / IEC TC65/SC65A.
Jara, A. J. et al. (2024). CyberSecurity Resilience Act (CRA) in practice for IoT devices: Getting ready for the NIS2. In 2024 IEEE Smart Cities Futures Summit (SCFC). IEEE.
Kim, S., Park, K.-J., and Lu, C. (2022). A survey on network security for cyber-physical systems: From threats to resilient design. IEEE Communications Surveys & Tutorials, 24(3):1534–1573.
Lento, L. O. B., Patinho, P., and Abreu, S. (2023). Um modelo declarativo para gestão de riscos em IoT. In Simpósio Brasileiro de Segurança da Informação e de Sistemas Computacionais (SBSeg 2023), pages 570–575, Juiz de Fora, MG.
Linkov, I., Eisenberg, D. A., Plourde, K., Seager, T. P., Allen, J., and Kott, A. (2013). Resilience metrics for cyber systems. Environ. Systems and Decisions, 33(4):471–476.
Mehmood, A., Epiphaniou, G., and Maple, C. (2023). A hybrid methodology to assess cyber resilience of IoT in energy management and connected sites. Sensors, 23(21):8720.
Mishchenko, D., Oļeiņikova, I., and Erdődi, L. (2024). Multidomain cyber-physical testbed for power system vulnerability assessment. IEEE Access, 12:38135–38149.
Nguyen, L.-H., Nguyen, V.-L., Hwang, R.-H., Kuo, J.-J., Lai, Y.-W., and Lee, Y.-C. (2024). Toward secured smart grid 2.0: Exploring security threats, protection models, and challenges. IEEE Communications Surveys & Tutorials.
NIST Smart Grid Interoperability Panel – Cyber Security Working Group (2014). Guidelines for smart grid cybersecurity. NISTIR 7628 Rev. 1, National Institute of Standards and Technology, Gaithersburg, MD.
NTIA (2021). The minimum elements for a software bill of materials (SBOM). Technical report, National Telecommunications and Information Administration, U.S. Department of Commerce. Pursuant to Executive Order 14028.
Parsons, E. K., Panaousis, E., and Loukas, G. (2023). A survey on cyber risk management for the internet of things. Applied Sciences, 13(15):9032.
Quincozes, V. E., Quincozes, S. E., Albuquerque, C., Passos, D., and Mossé, D. (2025). Uma avaliação estendida do impacto da seleção e enriquecimento de features em sistemas de detecção de intrusão para Smart Grids. In Simpósio Brasileiro de Cibersegurança (SBSeg 2025), pages 905–920.
Sarker, P. S., Sadanandan, S. K., and Srivastava, A. K. (2022). Resiliency metrics for monitoring and analysis of cyber-power distribution system with IoTs. IEEE Internet of Things Journal, 9(10):7826–7837.
Schroeder, K., Souppaya, M., and Pillitteri, V. (2024). Measurement guide for information security: Volume 2 — developing an information security measurement program. NIST Special Publication 800-55 Vol. 2, National Institute of Standards and Technology, Gaithersburg, MD.
Stouffer, K., Pease, M., Tang, C., Zimmerman, T., Pillitteri, V., Lightman, S., Hahn, A., Saravia, S., Sherule, A., and Thompson, M. (2023). Guide to operational technology (OT) security. NIST Special Publication 800-82 Rev. 3, National Institute of Standards and Technology, Gaithersburg, MD.
U.S. Department of Energy (2024). Microgrid overview. Fact Sheet 46060, Grid Deployment Office, U.S. Department of Energy.
Zografopoulos, I., Ospina, J., Liu, X., and Konstantinou, C. (2021). Cyber-physical energy systems security: Threat modeling, risk assessment, resources, metrics, and case studies. IEEE Access, 9:29775–29818.
Achaal, B., Adda, M., and Berger, M. (2024). Study of smart grid cyber-security, examining architectures, communication networks, cyber-attacks, countermeasure techniques, and challenges. Cybersecurity, 7(1).
Aghazadeh Ardebili, A. et al. (2025). IoT-driven resilience monitoring: Case study of a cyber-physical system. Applied Sciences, 15(1):55.
Coppolino, L., D’Antonio, S., Mazzeo, G., and Romano, L. (2023). Building cyber-resilient smart grids with digital twins and data spaces. Applied Sciences, 13(24):13060.
Da Silva, G. F. P., Costa, D. G., and De Jesus, T. C. (2023). A secure OTA approach for flexible operation of emergency detection units in smart cities. In 2023 IEEE International Smart Cities Conference (ISC2), pages 01–07.
Ebad, S. A. (2023). Quantifying IoT security parameters: An assessment framework. IEEE Access, 11:101087–101097.
ENISA (2011). Resilience metrics and measurements: Technical report. Technical report, European Network and Information Security Agency, Heraklion, Greece.
Fagan, M., Marron, J., Brady, K., Cuthill, B., Megas, K., and Herold, R. (2021). IoT device cybersecurity guidance for the federal government: Establishing IoT device cybersecurity requirements. NIST Special Publication 800-213, National Institute of Standards and Technology, Gaithersburg, MD.
FIRST.org (2019). Common Vulnerability Scoring System v3.1: Specification Document. Forum of Incident Response and Security Teams.
Horálek, J. and Sobeslav, V. (2023). Security baseline for substation automation systems. Sensors, 23(16):7125.
International Electrotechnical Commission (2007–2024). IEC 62351 — Power Systems Management and Associated Information Exchange: Data and Communications Security. IEC TC57 WG15.
ISA/IEC (2018–2024). ISA/IEC 62443 — Security for Industrial Automation and Control Systems. ISA / IEC TC65/SC65A.
Jara, A. J. et al. (2024). CyberSecurity Resilience Act (CRA) in practice for IoT devices: Getting ready for the NIS2. In 2024 IEEE Smart Cities Futures Summit (SCFC). IEEE.
Kim, S., Park, K.-J., and Lu, C. (2022). A survey on network security for cyber-physical systems: From threats to resilient design. IEEE Communications Surveys & Tutorials, 24(3):1534–1573.
Lento, L. O. B., Patinho, P., and Abreu, S. (2023). Um modelo declarativo para gestão de riscos em IoT. In Simpósio Brasileiro de Segurança da Informação e de Sistemas Computacionais (SBSeg 2023), pages 570–575, Juiz de Fora, MG.
Linkov, I., Eisenberg, D. A., Plourde, K., Seager, T. P., Allen, J., and Kott, A. (2013). Resilience metrics for cyber systems. Environ. Systems and Decisions, 33(4):471–476.
Mehmood, A., Epiphaniou, G., and Maple, C. (2023). A hybrid methodology to assess cyber resilience of IoT in energy management and connected sites. Sensors, 23(21):8720.
Mishchenko, D., Oļeiņikova, I., and Erdődi, L. (2024). Multidomain cyber-physical testbed for power system vulnerability assessment. IEEE Access, 12:38135–38149.
Nguyen, L.-H., Nguyen, V.-L., Hwang, R.-H., Kuo, J.-J., Lai, Y.-W., and Lee, Y.-C. (2024). Toward secured smart grid 2.0: Exploring security threats, protection models, and challenges. IEEE Communications Surveys & Tutorials.
NIST Smart Grid Interoperability Panel – Cyber Security Working Group (2014). Guidelines for smart grid cybersecurity. NISTIR 7628 Rev. 1, National Institute of Standards and Technology, Gaithersburg, MD.
NTIA (2021). The minimum elements for a software bill of materials (SBOM). Technical report, National Telecommunications and Information Administration, U.S. Department of Commerce. Pursuant to Executive Order 14028.
Parsons, E. K., Panaousis, E., and Loukas, G. (2023). A survey on cyber risk management for the internet of things. Applied Sciences, 13(15):9032.
Quincozes, V. E., Quincozes, S. E., Albuquerque, C., Passos, D., and Mossé, D. (2025). Uma avaliação estendida do impacto da seleção e enriquecimento de features em sistemas de detecção de intrusão para Smart Grids. In Simpósio Brasileiro de Cibersegurança (SBSeg 2025), pages 905–920.
Sarker, P. S., Sadanandan, S. K., and Srivastava, A. K. (2022). Resiliency metrics for monitoring and analysis of cyber-power distribution system with IoTs. IEEE Internet of Things Journal, 9(10):7826–7837.
Schroeder, K., Souppaya, M., and Pillitteri, V. (2024). Measurement guide for information security: Volume 2 — developing an information security measurement program. NIST Special Publication 800-55 Vol. 2, National Institute of Standards and Technology, Gaithersburg, MD.
Stouffer, K., Pease, M., Tang, C., Zimmerman, T., Pillitteri, V., Lightman, S., Hahn, A., Saravia, S., Sherule, A., and Thompson, M. (2023). Guide to operational technology (OT) security. NIST Special Publication 800-82 Rev. 3, National Institute of Standards and Technology, Gaithersburg, MD.
U.S. Department of Energy (2024). Microgrid overview. Fact Sheet 46060, Grid Deployment Office, U.S. Department of Energy.
Zografopoulos, I., Ospina, J., Liu, X., and Konstantinou, C. (2021). Cyber-physical energy systems security: Threat modeling, risk assessment, resources, metrics, and case studies. IEEE Access, 9:29775–29818.
Publicado
01/09/2026
Como Citar
OLIVEIRA, Lucas S.; ALVES, Gabriel S. B.; JESUS, Thiago C..
Um Scorecard Operacional para Métricas de Segurança e Resiliência em Sistemas de Energia Baseados em IoT. In: SIMPÓSIO BRASILEIRO DE CIBERSEGURANÇA (SBSEG), 26. , 2026, Armação dos Búzios/RJ.
Anais [...].
Porto Alegre: Sociedade Brasileira de Computação,
2026
.
p. 1212-1227.
DOI: https://doi.org/10.5753/sbseg.2026.28607.
