ENGINEERING-ORIENTED CYBER RISK ASSESSMENT FRAMEWORK FOR CRITICAL ENERGY INFRASTRUCTURE: APPLICATION TO OFFSHORE AND PIPELINE SYSTEMS IN THE BLACK SEA REGION

Alexandru GEORGESCU, Carmen Elena CIRNU, Andreea DINU, Tina ANDOLJŠEK

Abstract


Critical Energy Infrastructures (CEI) are complex cyber-physical systems integrating operational technology (OT) and information technology (IT) components whose disruption may generate severe operational, safety, environmental, and economic consequences. This paper develops a structured engineering-oriented framework for assessing cyber risks to CEI, grounded in industrial control system security principles and aligned with international standards such as IEC 62443 and NIST Cybersecurity Framework 2.0. The study applies a systematic review of recent cyber incidents (2023–2026) and organizes them into an engineering-based threat and vulnerability taxonomy. The framework is subsequently applied to two representative infrastructure types relevant to the Black Sea region: offshore oil and gas platforms and cross-border pipeline SCADA systems. The analysis identifies critical attack propagation paths between IT and OT layers, highlights vulnerabilities in supply-chain integration and remote access mechanisms and proposes technically grounded resilience measures. The paper moves beyond descriptive geopolitical analysis by providing a structured analytical model and operational recommendations applicable to engineering practice in the energy sector.

Full Text:

PDF

References


North, M. (2025). Why the energy transition means more cyberattacks. Mitsubishi Heavy Industries (MHI). Spectra. https://spectra.mhi.com/why-the-energy-transition-means-more-cyberattacks

Eurelectrics. (2025) Cybersecurity in the power sector. https://www.eurelectric.org/in-detail/cybersecurity-in-th e-power-sector/

. Sophos. (2025). The state of ransomware 2025. A Sophos Whitepaper. https://assets.sophos.com/X24WTUEQ/at/9brgj5n44hqvgsp5f5bqcps/sophos-state-of-ransomware-2024-wp.pdf

eSentire. (2026). The Industrialization of Cybercrime: Identities are Under Attack 2025 Year in Review, 2026 Threat Landscape Outlook Report. https://www.esentire.com/resources/library/esentire-2026-annual-cyber-threat-report

Lakshminarayana, S., Maple, C., Larkins, A., Flack, D., Few, C., David, K.-A., & Srivastava, A. K. (2023). Cybersecurity threats to power grid operations from the demand-side response ecosystem. arXiv. https://doi.org/10.48550/arxiv.2310.18820

Global Security Forum. (2024). Cybersecurity Workforce Report: Bridging the W[orkforce Shortage and Skills Gap. https://gcforum.org/en/research-publications/cybersecurity-workforce-report-bridging-the-workforce-shortage-and-skills-gap/

Verizon. (2024). 2024 data breach investigations report (DBIR). https://www.verizon.com/business/resources/reports/2024-dbir-data-breach-investigations-report.pdf

World Economic Forum. (2026). Global Cybersecurity Outlook 2026. https://www.weforum.org/publications/global-cybersecurity-outlook-2026/

AON. (2026). Cyber 2026: Evolving Threats Demand Strategic Leadership. https://www.aon.com/en/insights/articles/cyber-2026-evolving-threats-demand-strategic-leadership

NATO Scicence and Technology Organisation. (2025). Cognitive Warefare - NATO Chief Scientist Research Report. NATO Headquarters. Brussels. 2025. https://www.sto.nato.int/document/cognitive-warfare/

ACM Computing surveys. (2016). A Survey and Analysis of the GNSS Spoofing Threat and Countermeasures. DOI: 10.1145/2897166. https://www.researchgate.net/publication/301798786_A_Survey_and_Analysis_of_the_GNSS_Spoofing_Threat_and_Countermeasures

Government of Canada, Canadian Centre for Cyber Security. (2023). The cyber threat from supply chains. https://www.cyber.gc.ca/en/guidance/cyber-threat-supply-chains

Amomo, C.G. (2023). Countering IoT-Based Cyber-Physical Manipulation: A Framework for National Resilience Against Systemic Disruption. International Journal of Scientific Research & Engineering Trends, 9(6), ISSN: 2395-566X, 2023.

Dragos, Inc. (2026). DynoWiper: Analyzing the coordinated strike on Poland’s energy grid. Dragos Industrial Cybersecurity. https://www.dragos.com/blog/poland-power-grid-attack-electrum-targets-distributed-energy-2025

ESET. (2026). DynoWiper update: Technical analysis and attribution. https://www.welivesecurity.com/en/eset-research/dynowiper-update-technical-analysis-attribution/

Walter, M., Vineetha Harish, A., Christison, L. (2025). Visualisation of cyber vulnerabilities in maritime human-autonomy teaming technology. WMU J Marit Affairs 24, 5–31, https://doi.org/10.1007/s13437-025-00362-z

Hong, Y. (2023). Exclusive: Hackers behind cyberattack on Wuhan Earthquake Monitoring Center aim at stealing geological data: top cybersecurity expert. GlobalTimes, https://www.globaltimes.cn/page/202308/1295562.shtml

ACM Computing surveys. (2016). A Survey and Analysis of the GNSS Spoofing Threat and Countermeasures. DOI: 10.1145/2897166. https://www.researchgate.net/publication/301798786_A_Survey_and_Analysis_of_the_GNSS_Spoofing_Threat_and_Countermeasures

CISA (2025). Joint Guidance: Identifying and Mitigating Living Off the Land Techniques. Cybersecurity and Infrastructure Security Agency, Washington DC, https://www.cisa.gov/sites/default/files/2025-03/Joint-Guidance-Identifying-and-Mitigating-LOTL508.pdf

Claroty. (2025). The Global State of CPS Security 2025: Navigating Risk in an Uncertain Economic Landscape. https://claroty.com/resources/reports/the-global-state-of-cps-security-2025-navigating-risk-in-an-uncertain-economic-landscape

TSA (2024). Security Directive Pipeline-2021-0lC Enhancing Pipeline Cybersecurity. https://www.tsa.gov/sites/default/files/sd-pipeline-2021-01c.pdf

Department of Energy (2022). The API 1164 framework and cybersecurity considerations for pipeline transportation and storage. Technology Advancement and Deployment Task Group, Working Document of the NPC Study – Dynamic Delivery – America’s Evolving Oil and Natural Gas Transportation, Topic Paper #4-15, https://www.energy.gov/sites/default/files/2022-10/Infra_Topic_Paper_4-15_FINAL.pdf

Georgescu, A., Gurău, M.M., Bucovetchi, O. and Dinu, A. (2024) The European Cybersecurity Framework for Critical Energy Infrastructures, in Barichella, A. and Yada, J. (eds) The Palgrave Handbook of Cybersecurity, Technologies and Energy Transitions. Palgrave Studies in Energy Transitions. Cham: Palgrave Macmillan. Available at: https://doi.org/10.1007/978-3-031-04196-9_9-1

Badea, M., Bucovețchi, O., Gheorghe, A. V., Hnatiuc, M., & Raicu, G. (2025). Maritime Industry Cybersecurity Threats in 2025: Advanced Persistent Threats (APTs), Hacktivism and Vulnerabilities. Logistics, 9(4), 178. https://doi.org/10.3390/logistics9040178

Raman, G., AlShebli, B., Waniek, M., Rahwan, T., Peng, JC-H. (2020) How weaponizing disinformation can bring down a city’s power grid. PLoS ONE 15(8): e0236517. https://doi.org/10.1371/journal.pone.0236517

Kovanan, T., Nuojua, V., Lehto, M. (2019). Cyber Threat Landscape in Energy Sector Cyber Threat Landscape in Energy Sector. pp. - 353-361. 13th International Conference on Cyber Warfare and Security, ICCWS2018, 8 - 9th March 2018, National Defense University, Washington DC, USA

Republic of Poland, Ministry of Digital Affairs, CERT Polska, Energy Sector Incident Report – 29 December. https://cert.pl/en/posts/2026/01/incident-report-energy-sector-2025/

Kuzior, A., Tiutiunyk, I., Zielińska, A., & Kelemen, R. (2024). Cybersecurity and cybercrime: Current trends and threats. Journal of International Studies, 17(2), 220–239. https://doi.org/10.14254/2071-8330.2024/17-2/12

Sambucci, L., Paraschiv, E.A. (2024). The Accelerated Integration of Artificial Intelligence Systems and Its Potential to Expand the Vulnerability of Critical Infrastructure. Romanian Journal of Information Technology and Automatic Control 34 (3): 131–148.

Iancu, N., Gurău, M-M, Raicu, G., Cîmpineanu, M-J. (2025). Building Europe’s Civilian-Defence Cyber Resilience Through Expanding and Consolidating Networks: The ECYBRIDGE Experience. International Journal of Cyber Diplomacy 6: 19–37. https://doi.org/10.54852/ijcd.v6y202502

Hadji-Janev, M. (2021). Hyper Threats to Critical Information Infrastructure: Bringing the AI in the Game. International Journal of Cyber Diplomacy 2. https://ijcd.ici.ro/2021/hyper-threats-to-critical-information-infrastracture-bringing-the-ai-in-the-game/

Dinu, A., Vasile, P-C, Georgescu, A. (2024). AI-Driven Solutions for Cybersecurity: Comparative Analysis and Ethical Aspects. Romanian Journal of Information Technology and Automatic Control 34 (3): 35–48


Refbacks

  • There are currently no refbacks.


JOURNAL INDEXED IN :