University Report: MGT5ERM Article Review and Case Study Synthesis

This report, prepared for a university course, undertakes a comprehensive review of an article focusing on cybersecurity governance and management within Brazilian energy utilities. The report begins with a synopsis of the article, highlighting the risk management framework, its constructs, findings, and assertions. It describes the organizational background, industry context, cyber spaces, and associated cyber risks. A significant portion of the report explains the processes and elements pertaining to cyber risk governance and management within an organizational ERM framework, examining the implications of the proposed model. The report then synthesizes the article's concepts into a strategic ERM framework, recommending specific actions for asset management and risk evaluation. It discusses strengths, weaknesses, and processes to overcome weaknesses in the framework. The report concludes with a case study synthesis, offering recommendations for a strategic ERM framework and detailing its operational efficiency and reliability for the energy utilities.

Running head: ARTICLE REVIEW AND CASE STUDY SYNTHESIS
Article Review and Case Study Synthesis
Name of the Student
Name of the University
Author’s Note:

1
ARTICLE REVIEW AND CASE STUDY SYNTHESIS
Table of Contents
Part A: Article Review...............................................................................................................2
Part B: Case Study Synthesis.....................................................................................................8
References................................................................................................................................10

2
ARTICLE REVIEW AND CASE STUDY SYNTHESIS
Part A: Article Review
1. A brief synopsis of the article and risk management framework, its constructs,
findings and assertions
Cyber security within the most critical infrastructure has eventually aroused the
subsequent interest as well as worry of the energy utility, consumers, regulatory agency, and
government or even for the researches and academic institutions (Pardini, Heinisch and
Parreiras 2017). This article has built a specific theoretical model or framework for cyber
security management and governance for testing it with few of the academic professionals
and experts from the respective energy sectors. With the help of Delphi methodology and
statistics technique regarding validation and verification, the authors have developed an
assessment instrument on the basis of two constructs of management and governance.
A proper analysis of the Brazilian energy utility situation is being undertaken for
protecting the cyberspaces. This article has eventually reached to 2 fronts of an empirical or
even a conceptual one, since it systematises and enlarges the subsequent knowledge about
features of cyberspace management or governance (Buczak and Guven 2015). The
methodological framework used in this article helps for measurement of the dimensions in
the energy utility. This article has clearly described about the framework of cybersecurity
governance or even management for the smart grid within Brazilian energy utility. The
security of the smart grids or critical infrastructures majorly follows the traditional protection
means.
2. Description of the organizational background, industry, cyber spaces and cyber risks
Brazilian energy utilities are responsible for producing different energy aspects to the
consumers. Energy provisioning is termed as one of the most essential services as well as a
major element to improve overall life quality of population after successful enhancement of

3
ARTICLE REVIEW AND CASE STUDY SYNTHESIS
sustainable development and social inclusion (Elmaghraby and Losavio 2014). However,
they have to protect their cyber spaces from any kind of cyber risk and ensuring safety and
security to a high level. Such security refers to processes and technologies for successfully
protecting data, programs, devices and networks from attacks, damages as well as
unauthorized access. The smart grid comprise of an incremented utilization of control
technology and digitalized information for improvement of efficiency, security and reliability
to electric grids (Cherdantseva et al. 2016).
There is an increasing system vulnerabilities and for this particular fact, it is
completely unknown if Brazilian energy is prepared for facing the threats. The conceptual
framework within smart grid environment is being handled and the conceptions for
management and governance are being considered for cyber security (Wells et al. 2014).
Moreover, it was extremely important to manage within cyber space as well as the dimension,
the theoretical-empirical models and even the methodologies for better research as well as
application and validation of these models for the subsequent scopes of Brazilian energy
utility. The smart grid is the system for transmission of electric grids as well as distribution
with the help of remote sensing, bidirectional communications, proper monitoring as well as
control systems, being distributed in energy provisioning.
There exists some of the most distinctive and important cyber risks that are needed to
be analysed on a priority basis (Abawajy 2014). There are few categories of cyber risks,
which include inadvertent, deliberated, inaction, hardware, software, systems, process design
and execution, controlling of processes, supporting procedures, legal problems, business
related issues and service dependencies. The major issues under these thirteen categories are
errors, mistakes, frauds, sabotage, theft, vandalism, knowledge, guidance, performance,
maintenance, compatibility, designs, specification, integrations, complexities, process
flowing, escalation of issues, status monitoring, metrics, staffing, training and development,

4
ARTICLE REVIEW AND CASE STUDY SYNTHESIS
fire, flood, regulatory compliance, supplier failure, market conditions, emergency services
and transportation (Craigen, Diakun-Thibault and Purse 2014).
3. Explanation of processes and elements pertaining to the cyber risk governance with
ERM framework
There are 2 most important elements of the entire cyber-environment, which are the
internal computer-networked environment that is being utilized for on critical operation as
well as administrative task and secondly the communication network, which is responsible
for supporting the confidential data over the controlled systems and even controlling original
physical procedures (Cavelty 2014). Apart from the 2 infrastructures mentioned above, it is
extremely vital to involve operational data, which can refer to the critical organizational
procedures. The invaders of this cyber-environment could be sub divided based on the attack
motivation. The invader could be one of the nations, the activist group or even an ordinary
individual. The cyber security has two constructs, namely management and governance.
This governance emphasizes on effective practices of information security
governance and with methodology, the cyber security can be analysed with various
approaches like strategic integration, risk mitigation, organizational environment for better
decision making in the organization (Ben-Asher and Gonzalez 2015). There are various
conditions that are being provided by the respective company for the core purpose of
delegating the responsibilities and duties in fighting competitors’ interests and violating
organizational cyber space. This dimension commitment of directors substantially indicates
proper involvement of the shareholders, executives as well as counsellors for monitoring
cyber security action deployment. The strategic enterprise risk management framework for
this particular cyber security model is perfect for Brazilian energy utilities and it is required

5
ARTICLE REVIEW AND CASE STUDY SYNTHESIS
to keep the entire organizational environment both updated and managed (Knowles et al.
2015).
4. Discussion on the policy and process implications of proposed model to the company
as a strategic organizational enterprise risk management framework
The policy and process implications of the proposed model to the respective company
as the strategic organizational ERM framework are required to be considered for
understanding the set of dimensions from corporate governance (Lam 2014). The first and the
foremost dimension is an effective legal or even regulatory basis within the governance of the
cyber security for smart grid. It eventually refers to the fact that regulatory and legal aspects
are important for understanding if ERM framework can fulfil the need of energy utilities with
cyber security international standards in Brazilian critical infrastructure. Moreover, the
respective operational risks of these energy utilities are reduced with the above stated
variable.
The second important dimension is the relation with few stakeholders of smart grid in
the governance of cyber security and it refers to the fact that there should be certain
relationship of cyber security energy infrastructure prevailing within energy utilities and
government. The issue of cyber security should be eventually extended and when the threats
are being responded and any type of vulnerability is found, these energy utilities ensure that
the data could be correctly and efficiently shared for reducing risks and threats of
stakeholders and even improving network resilience (Bromiley et al. 2015). Another
significant dimension includes rising standards of transparency according to the few
principles of corporate governance for properly managing cyber security in smart grid, which
refers to the fact that access to information for cyber security should be relevant and precise
and the stakeholders of Brazilian energy utilities should know about this information.

6
ARTICLE REVIEW AND CASE STUDY SYNTHESIS
An importance of continuously practicing periodic security audits being eventually
carried out by the independent auditors for better enhancement of operational performances.
Another effective and important dimension that is to be considered is the equitable treatments
of shareholders for better management of the operational cyber risks. The entire governance
system of Brazil does not ensure a maintenance of constant interactions to enhance the
operational performances of organizations within energy sector (Olson and Wu 2015). A
major analysis substantially refers to every dimension of cyber security management of the
smart grids within energy companies. It is extremely important to integrate the strategies of
cyber security with any other strategy like smart grid. The respective planning for continuing
the services in cyber security incidents are required to be considered under every
circumstance.
The operational risks could be reduced after managing them in an effective manner
such as monitoring the cyber environment, observing operational risks and even observing
the risks associated to vulnerabilities and invasions in the electric systems. The cyber security
risk management is required to be considered under every aspect and it might end up
interrupting as well as destroying the critical cyber assets for the establishment of every
strategy.
5. Critical Reviewing of the cyber-security model on how well it gets fits to the
organization and recommendations for better improvement
There are six portions of the theoretical methodological model of cyber security used
in this article. The first part comprises of stakeholders, in which there exists utilities,
technology providers, researchers, consumers and policy makers (Grace et al. 2015). It
ensures that better efficiency is being observed without much complexity and should be
maintained effectively. The cyber security governance includes rights of the stakeholders,

7
ARTICLE REVIEW AND CASE STUDY SYNTHESIS
executive board, relationship with stakeholders, legal and regulatory basis and disclosure and
transparency. This cyber security management includes human resource management, asset
management, risks management as well as strategic cyber security planning.
The smart grids portion of the theoretical methodological model includes operational
efficiency and reliability. It is extremely important and significant to ensure the entire smart
grid is reliable and have high efficiency. The critical infrastructure for energy eventually
consists of few critical assets or resources and even critical information and the cyber
environment comprises interconnection, vulnerabilities, operational risks, uncertainties, cyber
assets and even confidential information. It is recommended to use precautions in the cyber
security framework for ensuring that no risk or threat could enter into the environment and
bring out destruction of the information.

8
ARTICLE REVIEW AND CASE STUDY SYNTHESIS
Part B: Case Study Synthesis
1. Recommendation of a strategic ERM framework for the company on the basis of
models for emphasizing on cyber security risk management features
A strategic ERM provides a specific framework for better management of the risks
that includes identification of several events that are relevant to the organizational objectives,
assessment of these risks for impacts and even determination of a response strategy. The
entire process is being monitored effectively so that all types of risks are being analysed
without much complexity (Mikes and Kaplan 2014). The model of this ERM is one of the
most recommended and standardized framework, which any organization can use for
development, revising as well as reviewing the various risks and threats related to enterprise
growth. The utilization of this ERM risk management technique is highly recommended for
the company since it emphasizes on several features of cyber security risk management.
There are few distinctive actions for asset management dimension, which include
monitoring the vital cyber assets of the electrical systems of Brazilian energy utility like
power-system automation asset. The second action is controlling the permission and even
logical and physical access to the operational technologies and IT assets (Farrell and
Gallagher 2015). A uniform process is being maintained in the ERM framework for
successfully evaluating risks and opportunities, assessment of the relative expenses and
benefits of risks or opportunities, successful identification of external control mechanisms,
which address the risks and opportunities and finally determination of what controls are being
required for addressing the issues.
2. Explanation of the specific framework and discussion of any strength and weakness
and process to overcome the weaknesses

9
ARTICLE REVIEW AND CASE STUDY SYNTHESIS
For ensuring operational efficiency and reliability of the ERM framework, the
respective energy utilities eventually performed a proper optimization of operations and
resources within the respective network towards better cyber-security, development and
incorporation of real-time, automatic as well as interactive technologies substantially aimed
at energy generation (Cavelty 2014). This is being done by utilizing peak shaving
technologies and even energy storage. The cyber environment is being conceived as the
major collection of ICT infrastructures of a company like telecommunication networks,
personal devices, controllers, processors and embedded sensors. Integrity, quality and
transparency are being included while releasing information as well as improvising
compliance with the help of legislation (Farrell and Gallagher 2015). Moreover, effectiveness
and efficiency of supervision and regulatory agencies is being observed for monitoring each
and every activity.
The advantages of ERM framework involve focusing on the organizational resources
for successful management of the risks. Competitive opportunities and strategic advantages
for undertaking extra risks are one of the most significant strengths in this framework. This
type of framework would help to create a strategic plan for addressing them. The weakness of
this framework includes high costs, while implementing the framework (Craigen, Diakun-
Thibault and Purse 2014). Without proper investment, it becomes extremely difficult in
achievement of strategic objectives. This particular issue could be resolved by proper
planning. An effective planning ensures that the valuable assets of a company are safe and
secured by lowering of the costs.

10
ARTICLE REVIEW AND CASE STUDY SYNTHESIS
References
Abawajy, J., 2014. User preference of cyber security awareness delivery methods. Behaviour
& Information Technology, 33(3), pp.237-248.
Ben-Asher, N. and Gonzalez, C., 2015. Effects of cyber security knowledge on attack
detection. Computers in Human Behavior, 48, pp.51-61.
Bromiley, P., McShane, M., Nair, A. and Rustambekov, E., 2015. Enterprise risk
management: Review, critique, and research directions. Long range planning, 48(4), pp.265-
276.
Buczak, A.L. and Guven, E., 2015. A survey of data mining and machine learning methods
for cyber security intrusion detection. IEEE Communications Surveys & Tutorials, 18(2),
pp.1153-1176.
Cavelty, M.D., 2014. Breaking the cyber-security dilemma: Aligning security needs and
removing vulnerabilities. Science and engineering ethics, 20(3), pp.701-715.
Cherdantseva, Y., Burnap, P., Blyth, A., Eden, P., Jones, K., Soulsby, H. and Stoddart, K.,
2016. A review of cyber security risk assessment methods for SCADA systems. Computers
& security, 56, pp.1-27.
Craigen, D., Diakun-Thibault, N. and Purse, R., 2014. Defining cybersecurity. Technology
Innovation Management Review, 4(10).
Elmaghraby, A.S. and Losavio, M.M., 2014. Cyber security challenges in Smart Cities:
Safety, security and privacy. Journal of advanced research, 5(4), pp.491-497.
Farrell, M. and Gallagher, R., 2015. The valuation implications of enterprise risk
management maturity. Journal of Risk and Insurance, 82(3), pp.625-657.

11
ARTICLE REVIEW AND CASE STUDY SYNTHESIS
Grace, M.F., Leverty, J.T., Phillips, R.D. and Shimpi, P., 2015. The value of investing in
enterprise risk management. Journal of Risk and Insurance, 82(2), pp.289-316.
Knowles, W., Prince, D., Hutchison, D., Disso, J.F.P. and Jones, K., 2015. A survey of cyber
security management in industrial control systems. International journal of critical
infrastructure protection, 9, pp.52-80.
Lam, J., 2014. Enterprise risk management: from incentives to controls. John Wiley & Sons.
Mikes, A. and Kaplan, R.S., 2014, October. Towards a contingency theory of enterprise risk
management. AAA.
Olson, D.L. and Wu, D.D., 2015. Enterprise risk management (Vol. 3). World Scientific
Publishing Company.
Pardini, D.J., Heinisch, A.M.C. and Parreiras, F.S., 2017. Cyber security governance and
management for smart grids in brazilian energy utilities. JISTEM-Journal of Information
Systems and Technology Management, 14(3), pp.385-400.
Wells, L.J., Camelio, J.A., Williams, C.B. and White, J., 2014. Cyber-physical security
challenges in manufacturing systems. Manufacturing Letters, 2(2), pp.74-77.