The digital twin of the SCADA system network: a threat model and risk-oriented cyber defense at oil and gas facilities

The article discusses the application of a digital twin of a SCADA system network at facilities of the oil and gas industry for building a threat model and selecting risk-oriented cyber protection measures. A digital twin is understood as a virtual representation of the topology of an industrial network, assets (servers, controllers, workstations), technological links and data flows, updated based on configurations, logs and telemetry. A methodology is proposed that includes asset inventory, allocation of zones and channels, description of threats and vulnerabilities, creation of cyber incident scenarios, and assessment of risk based on probability and consequences for production, ecology, and security. In the twin environment, secure simulation of communication failures, data substitution, and unauthorized operator actions is performed to test resilience and detectability. Based on the results, the prioritization of countermeasures is justified: segmentation, remote access control, least privilege principle, anomaly monitoring, and management of updated.