The development of a smarter electric grid will depend on increased deployments of information and communication technology (ICT) to support novel communication and control functions. Unfortunately, this additional dependency also expands the risk from cyber attacks. Designing systems with adequate cyber security depends heavily on the availability of representative environments, such as testbeds, where current issues and future ideas can be evaluated. This paper provides an overview of a smart grid security testbed, including the set of control, communication, and physical system components required to provide an accurate cyber-physical environment. It then identifies various testbed research applications and also identifies how various components support these applications. The PowerCyber testbed at Iowa State University is then introduced, including the architecture, applications, and novel capabilities, such as virtualization, Real Time Digital Simulators (RTDS), and ISEAGE WAN emulation. Finally, several attack scenarios are evaluated using the testbed to explore cyber-physical impacts. In particular, availability and integrity attacks are demonstrated with both isolated and coordinated approaches, these attacks are then evaluated based on the physical system's voltage and rotor angle stability.

Cyber-Physical Security Testbeds: Architecture, Application, and Evaluation for Smart Grid

Disruption of electric power operations can be catastrophic on national security and the economy. Due to the complexity of widely dispersed assets and the interdependences among computer, communication, and power infrastructures, the requirement to meet security and quality compliance on operations is a challenging issue. In recent years, the North American Electric Reliability Corporation (NERC) established a cybersecurity standard that requires utilities' compliance on cybersecurity of control systems. This standard identifies several cyber-related vulnerabilities that exist in control systems and recommends several remedial actions (e.g., best practices). In this paper, a comprehensive survey on cybersecurity of critical infrastructures is reported. A supervisory control and data acquisition security framework with the following four major components is proposed: (1) real-time monitoring; (2) anomaly detection; (3) impact analysis; and (4) mitigation strategies. In addition, an attack-tree-based methodology for impact analysis is developed. The attack-tree formulation based on power system control networks is used to evaluate system-, scenario -, and leaf-level vulnerabilities by identifying the system's adversary objectives. The leaf vulnerability is fundamental to the methodology that involves port auditing or password strength evaluation. The measure of vulnerabilities in the power system control framework is determined based on existing cybersecurity conditions, and then, the vulnerability indices are evaluated.

/pdf/cybersecurity-for-critical-infrastructures-attack-and-b43elyfw9t.pdf

Cybersecurity for Critical Infrastructures: Attack and Defense Modeling

A survey of approaches combining safety and security for industrial control systems

Cyber intrusions to substations of a power grid are a source of vulnerability since most substations are unmanned and with limited protection of the physical security. In the worst case, simultaneous intrusions into multiple substations can lead to severe cascading events, causing catastrophic power outages. In this paper, an integrated Anomaly Detection System (ADS) is proposed which contains host- and network-based anomaly detection systems for the substations, and simultaneous anomaly detection for multiple substations. Potential scenarios of simultaneous intrusions into the substations have been simulated using a substation automation testbed. The host-based anomaly detection considers temporal anomalies in the substation facilities, e.g., user-interfaces, Intelligent Electronic Devices (IEDs) and circuit breakers. The malicious behaviors of substation automation based on multicast messages, e.g., Generic Object Oriented Substation Event (GOOSE) and Sampled Measured Value (SMV), are incorporated in the proposed network-based anomaly detection. The proposed simultaneous intrusion detection method is able to identify the same type of attacks at multiple substations and their locations. The result is a new integrated tool for detection and mitigation of cyber intrusions at a single substation or multiple substations of a power grid.

Integrated Anomaly Detection for Cyber Security of the Substations

This paper investigates cyber attacks on ICS which rely on IEC 60870-5-104 for telecontrol communications. The main focus of the paper is on man-in-the-middle attacks, covering modification and injection of commands, it also details capture and replay attacks. An initial set of attacks are preformed on a local software simulated laboratory. Final experiments and validation of a man-in-the-middle attack are performed in a comprehensive testbed environment in conjunction with an electricity distribution operator.

Towards Understanding Man-In-The-Middle Attacks on IEC 60870-5-104 SCADA Networks

In this paper we present the CRUTIAL approach to model and quantify (inter)dependencies between the Electrical Infrastructure (EI) and the Information Infrastructures (II) that implements the EI control and monitoring system The quantification is achieved through the integration of two models: one that concentrates more on the structure of the power grid and its physical quantities and one that concentrates on the behaviour of the control system supported by the II The modelling approach is exemplified on a scenario whose goal is to study the effects of a II partial failure (a denial of service attack that compromises the communication network) on the remote control of the EI

/pdf/quantification-of-dependencies-in-electrical-and-information-u31eke8onm.pdf

Quantification of dependencies in electrical and information infrastructures: The CRUTIAL approach

The paper presents a set of control system scenarios implemented in two testbeds developed in the context of the European Project CRUTIAL - CRitical UTility InfrastructurAL Resilience. The selected scenarios refer to power control systems encompassing information and communication security of SCADA systems for grid teleoperation, impact of attacks on inter-operator communications in power emergency conditions, impact of intentional faults on the secondary and tertiary control in power grids with distributed generators. Two testbeds have been developed for assessing the effect of the attacks and prototyping resilient architectures.

Testbeds for Assessing Critical Scenarios in Power Control Systems

In order to evaluate the resiliency of architectures supporting teleoperation functions, a laboratory testbed, described in the paper, is being developed by CESI RICERCA in the context of the European Project CRUTIAL. The testbed implements a prototypal but significant power system control architecture with its integrated ICT infrastructure.

/pdf/a-laboratory-testbed-for-the-evaluation-of-cyber-attacks-to-37l510ndom.pdf

A laboratory testbed for the evaluation of cyber attacks to interacting ICT infrastructures of power grid operators

The objective of the chapter is to present the role of cyber security experiments within a methodological approach for the evaluation of cyber risks in grid control systems. As a starting point, a cyber-power risk index has been defined to support the identification of relevant risk factors across network attack models. Instances of attack models have been then experimented on an ICT architecture implementing grid operation scenarios with the double aim of evaluating the attacks’ effects by means of communication performance measures and of tuning the configuration of security mechanisms. The chapter discusses the results of a variety of attack experiments and their role in the calculation of the risk index.

Cyber Risks in Energy Grid ICT Infrastructures

The paper presents results obtained experimenting Denial of Service cyber attacks to the communications involved the power grid operations. Attack processes are simulated and deployed in a laboratory testbed and their impact is evaluated by observing the application behavior during ordinary maintenance and operation activities, as well as during the execution of highly critical defense actions.

/pdf/assessment-of-power-control-systems-communications-through-2l54vzjxbp.pdf

Fabrizio Garrone

Papers

Quantification of dependencies in electrical and information infrastructures: The CRUTIAL approach

Testbeds for Assessing Critical Scenarios in Power Control Systems

A laboratory testbed for the evaluation of cyber attacks to interacting ICT infrastructures of power grid operators

Cyber Risks in Energy Grid ICT Infrastructures

Assessment of power control systems communications through testbed experiments