Cybersecurity for Smart Grids: Vulnerabilities and Strategies to Provide Cybersecurity
2 likes2,231 views
The document discusses the vulnerabilities and cybersecurity strategies for smart grids, emphasizing the increasing risks associated with cyber attacks due to greater digital integration. It highlights the economic impacts and the importance of coordinated efforts between governments and utilities to enhance cybersecurity. The conclusions stress the need for ongoing adaptation to evolving cyber threats and the establishment of effective cyber risk management strategies globally.
Cybersecurity for Smart Grids: Vulnerabilities and Strategies to Provide Cybersecurity
- 1. Cybersecurity for Smart Grids: Vulnerabilities, and Strategies to Provide Cybersecurity Cyril W. Draffin, Jr. Project Advisor, Massachusetts Institute of Technology Energy Initiative Scott Aaronson Executive Director, Security and Business Continuity, Edison Electric Institute International Energy Agency’s International Smart Grid Action Network (ISGAN) Academy – 1st Cybersecurity Webinar 28 June 2017 1
- 2. Topics for Cybersecurity for Smart Grids Webinar #1: Vulnerabilities, and Strategies to Provide Cybersecurity 1. Objectives 2. Cyber Threats and Vulnerabilities (and Cyber Attacks) 3. Smart Grid Trends 4. Privacy and Data Issues 5. US/European/International Organizations Addressing Cybersecurity 6. Cybersecurity Strategies 7. Conclusions 2
- 3. Cybersecurity Attacks can Come in Many Ways • Loss of grid control from errors or deliberate tampering with data, complex algorithms, or communications – Cascading Failure Modes – Extended problems with electric grids crossing national borders – Attack via dispersed Distributed Energy Resources (e.g. solar, wind, storage) with insufficient cybersecurity • False data injection into pricing and demand systems – Market manipulation • Possible attack on electric utility systems from sophisticated nation states – Requiring attribution 3 Cyber Threats
- 4. Critical Infrastructure Threat Landscape 4 Source: The Chertoff Group Cyber Threats
- 5. Cybersecurity of the Electric Grid: Context • Cyber incidents are growing in number and sophistication-- and pose serious risks to the electricity grid • Some integration of the grid with information and communications technology reduces risks associated with electricity blackouts-- but as country’s grids become more automated and utilize more digital technology, the attack surface grows and the grid becomes increasingly vulnerable to disruption • Deepening interdependencies between electricity and other critical infrastructures (telecommunications, internet, natural gas supply) • Society’s increasing dependence on electricity raises the economic and social consequences of long duration power outages • Protecting the grid and mitigating consequences of an attack is public order issue, and national security imperative Cyber Vulnerabilities 5
- 6. Smart Grid Cybersecurity: Potential Vulnerabilities in Digital Technologies Location of Cybersecurity Vulnerabilities Smart Grid (more complex digitally interconnected grid & active management) Electricity Generators • More external monitoring and dispatching, and Distributed Energy Resources (e.g. Solar and Wind) X Electrical/Grid Control Systems (transmission & distribution) • More digital interfaces, sophisticated SCADA, load balancing, voltage frequency control, monitoring X Smart Meters • More digital connections and customer interfaces X Pricing, Bidding, and Billing Systems • More active generator and customer interfaces & customer privacy issues (including complexity with time of day pricing, and Software as a Service) X Cyber Vulnerabilities 6
- 7. Cost of Cyber Attacks Can Be Large • Economic impact to the economy – Lloyd’s estimates widespread cyber attack on US grid would have $243 billion economic impact (July 2015 Business Blackout report) • Insurance liability – Lloyd’s estimates widespread cyber attack on US grid would have $21 billion in insurance claims under 30 lines of business (July 2015 Business Blackout report) • Loss of reputation and diminished credit of electric utility • Loss of revenue of the electric utility • Lawsuits against the electric utility and its suppliers 7 Cyber Vulnerabilities
- 8. Source: SANS ICS - ICS.SANS.ORG 225.000 7 x 110 KV SubStations 23 x 35 KV SubStations (up to 50) 100s Damaged 3.5 to 7 hours Outage Duration 3 DSOs affected 135 MW Impact 10s Field Devices Affected 103 Cities and Towns Affected Outside Temp. Between 4 and -8° Cent. Case Study: Ukraine Attack Cyber Attacks 8 • Details on December 2016 Ukraine Attack presented in WIRED magazine, July 2017, “How to Switch a Country Off”. • Details on December 2015 attack presented in Electricity-ISAC and SANS Industrial Control Systems. 2016. “Analysis of the Cyber Attack on the Ukrainian Power Grid.” Electricity-Information Sharing and Analysis Center. ics.sans.org/media/E-ISAC_SANS_Ukraine_DUC_5.pdf.
- 9. Multi-hour Distruption of multiple major websites Case Study: Internet of Things (IOT) Attack Cyber Attacks Against Dyn, a company that services many popular web sites 9 The attack surpassed 1.2 Tbps (terabits per second) Over 100,000 malicious endpoints launched attacks Thousands of businesses affected including: CNN, Twitter, Netflix, Github, Paypal, Yelp
- 10. WannaCry • Ransomware • Automated Worm Functionality • Over 230,000 computers in over 150 countries impacted • Parts of Britain's National Health Service (NHS) • Spain's Telefónica • FedEx and Deutsche Bahn • Impact on Renault manufacturing facilities Cyber Attacks 10 Note: In June 2017 NotPetya attack made on Ukrainian and global organizations
- 11. CRASHOVERRIDE • Virus developed to disrupt industrial control systems • Could attack electricity substations and circuit breakers, using industrial communication protocols which are standardized across a number of critical infrastructures 11 Cyber Attacks
- 12. Many Visions of the “Smart Grid” 12 Source: United States National Institute of Standards and Technology Source: Electric Power Research Institute Source: Nature Source: United States Department of Energy Smart Grid Trends
- 13. Data Exchange Is Increasingly Complex 13 • More data exchange and communications more vulnerability • Different types and generations of components must be interoperable. • Decisions to standardize on protocols are complex, require input from a wide range of stakeholders. Smart Grid Trends
- 14. 14 Active Management can Increase Cyber Risk Source: Covrig et al. (2014), Elberg & Lockhart (2014), Kellison (2012), Ritch (2013), and SCE (2011) New Technologies & Systems SynchroPhasers Supervisory Control And Data Acquisition Energy Management System / Distribution Management System / Outage Management System / Asset Management System Examples for Discussion Smart Grid Trends
- 15. Considerations in addressing Smart Grid Trends • Utilities need to be prepared to operate in a more complex environment where they have less control – Highly automated demand and control systems with distributed decisions and reliance on “always available” communications – Effective monitoring and understanding of baseline “within band” operations is important to detect anomalous activity – Vulnerabilities at interfaces when new technologies are added (especially if done with insufficient security design and testing) – Need to use cyber “best practices” and prepare for future innovation – Possible reliance on monitoring and control information in the cloud (as players and grid interfaces increase) 15 Smart Grid Trends
- 16. Privacy and Data Issues • Customer Privacy, Data Integrity, and Data Protection are important concerns – Grid operational data – Consumer electric usage data • Systems to protect privacy must satisfy customers and their governments – Many laws protect the privacy of personal information – European law fully protects customers from usage of personal information – Need for coordination, because company and customer data frequently cross state and country lines 16 Privacy and Data Note two documents that deal with privacy and data issues are: • Center for Internet Security (CIS) Privacy Implications Guide issued January 12, 2017 with CIS Controls (Version 6) • The European General Data Protection Regulation (GDPR) that will become effective on 25 May 2018.
- 17. 17 Approach to Grid Security Standards Physical Cyber Industry- Government Partnership Electricity Subsector Coordinating Council (ESCC) Electricity Information Sharing & Analysis Center (E-ISAC) Partnerships with federal, state, & local governments Incident Response Grid Resiliency Mutual Assistance Spare Equipment Programs Strategies
- 18. Regulatory and Coordination Organizations and Standards Federal Energy Regulatory Commission (FERC) and North American Electric Reliability Corporation (NERC) Cyber Security of the Smart Grids Expert Group on the Security and Resilience of Communication Networks and Information Systems for Smart Grids Europe Electricity Information Sharing and Analysis Center security services to owner and operator organizations of Bulk Power System across North America US Department of Homeland Security (DHS) Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) Electricity Sector Cybersecurity Capability Maturity Model (DOE/DHS) European Commission Joint Research Centre cybersecurity research European Network and Information Security Agency 18 NIST Framework and Roadmap for Smart Grid Interoperability Standards, Release 3.0 National Association of Regulatory Utility Commissioners CIGRE, the International Council on Large Electric Systems International Electrotechnical Commission IEC 62443 Standard Organizations United States Electricity Subsector Coordinating Council International
- 19. Ongoing United States Federal Efforts: Examples • Standards: In July 2016, FERC directed NERC to develop a new or modified CIP Reliability Standard to address supply chain cybersecurity risks in bulk electric system operations • Information sharing: In 2016, DHS launched the Automated Indicator Sharing (AIS) program to enhance information sharing practices across government and private sectors-- This capability facilitates the exchange of cyber threat indicators between the Federal government and parties that opt in to the program through machine to machine sharing • Exercises: In 2011, 2014, 2016 (GridEx IV planned for 2017), NERC has conducted sector-wide grid security exercises, called GridEx, to execute the electricity sector’s crisis response to simulated coordinated cybersecurity and physical security incidents • Tools: DOE developed the Electricity Subsector Cybersecurity Capability Maturity Model (C2M2) to help energy sector owners and operators evaluate, prioritize, and improve their cybersecurity capabilities and allow for a better overall assessment of the cybersecurity posture of the energy sector. • Research & Development: DOE designed the Cybersecurity for Energy Delivery Systems (CEDS) program to assist the energy sector asset owners by developing cybersecurity solutions for energy delivery systems through integrated planning and a focused R&D effort 19 Organizations
- 20. European Reports: Recent Examples • European Union – Cyber Security in the Energy Sector (February 2017) – https://ec.europa.eu/energy/sites/ener/files/documents/eecsp_report_final.pdf • European Commission's Energy Expert Cyber Security Platform (EECSP) Expert Group Report (February 2017) – Protection concepts reflecting current threats and risks – Effects of cyber attacks not fully considered in the design rules of an existing power grid – Handling of cyber attacks within the European Union – Constraints imposed by cybersecurity measures in contrast to real- time/availability requirements • European Directive on security of network and information systems (NIS Directive) (adopted July 2016) 20 Organizations
- 21. Strategies to address Cyber Vulnerabilities • Risk management, include risk analysis and prioritization, to understand vulnerabilities within and across critical infrastructure systems (and to select proper standards and strategies) • Information sharing to enhance situational awareness and mitigation practices across government and industry. • Standards to set a minimum level of security practices across the electricity infrastructure. • Cost-recovery for security investments to ensure adequate resources are available to address threats and vulnerabilities. • Workforce education and training to increase the talent pool of security experts that can address the complexities of electric grid systems and the evolving cyber risk landscape. Strategies 21
- 22. Risk Management: Types of Cyber Activities Required 22 • Complexity, continuous evolution preclude perfect protection from cyberattacks. • More emphasis is needed on developing and deploying response and recovery strategies and procedures Assess vulnerabilities, threats, impacts Reduce vulnerabilities, threats, impacts Prevent attacks, incidents, other outages Respond during attack Recover and restored Strategies Note: Center for Internet Security CIS Controls (Version 6) provides prioritized set of actions to protect organizations and data from known cyber attack vectors.
- 23. Address Cyber Penetrations and prepare for Cyber Incidents (including Information Sharing) • Unfortunately there is not a "magic bullet" that stops all cybersecurity attacks, or stops Smart Grids or Distributed Energy Resources from introducing cyber vulnerabilities • Electric utilities and governments need to share current cyber threat information – Confidential sharing valuable for risk mitigation and responding quickly to changing threats – North American Electric Reliability Council (NERC) 2015 GridEx III emergency response exercise with utilities, law enforcement and government; 4400 people involved (March 2016 report) – United States - Computer Emergency Readiness Team; Electricity – Information Sharing & Analysis Center – Europe Computer Security Incident Response Teams; CERT-EU; European Energy- ISAC; ENSIA product security certification 23 Strategies
- 24. Cyber Security and Resilience (including Standards) • Follow and Improve Cyber Security Regulations and Best Practices – Provide regulatory standards for distribution systems and DERs as generation becomes more widespread – national cyber standards may become role of US Department of Energy – Support European efforts to quickly share detailed electric utility cyber attack, mitigation, and recovery information – Develop cost allocation methods for cyber security and resiliency among multiple parts (transmission, distribution) of the electric utility system • Develop utility specific, regional and national detailed plans for recovering from cyber attack – Conduct emergency response exercises such as GridEx and Cyber Europe (2014 and 2016) 23 Strategies
- 25. How much Cybersecurity effort and expenditures are sufficient to assure smart grids are secure enough? • Challenge: Need to understanding of range of costs for cyber security and resiliency, who pays costs, and value received – Bulk Energy System regulated in United States by Federal Energy Regulatory Commission and NERC with defined cyber security standards– but limited in scope • US Critical Infrastructure Protection (CIP) Standards (9 subject to current enforcement: 8 cyber, 1 physical; and 17 subject to future enforcement) • European Commission Network and Information Security Directive • Cost recovery for cybersecurity operating costs is issue – Distribution Systems usually do not have required cyber security standards, so harder to determine amount of cyber protection to provide and how to pay for it • Some general cyber security guidelines exist (e.g. US NIST cybersecurity framework) • US States (e.g. California, New York, Hawaii) may address issue • US National Association of Regulatory Utility Commissioners (NARUC) provided cyber security questions regulatory bodies should ask (2016/2017) • Suppliers more interested in producing power and meeting safety regulations – Corporate Business Systems for more diverse utilities over the next decade – Cyber Recovery Costs responsibility is unclear (utility, vendors, insurance, government) 25 Strategies
- 26. Conclusions • Cybersecurity Threats and Grid Vulnerabilities will continue to evolve for many decades • Because of importance of the Grid to industrial economies, cyber risks must be addressed by entire worldwide electric power industry • Although Smart Grids may be able to detect anomalies sooner, increased digitization and interfaces increase cyber risks • Data integrity and protection are needed • United States and European organizations have established some cybersecurity standards and working groups-- including information sharing organizations • Cyber Risk Management strategies are needed throughout the world-- and many have been adopted by utilities in the US and Europe 26 Conclusions
- 27. Questions & Comments Contacts: Cyril Draffin Email: draffin@alum.mit.edu Scott Aronson Email: saaronson@eei.org Cyril W. Draffin MIT Energy Initiative, E19-307 77 Massachusetts Avenue Cambridge, Massachusetts, 02139-4307 USA Scott Aaronson Edison Electric Institute 701 Pennsylvania Avenue, NW Washington, DC , 20004-2696 USA ISGAN Academy coordination: Institute for Research in Technology Comillas Pontifical University Santa Cruz de Marcenado 26 28015 Madrid, Spain International Energy Agency’s (IEA) International Smart Grid Action Network (ISGAN) Academy – 1st Cybersecurity Webinar Cybersecurity for Smart Grids: Vulnerabilities, and Strategies to Provide Cybersecurity 26
- 28. Topics for Cybersecurity Smart Grids Webinar #2: Technical Approaches to Provide Cybersecurity 2nd Cybersecurity Webinar Planned for September 2017 1. Objectives 2. Cybersecurity Approach and Best Practices 3. Case Studies 4. Regulatory and legal constraints of architecting smart grids in a secure way 5. Questions and Comments 28 Additional Information
- 29. ISGAN Academy series 29 Additional Information This recorded cybersecurity webinar and previous webinars are available at ISGAN Academy platform: http://www.leonardo-energy.org/resources/1070/isgan-academy-58ec8d2e7b9b0