This document discusses cyber security in the power sector. It begins with an overview of industrial control systems used for power systems and how they are susceptible to cyber attacks. It then discusses various cyber threats to power systems, how attackers could compromise systems, and strategies to effectively defend industrial control systems for power. These strategies include using industry best practices, secure design principles like zone and conduit architecture, secure interfaces with dual firewall DMZs, secure governance policies and compliance, and increasing security awareness. The document emphasizes that complete security is impossible and an optimized, cost-effective approach is needed.

1. Cyber Security in Power
Sector
P.K.Agarwal, Director and CISO
Power System Operation Corporation Ltd., pkagarwal@ieee.org
Date - 23-11-2018
1

2. Overview
Industrial Control
Systems (ICS):
Essential for Power
System, but
susceptible to cyber
attack.
01
Cyber Threats:
How power
systems can be
compromised by
cyber-attacks
02
Strategies to
effectively defend
Industrial Control
System i.e. Power
System
03
Best Practices and
other suggested
methods to ensure
power system
cyber security.
04
Date - 23-11-2018 2

3. Power System
Energy Surety and
Sustainability - key
drivers
ICS uses more and
more IT
Modern power
system ICS can not
be kept isolated
All power systems
have Industrial
Control Systems
(ICS)
ICS are more
venerable to cyber
attack
But, are power
system ICS Secure?
Date - 23-11-2018 3

4. Power
System –
Industrial
Control
System
Distributed
Control
System
(DCS) and
Process
Control
Systems
(PCS):
A group of computers and/or smart field devices
networked together to monitor and control industrial
processes with direct feedback control.
Control systems operate in near real time and is used in
critical sectors such as Power Generation, Oil & Gas
Refining, Water Treatment, Chemical, etc.
May consist of BMI, PLC’s, stand alone power
electronics controllers, microgrid controllers, Substation
Automation systems,
Supervisory
Control and
Data
Acquisition
(SCADA)
system:
Normally applied to a systems connected to devices
over a larger area including multiple buildings or even
many miles away.
Operative word is Supervisory used in critical sectors
such as Electrical Transmission & Distribution, Oil & Gas
Pipelines, Water/Sewer, and Transportation.
Date - 23-11-2018 4

5. Critical Power System Infrastructure
Date - 23-11-2018 5

6. Power System - ICS Footprint
Generator Control Systems
SmartGrid Control and Automation Systems
Utility Monitoring and Control Systems
Supervisory Control and Data Acquisition (SCADA) Systems
Transmission and Distribution
Fuel management Systems
Power Quality and UPS Systems
Renewable Energy Control Systems
And More…….
Date - 23-11-2018 6

7. Cyber Threats
- Sources
National Governments
Terrorists
Industrial Spies and Organized Crime Groups
Hacktivists
Hackers
Note - We no longer have days after infection to respond,
current trends are minutes after infection to propagate!
Date - 23-11-2018 7

8. Cyber Threat
Actors
• Insiders
• Disgruntled employees
• Disgruntled contractor
• Active agencies
• Competitors
• Organized crime
• Others
Threats
Date - 23-11-2018 8

9. Increasing and
innovative
attacks on
Power
Date - 23-11-2018
• First attack on Ukraine Power System in
2014-15.
• Entry from IT system through an email
attachment.
• Switched off many feeder sub stations.
• Made recovery difficult by corrupting
SCADA, overloading customer services.
• Now first malware specially made for
electricity system is made.
• Probably made by same attacker group
responsible for Ukraine.
• It CRASHOVERIDE. Hacks multiple p
9

10. Seven Strategies to Effectively Defend Industrial Control Systems
Date - 23-11-2018 10

11. Use Industry
Best
Practices
Network security: Firewalls, DMZ implementations,
whitelisted connections, whitelisting applications, etc
Secure Internet services
Using systems that have gone through third part audits, such
as the INL process
Upgrading legacy ICS systems
Upgrading Operating systems and developing systems that
can be patched
Packet inspection (where possible)
Secure ICS Planning and design services
Third Party audits
Date - 23-11-2018 11

12. Secure by
Design –
Zone and
Conduit
Architecture
Date - 23-11-2018 12

13. Secure
Interface –
Dual Firewall
DMZ
Date - 23-11-2018 13

14. Secure by
multiple
control -
Date - 23-11-2018 14

15. Secure by
Governance –
Policies and
Compliance
Cyber Security Policy
Chief Information
Security Officer
• Independent
• Directly reporting to Head
• Preferably board member
Certification – Regular
audit and compliance
VAPT and compliance
Adoption of standard
framework
Security Control Center
Date - 23-11-2018 15

16. Secure by
Awareness –
Points to
Ponder
Date - 23-11-2018 16
There is nothing like absolute security
Every requirement is unique and every solution is unique.
Security comes at a cost – need optimization.
Secure real-time information is a key factor to reliable
delivery of power to the end-users.
Human element is the strongest link in cyber security but
may be the weakest due to lake of awareness
Security is every one responsibility rather than of CISO.
Develop a organizational cultural of being and keeping secure

17. Date - 23-11-2018 17