Slides from a panel presentation at Schweitzer Engineering Laboratories’ Modern Solutions Power Systems Conference. The panel titled ‘ Inherently Safe Cyber‘ was moderated by Dr. Ryan Bradetich, SEL’s VP of Automation and Communication R&D. After possing a hypothetical scenario, each panelist was asked to give a 15-minute presentation outlining their approach followed by some Q/A. About Panel: Cyber needs a fundamental change to realize a future where our communications networks and information systems are inherently safe. Can we take advantage of operational technology applications to solve the problem for the power industry? By posing a hypothetical solution, the panel will discuss engineering a cybersecure power system network. For thoughts and comments for the presentation and the panel see: http://www.nathanswallace.org/blog/sel-2018-modern-power-system-solutions-conference/

2. @NathanSWallace www.nathanswallace.org
Nathan Wallace, PhD
@NathanSWallace
n.wallace.us@ieee.org
06/07/2018
Dir. Cyber Engineering Staff Engineer

3. @NathanSWallace www.nathanswallace.org
Disclaimer
• Statements and opinions are my own which may or may not reflect that of
my current employer.
• Statements are based on generalized observations of the industry and do
not represent any particular entity or asset owner.

4. @NathanSWallace www.nathanswallace.org
Volunteering:
EE Intern EE Intern Associate Engineer
Co-Founder, Dir. Cyber Engineering
Drafting Relay Settings
T&D Protection
Research Associate
ICS Cybersecurity Researcher
Digital Forensics Examiner
Staff Engineer
Relay & RTU
Design, Setting, & Commissioning
Risk Assessments,
Security Design & Integration
• Electrical Power System Cyber Device Function Numbers, Acronyms, and Designations
• Guide for Testing and Commissioning Power System Cybersecurity Controls
• IoT for connected home – Communication and Cybersecurity Requirements for Connecting
Home to Utility
• Std. C37.240 Cyber Security Requirements for Power System Automation, Protection and
Control Systems
Industry Standards & Guides
Personal Background

5. @NathanSWallace www.nathanswallace.org
Inherently Safe Cyber-secure
Power System Environments
• Inherent => Built-in, included, integrated, … it has been engineered.
• Safe => Power System Cybersecurity is a SAFETY Issue
Baked-in vs Bolted-on. Requires little to no human interaction.
Ex: Aurora Generator Test
Ex: DERs

6. @NathanSWallace www.nathanswallace.org
Key Takeaways from
Protection and Control Engineering
Security: “The facet of reliability that relates to the degree of certainty that a
relay or relay system will not operate incorrectly.” cyber device or
Northeast
Outage 2003
Arizona
Outage 2007
FPL
Outage 2008
Ukraine
Attack 2016
Load Lost 61,800 MW 400 MW 4,300 MW 230,000 Customers
Intent Unintentional Unintentional Unintentional Intentional
Cyber Yes Yes Yes Yes
Are all grid cyber-events malicious and intentional?

7. @NathanSWallace www.nathanswallace.org
Taxonomy of
Power Grid Cyber-Events
Malicious
Unintentional
95% - 99% Known
1 2
3
4
5
n
…
nth update
at Sub 1
nth update
at Sub N
Path B
Industry Technical
Standards &
Best Practices
Energized
Path A
Review
Design
Proactive or Reactive

8. @NathanSWallace www.nathanswallace.org
Cyber Infrastructure
(Computation & Communication)
Physical Infrastructure
(Flow of Power)
Inputs: Currents, Voltages, Impedance,
Status (open, close, lockout)
Output: Open/Close Bkr, +/- Vars,
Inputs: Topology, traffic flows,
deep packet inspection, communication state,
state of physical power system
Output: For the most part
NOTHING!
Key Takeaways from
Protection and Control Engineering
Protection and Control
of the Modernized Grid

9. @NathanSWallace www.nathanswallace.org
Cyber Infrastructure
(Computation & Communication)
Protection and Control
of the Modernized Grid
Physical Infrastructure
(Flow of Power)
Identify
Detect
Respond
Recover
Protect
Tasks
NIST. Framework for Improving Critical Infrastructure Cybersecurity, V1, 2014
-Cyber Assets, Zones
-Controls, Firewalls, data-diodes,
IED setting configuration
-Controls, Relays, RTUs, EMS,
IED setting configuration
-Loads, transformers, Zones
-IEDs, Relays, RTUs, SCADA,
Firewalls, IDS, SIEMs
-Relay Protection Logic,
Primary & Back-up, SCADA
-Isolate fault, reclose,
lockout, open, close, SOE
-open, close,
+/- Vars, Improvements
-Remove access, drop packets,
SoE, ICS Digital forensics
-Backups, Replace,
Improvements

10. @NathanSWallace www.nathanswallace.org
Filled box method
(IEEE Std PC37.2)
Key Takeaways from
Protection and Control Engineering
• Operational One-Line
Cyber Infrastructure
(Computation & Communication)
Physical Infrastructure
(Flow of Power)
Documenting Protection & Control
• A Firewall in a ‘Communications One-Line’
PSCC WG S7 - Electrical Power System Cyber Device
Function Numbers, Acronyms, and Designations
c50 – Role based access control
c51 – Report cyber events to master
c52 – Cyber-event concentrator (RTU)
c53 – Cyber-event converter, (DNP -> Syslog)
c54 – Log cyber-events locally
c56 - Antivirus
c57 – Enable host firewall
c58 – Intrusion detection
c59 – Intrusion prevention
c60 – Web access
c61 – Email alerts

11. @NathanSWallace www.nathanswallace.org
Key Takeaways from
Protection and Control Engineering
PSCC WG S8 – Guide for Testing
Power System Cybersecurity Controls
Cyber Infrastructure
(Computation & Communication)
Physical Infrastructure
(Flow of Power)
Testing & Commissioning
Protection & Control
IEEE Std C37.233-2009 “Guide for
Power System Protection Testing”
• Testing Logic
• End-to-End Binary/Analogs
Other than communication checks
NOTHING!
• 1st NERC-CIP audit of asset owner in TN revealed
over half of the firewalls were misconfigured.
• Another asset owner had multiple cyber related
alarms enabled in the IEDs, but they were not
being monitored.
Inject
PT/CT
Signals
Trip?
IEDn

12. @NathanSWallace www.nathanswallace.org
Safety Reliability
Thank You!
Nathan Wallace
@NathanSWallace
n.wallace.us@ieee.org
Dir. Cyber Engineering Staff Engineer