From turbine to toaster, the electrical grids are evolving. Increases in distributed generation, battery storage, advanced metering, and automation results in a growing dependency on computational and communication technology. With engineers and technicians historically focused only on the physical infrastructure, there is an increased need to bring that same focus and understanding to the grid’s supporting cyber infrastructure. By first examining the multitude of cyber threats, this talk explores the challenges, misconceptions, and barriers associated with protecting the modernized power grid.

1. Power System Cybersecurity
Threats, Challenges, and Barriers
Nathan Wallace, PhD, CSSA
Cybersecurity Research Engineer
05 Jan. 2017

2. Personal Background
Volunteering:
EE Intern EE Intern Associate Engineer Research Associate VisiHng Lecturer
Staff Engineer Cybersecurity Researcher

3. Overview
• Why
State of Affairs: Grid & Cyberspace
Cybersecurity => Safety
Misconcep.ons & Challenges
• What are we missing
Cyber aware devices and systems
80 – 95% of
the Grid’s
Cyber Assets
Fall Outside
NERC-CIP
80 – 90% of
the Grid’s
Cyber Assets
are Outside
NERC-CIP
Most Violated:
NERC-CIP
&
NERC-PRC

4. Security: “The facet of reliability that relates to the degree of certainty that a
relay or relay system will not operate incorrectly.” cyber device or
Na.on States
Hackers
Vendors
Inten.onal
Insider
Accident
Insider
Misconfigura.on
Cyber
Security
Cybersecurity = Physical + EMI + Digital[Compu.ng & Communica.ons]

5. Two Infrastructures
Residen.al Industrial Commercial
GeneraHon Transmission
DistribuHon
• Physical
• Cyber
Control Center
Distribu.on
Control Center
RTOs/ISO

7. 2016 Tech Expo: Virtual reality used to fix
a steam turbine that’s located hours away.

8. State of Affairs: The Grid
Monitoring Points Control Point
Markets OperaHons Service Provider
GeneraHon
Transmission DistribuHon
Customer

10. State of Affairs: The Grid
Communica.on
CYBER
Northeast
Outage 2003
Arizona
Outage 2007
FPL
Outage 2008
Ukraine
AXack 2016
Load Lost 61,800 MW 400 MW 4,300 MW 230,000 Customers
Intent Uninten.onal Uninten.onal Uninten.onal Inten.onal
Cyber
Caused
Yes Yes Yes Yes
Computa.onal

11. “Our expecta.ons is that the modernized electricity grid
will be 100 to 1000 .mes larger than the Internet”
– CISCO VP
Advanced
Metering
Electric
Vehicles
Distributed
Genera.on
Grid Moderniza.on
Distribu.on
Automa.on
State of Affairs: The Grid
‘Grid of Things’

12. State of Affairs Cyberspace
hmp://map.ipviking.com/
• Avg price per 0-Day:
• Avg number of days 0-day remains private:
• Avg number of days .ll patch is issued:
• Avg of newly created malware per day:
• Avg dwell .me .ll detec.on:
USD $40,000 - $160,000
151 days
300,000
205 days
120 days

13. State of Affairs Cyberspace & Cyberwar
“Global Cyber Weapon Market
Expected to Reach
USD 522 billion in 2021.”
- Global Newswire, 2015
Transparency Market Research Report

14. Cybersecurity => Safety
21 Lines of Code
Aurora Generator Test

15. Distribu.on
System Operator
Virtual
Power Plant
Cybersecurity => Safety

16. Common MisconcepHons
• We are not a target.
• Minimum security needed, we are low impact.
• We are not connected to the Internet.
Ipviking, Shodan, ICS-CERT, Foreign FTP servers
Ukraine, Changing Standards, State Regula.ons
Stuxnet, Repor.ng capacity to RTO, Firewalls
Challenges

17. MisconcepHon: We are not a target.
Ipviking,

18. MisconcepHon: We are not a target.
Ipviking, Shodan,

19. MisconcepHon: We are not a target.
Ipviking, Shodan, ICS-CERT,
0
50
100
150
200
250
300
350
2012 2013 2014 2015
Incidents

20. MisconcepHon: We are not a target.
Ipviking, Shodan, ICS-CERT,
• Passwords, electrical drawings, communica.on drawings (IP, Protocols), etc
• File servers contained malicious code
71 Genera.on Plants
~20,000 Files
Genera.on, Transmission,
Distribu.on Systems
“From New York to California”
Source: AP Inves.ga.on: US Power Grid Vulnerable to Foreign Hacks. Dec. 21, 2015
“Digital clues pointed to
foreign hackers.”
Seven file (FTP) servers
with no authoriza.on
FTP servers

21. MisconcepHon: Minimum security needed, we are low impact.
Ukraine,
30 Sta.ons De-energized
• 7 110 kV sta.ons
• 23 35 kV sta.ons
• ~3 to 6 hrs to re-energize
• 230,000 customers impacted
• Telephone denial of service
• Breached 6 months prior
• Altered firmware at substa.ons
“We were blinded”
Dec 23 2015
Control Center Operator
Source: E-ISAC. Analysis of the Cyber Amack on the Ukrainian Power Grid. March 18, 2016

22. MisconcepHon: Minimum security needed, we are low impact.
Ukraine, Changing Standards,
NERC
Physical
Security v3
Voluntary Mandatory
2000
Metcalf
Amack
Ukraine
2015
Dec
2013
Apr
Stuxnet
Discovered
2010
1st IEEE
Substa.on
Sec Standard
2002
Energy
Policy Act
2005
2005
NERC
updates
Asset ID
CIP-002 v4
2010
FERC
designates
NERC as ERO
2007
FERC
Approves
Asset ID
CIP-002 v4
2012 2015
NERC
Effec.ve
Asset ID
CIP-002 v5.1
2017
FERC to
Approve
NERC
CIP v7
‘Code moves faster than Policy’

23. MisconcepHon: Minimum security needed, we are low impact.
Ukraine, Changing Standards, State Regula.ons

24. MisconcepHon: We are not connected to the Internet.
Stuxnet,

25. MisconcepHon: We are not connected to the Internet.
Stuxnet, Repor.ng Capacity to RTO,

26. MisconcepHon: We are not connected to the Internet.
Stuxnet, Repor.ng Capacity to RTO, Firewall
Aug 13th 2016, accidental release of 0-day vulnerabili.es kept by a Govt. (Cisco,
Juniper, etc.)

27. Challenges No Longer Can
Set It and Forget It

28. Challenges
Cybersecurity: Who’s Responsibility is it?
IT Dept. OT Dept.
t
- So$ware to determine how power flows and when breakers open/closes
- Apache, Telnet, SSH, MySQL, FTP, LDAP, Embedded Linux, Windows, etc.
- Virtual Power Plants and protec.on relays, so$ware defined networking

29. Challenges Complexity and Age
Power Grid Space Sta.on
VS
TV Integrated Circuit
• Age is physical and
has visual indicators
• Age is an abstrac.on and
exists in so$ware

30. Challenges Vendor Confusion/Sales Pitches
Example 1: Install smart meter to ‘side-step cybersecurity requirements’
Issue: How are the values being used when received…
Example 2:
Issue: So$ware and protocols have a tendency to become
vulnerable over .me. (Poodle, Heartbleed, Shellshock, etc)

31. What are we missing

32. Exhibit 4.1.1 Strategies for Achieving Energy Delivery Systems Cybersecurity
Vision: By 2020, resilient energy delivery systems are designed, installed, operated, and
maintained to survive a cyber incident while sustaining cri.cal func.ons.
Strategies: Build Culture
of Security
Asses and
Monitor Risk
Protec.ve
Measures to
Reduce Risk
Manage
Incidents
Sustain
Security
Improvements
Near-term
(0–3 years)
By 2013
Mid-term
(4–7 years)
By 2017
Long-term
(8–10
years)
By 2020

33. Exhibit 4.1.1 Strategies for Achieving Energy Delivery Systems Cybersecurity
Vision: By 2020, resilient energy delivery systems are designed, installed, operated, and
maintained to survive a cyber incident while sustaining cri.cal func.ons.
Near-term
(0–3 years)
By 2013
3.1 Capabilities to evaluate the robustness and
survivability of platforms, systems, networks, and systems
Strategies: Build Culture
of Security
Asses and
Monitor Risk
Protec.ve
Measures to
Reduce Risk
Manage
Incidents
Sustain
Security
Improvements

34. Exhibit 4.1.1 Strategies for Achieving Energy Delivery Systems Cybersecurity
Vision: By 2020, resilient energy delivery systems are designed, installed, operated, and
maintained to survive a cyber incident while sustaining cri.cal func.ons.
Near-term
(0–3 years)
By 2013
4.1 Tools to identify cyber events across all levels of
energy delivery system networks
4.2 Tools to support and implement cyber attack
response decision making for the human operator
Strategies: Build Culture
of Security
Asses and
Monitor Risk
Protec.ve
Measures to
Reduce Risk
Manage
Incidents
Sustain
Security
Improvements

35. Exhibit 4.1.1 Strategies for Achieving Energy Delivery Systems Cybersecurity
Vision: By 2020, resilient energy delivery systems are designed, installed, operated, and
maintained to survive a cyber incident while sustaining cri.cal func.ons.
4.4 Real-.me forensics capabili.es
4.5 Cyber event detec.on tools that evolve
with the dynamic threat landscape
Strategies: Build Culture
of Security
Asses and
Monitor Risk
Protec.ve
Measures to
Reduce Risk
Manage
Incidents
Sustain
Security
Improvements
Mid-term
(4–7 years)
By 2017

36. Exhibit 4.1.1 Strategies for Achieving Energy Delivery Systems Cybersecurity
Vision: By 2020, resilient energy delivery systems are designed, installed, operated, and
maintained to survive a cyber incident while sustaining cri.cal func.ons.
Strategies: Build Culture
of Security
Asses and
Monitor Risk
Protec.ve
Measures to
Reduce Risk
Manage
Incidents
Sustain
Security
Improvements
2.3 Tools for real-.me security state
monitoring and risk assessment of all energy
delivery system architecture levels and across
cyber-physical domains.
Long-term
(8–10
years)
By 2020

37. Exhibit 4.1.1 Strategies for Achieving Energy Delivery Systems Cybersecurity
Vision: By 2020, resilient energy delivery systems are designed, installed, operated, and
maintained to survive a cyber incident while sustaining cri.cal func.ons.
Strategies: Build Culture
of Security
Asses and
Monitor Risk
Protec.ve
Measures to
Reduce Risk
Manage
Incidents
Sustain
Security
Improvements
4.7 Capabili.es for automated response to
cyber incidents.
Long-term
(8–10
years)
By 2020

38. Business Layer
Life-Cycle Management Layer
OperaHons Layer
Physical Layer
Cyber-Physical Layer
Requirements Regula.ons Incen.ves
Design Upgrades Ops Disposal
Design
Sensors
Compu.ng
Plaxorm
Models
Power System State
Controller
Monitor Control
Disposal
Current New
Models
Cyber Phys.
CPS
Phys.
Econ.
What are we missing

39. Cyber Infrastructure
(ComputaHon & CommunicaHon)
ProtecHon and Control
Detec.on, Processing,
Manipula.on
Physical Infrastructure
(Flow of Power)
Inputs: Currents, Voltages, Impedance,
Status (open,close, lockout)
Output: Open/Close Bkr, +/- Vars,
Inputs: Topology, traffic flows,
deep packet inspec.on, communica.on
state, state of physical power system
Output: NOTHING!
What are we missing

40. Ques.ons & Thoughts?
Nathan Wallace, PhD, CSSA
nathanwallace@computer.org
@NathanSWallace
Safety?

41. IEEE Computer Society
New Orleans Chapter
MeeHng
Ideas
MeeHng
LocaHons
Take our Survey
What are your Interests and Ideas?
The scope of the Computer Society shall encompass all aspects of theory,
design, practice, and application relating to computer and information
processing science and technology.
hXp://sites.ieee.org/neworleans/cs-survey/