Presentation is loading. Please wait.

Presentation is loading. Please wait.

Critical Energy Resources and their Interdependencies Alain Hubrecht – ECCRP Abu Dhabi, UAE – October 3-4, 2010 Workshop on Interdisciplinary Studies in.

Similar presentations


Presentation on theme: "Critical Energy Resources and their Interdependencies Alain Hubrecht – ECCRP Abu Dhabi, UAE – October 3-4, 2010 Workshop on Interdisciplinary Studies in."— Presentation transcript:

1 Critical Energy Resources and their Interdependencies Alain Hubrecht – ECCRP Abu Dhabi, UAE – October 3-4, 2010 Workshop on Interdisciplinary Studies in Information Security and Privacy (WISSP10) Digital Security of Critical Infrastructure Session

2 Warfare is evolving, particularly to that of a cyber level Control systems (SCADA, DCS…) used in the oil & gas, electrical and energy sectors face new threats Telecommunication, banks and information flows are among other critical resources Important to protect these resources for the functioning of a society or economy WISSP10, October 3-4, 20102Alain Hubrecht - ECCRP Who Am I Co-founder of The European Center for Critical Resources Protection (ECCRP) 15 years experience in Computer Aided Design and Virtual Reality Developed activities in vizualisation and training for complex industrial environment (power plants, electrical grids) Worked with leading Oil and Gas and engineering offices worldwide High Performance Computing expert for European Commission Homeland Security, Peace Support Operations and Critical Infrastructure Protection expert for NATO Founder of different start-ups in the IT field

3 Warfare is evolving, particularly to that of a cyber level Control systems (SCADA, DCS…) used in the oil & gas, electrical and energy sectors face new threats Telecommunication, banks and information flows are among other critical resources Important to protect these resources for the functioning of a society or economy WISSP10, October 3-4, 20103Alain Hubrecht - ECCRP Critical Energy Resources Related to energy production, transmission and distribution Oil, Natural Gas, Coal, Nuclear, … solar/wind… 3 types: Physical assets, or anything you can touch Cyber assets (IT components) Data, or things you cannot touch

4 Warfare is evolving, particularly to that of a cyber level Control systems (SCADA, DCS…) used in the oil & gas, electrical and energy sectors face new threats Telecommunication, banks and information flows are among other critical resources Important to protect these resources for the functioning of a society or economy WISSP10, October 3-4, 20104Alain Hubrecht - ECCRP Physical Assets Power Plants(nuclear, coil, gas, oil) Power Stations (400KV -> 11KV) High Voltage Lines (400KV -> 11KV) Refineries NLG Terminals Anything Offshore like FPSO, Platforms, Seabed Eq Pipelines (Oil, Gas) People (control room operators, engineers, starters, …) Drawings (P&ID, Logical schemas, …) etc…

5 Warfare is evolving, particularly to that of a cyber level Control systems (SCADA, DCS…) used in the oil & gas, electrical and energy sectors face new threats Telecommunication, banks and information flows are among other critical resources Important to protect these resources for the functioning of a society or economy WISSP10, October 3-4, 20105Alain Hubrecht - ECCRP Data, Intangible Assets Customer database SCADA values DCS historical values Alarm rules, super rules Starting Sequences (nuclear reactor, high voltage network…) …

6 Warfare is evolving, particularly to that of a cyber level Control systems (SCADA, DCS…) used in the oil & gas, electrical and energy sectors face new threats Telecommunication, banks and information flows are among other critical resources Important to protect these resources for the functioning of a society or economy WISSP10, October 3-4, 20106Alain Hubrecht - ECCRP Cyber Assets Cyber physical assets that control and process the data Computer hardware and IT infrastructure (servers, desktop…) Network Communication Links (switch, routers, firewalls) Specific Industrial devices (PLC, RTU, etc)... It is these assets which are covered by common cyber security threats Attacking these assets can have an impact on physical assets and data

7 WISSP10, October 3-4, 20107Alain Hubrecht - ECCRP Internal Interdependencies Sorting Physical Assets The time to repair or order a new one should be integrated in the loss of production. Some equipments like crackers or transformers need up to one year to be reordered or manufactured. Interdependencies Some other components can produce disastrous domino effects. All components (vessels, valves, reservoir, pipes, motors, …) have to be sorted out by the impact they can have on the production in case of loss/break. first node of interdependencies

8 WISSP10, October 3-4, 20108Alain Hubrecht - ECCRP Internal Interdependencies Cascade effects in case of loss of production of a power plant are prevented with solutions like EuroStag, a monitoring software, continuously sniffing even the smallest perturbation on the network, and able to correct appearing problems very quickly, before the cascade starts its disaster. When these assets are part of an international network, involved in an automatic balancing scheme, or integrated in a pool (deregulated market) the consequences can be more complex to handle and solve. Some solutions exist…

9 WISSP10, October 3-4, 20109Alain Hubrecht - ECCRP External Interdependencies A much more complex node of interdependencies however, exists between other critical infrastructures including: telecommunications, finance or transportation. Difficult to understand Different Critical Infrastructure not always handled holistically Difficult communication between all security infrastructures security initiatives Damage of a joint attack on all Critical Infrastructures is not well understood yet

10 WISSP10, October 3-4, Alain Hubrecht - ECCRP External Interdependencies Interdependen cies Energy - Oil and Gas, Electricity Telecommunic ation and Information Banking and Finance Wate r Transportation Energy - Oil and Gas, Electricity Highly connected and interdependent infrastructure for business and economic security Telecommunic ation and Information Highly connected and interdependent infrastructure for business and economic security Banking and Finance Highly connected and interdependent infrastructure for business and economic security Water Essentials and highly dependent infrastructure for health and safety Transportation Highly connected and interdependent infrastructure for business and economic security

11 WISSP10, October 3-4, Alain Hubrecht - ECCRP So far…. Different types of assets (Physical, Data, Cyber) Internal dependencies: can be sorted and understood External dependencies: hard to understand, not much work done Domino effect exists for internal and external dependencies

12 WISSP10, October 3-4, Alain Hubrecht - ECCRP Europe Europe is in the process of developing industrial and legal framework in an attempt to prevent these resources being attacked. Other projects are also well on their way to understand these technologies and their implications.

13 WISSP10, October 3-4, Alain Hubrecht - ECCRP Europe Three streams of information from EU Council directives and reports Framework Program Calls from European Commission FP7 -> ICT -> Security ->Energy Founded Projects

14 WISSP10, October 3-4, Alain Hubrecht - ECCRP Europe European Union Council Directive 2008/114/EC : On the identification and designation of European Critical Infrastructures and the assessment of the need to improve their protection Only two critical infrastructures defined: Energy (Electricity, Oil, Gas) Transport (Road, Rail, Air, Inland Waterways, ports) In comparison, the Department of Homeland Security in USA has defined 18 Critical Infrastructures and key Resources Sectors (Banking and Finance, Chemical, Energy, Transportation, Information Technology, Water, Emergency Services, Communications, …)

15 WISSP10, October 3-4, Alain Hubrecht - ECCRP Europe European Union - EPCIP European Program for Critical Infrastructures Protection (DG Home Affairs) Budget: 10m/year Not mandatory to be transnational Focus on policy and support scheme 2 calls since 2005, next one in November 2010 Achievements: -Discussions between countries directive (see previous page), next version in Cross sectorial group, , 60 experts, no results. -Question was: what are the real issues?

16 WISSP10, October 3-4, Alain Hubrecht - ECCRP Europe European Commission : Seventh Framework Program (FP7) first call Among others, joint call on Information and Communication Technologies Security Two Areas with different topics: 1. Pervasive and Trusted Network and Service Infrastructures/Critical Infrastructures Protection 2.Security Systems Integration, Interconnectivity and interoperability

17 WISSP10, October 3-4, Alain Hubrecht - ECCRP Europe Topics: Technology building blocks for creating, monitoring and managing secure, resilient, and always available information infrastructures that link critical Infrastructures ICT support for first responders in crisis occurring in Critical Infrastructures Optimized situational awareness through intelligent surveillance of Interconnected transport or energy infrastructures etc… European Commission

18 WISSP10, October 3-4, Alain Hubrecht - ECCRP Europe European Commission FP (total of 6.4 billions Euros) Latest round (call) of financial support just released Multiples areas (health, food, space, nanotechnologies, …) Two of those areas are Security and Energy Call still open until 2nd of December 2010 Under Security, two activites related to critical infrastructures: SEC : Protection of Critical Infrastructures against Electromagnetic Attacks SEC : Cyber Attacks Against Critical Infrastructures

19 WISSP10, October 3-4, Alain Hubrecht - ECCRP Europe Project ESCoRTS (Security of Control and Real Time systems) SCADA best practice on security, cyber security tastings facilities etc Project VIKING Investigate SCADA vulnerability, increase awareness for CIP. Etc Project EURACOM Protection of energy supply for European interconnected energy networks Project ESTEC Assess feasibility of a European Network SCADA security test centres A few others national project (Ex. ASTROM, AFTER – Italy) European Projects (UE related)

20 WISSP10, October 3-4, Alain Hubrecht - ECCRP Europe CPNI (Center for the Protection of National Infrastructures) United Kingdom Works closely with counterpart centers and institutes in USA Similar centers in Australia, Canada and NZ Provide security advice to national infrastructures All sort of activities around CIP Generally, information released by CIP is closed/private BSI (Federal Office for Information Security) Germany One of their studies areas is Security of Critical Infrastructure and Internet EuroScie (Scada and Control System Environment) Switzerland etc… Non UE related

21 WISSP10, October 3-4, Alain Hubrecht - ECCRP NATO NATO Industrial Advisory Group (NIAG) NIAG influences industrial system requirements and development Currently they have two researches areas: 1. Risk assessment and contingency planning for interconnected transport or energy networks 2. Modelling and Simulation for training CCDCOE (Cooperative Cyber Defence Centre of Excellence) Based in Estonia, launched in 2008 Four core areas of research One of them is Critical Information Infrastructure Protection

22 WISSP10, October 3-4, Alain Hubrecht - ECCRP ECCRP Founded in 2009 Will be located in an old World War II bunker in Brussels First center to provide security awareness and defense capabilities for these resources with the help of Virtual Reality. Will ensures everyone understands the risks associated with Critical Infrastructure Protection ECCRP IT Security Virtual Reality Homeland SecurityIndustrial Safety

23 WISSP10, October 3-4, Alain Hubrecht - ECCRP ECCRP Electricity Water Supply Oil & Gas… Telecommunicatio n BankingInformation SCADA PCN … TDM VOIP MPLS … SwiftNet X.25 … WWW … Virtual Reality, Virtual Machines and Virtual Networks VisioSpace

24 WISSP10, October 3-4, Alain Hubrecht - ECCRP ECCRP Combine all critical infrastructures together, not only energy (SCADA related) Use Virtual 3D Reality to modelize cities, countries and infrastructures Provide training and demonstration to both VIPs and specialists Best of Breed Trainings given by international experts in different fields Creation of an International Advisory Board Brussels center is a concept center. Possibility to open similar centers in other part of the world

25 WISSP10, October 3-4, Alain Hubrecht - ECCRP Conclusion Critical Energy Resources : different types of assets Internal and external interdependencies Lots of initiatives from European Union, National Countries or NATO Few combine all critical infrastructures together ECCRP will be the first center to use Virtual Reality Still lots to do…

26 WISSP10, October 3-4, Alain Hubrecht - ECCRP Questions Question?


Download ppt "Critical Energy Resources and their Interdependencies Alain Hubrecht – ECCRP Abu Dhabi, UAE – October 3-4, 2010 Workshop on Interdisciplinary Studies in."

Similar presentations


Ads by Google