1. Xanthus Consulting International Smart Grid Cyber Security: Support from Power System SCADA and EMS Frances Cleveland fcleve@xanthus-consulting.com

2. Xanthus Consulting International May 10, 2015 2 Cyber Security and the Smart Grid – Why is it important? August 14, 2003 Northeast Blackout – (enhanced photo) What caused the blackout?  Power Equipment Failures?  Mistakes by People?  Information Flow Design Flaws? What does this blackout have to do with Security? And Information Flow Design Flaws? Are those Smart Grid Security Issues? Yes, given how dependent the Smart Grid has (and will increasingly) become on information, “All Hazards” security mandates the need for a reliable and secure information infrastructure What is this picture?

3. Xanthus Consulting International May 10, 2015 3 What is Security? Some Key Concepts 1.For power systems, keeping the lights on is the primary focus. Therefore the key security requirements are Availability and Integrity, not Confidentiality (AIC, not CIA) 2.Encryption, by itself, does not provide security. 3.Security threats can be deliberate attacks OR inadvertent mistakes, failures, and natural disasters. 4.The most dangerous “attacker” is a disgruntled employee who knows exactly where the weaknesses are the easiest to breach and could cause the worst damage. 5.Security solutions must be end-to-end to avoid “man-in-the-middle” attacks or failed equipment from causing denial of service 6.Security solutions must be layered, so that if one layer is breached, the next will be there. Security is only as strong as its weakest link. 7.Security will ALWAYS be breached at some time – there is no perfect security solution. Security must always be planned around that eventuality. 8.Security measures must balance the cost of security against the potential impact of a security breach

4. Xanthus Consulting International May 10, 2015 4 To maintain power system reliability, need to manage both the Power System Infrastructure and its supporting Information Infrastructure Central Generating Station Step-Up Transformer Distribution Substation Receiving Station Distribution Substation Distribution Substation Commercial Industrial Commercial Gas Turbine Diesel Engine Cogeneration Turbine Fuel cell Micro- turbine Wind Power Residential Storage Photovoltaic systems Control Center Operators, Planners & Engineers 2. Communications and Information Infrastructure 1.Power System Infrastructure

5. Xanthus Consulting International May 10, 2015 5 Traditional “IT” Security Measures Cannot Meet All Power System Security Requirements Two key security issues for utilities are power system reliability and legacy equipment: –Power systems must continue to operate as reliably as possible even during a security attack. –It is financially and logistically impractical to replace older power system equipment just to add security measures. Layered security is critical not only to prevent security attacks, but also to detect actual security breaches, to survive during a security attack, and to log all events associated with the attack. –Most traditional “IT” security measures, although able to prevent and/or detect security attacks, cannot directly help power systems to continue operating. –For legacy systems and for non-critical, compute- constrained equipment, compensating methods may need to be used in place of these traditional “IT” security measures.

6. Xanthus Consulting International May 10, 2015 6 Use of Power System SCADA and Energy Management Systems for Certain Security Solutions One method for addressing these problems is to use existing power system management technologies as a valid and very powerful method of security management, particularly for detecting, coping with, and logging security events. –Add sensors, intelligent controllers, and intrusion-detection devices on “critical” equipment –Utilize and expand existing SCADA systems to monitor these additional security-related devices –Expand the SCADA system to monitor judiciously selected power system information from AMI systems. –Expand Power Flow analysis functions to assess anomalous power system behaviors such as unexpected shifts of load and generation patterns, and abnormal power flow contingency analysis results to identify unexpected situations.

7. Xanthus Consulting International May 10, 2015 7 Distribution Markets Service Provider Distribution Grid Management Use Cases: Logical Interfaces Used by NIST for Security Assessments Customer ISO/RTO Transmission SCADA/EMS Energy Market Clearinghouse Aggregators and Energy Market-based Providers Operations Distribution SCADA Geographic Information System AM/FM Customer Information Sys Distribution Operator DMS power system modeling functions: DOMA, VVWS, FLIR, CA, MFR, OMS, WMS Metering & Billing Load Management System AMI Headend Customer appliances, DER, PEV, Electric Storage Metering Distribution Engineering Distributed Intelligence Capabilities Distribution Field Crews, Mobile Computing 2 3 Energy Service Providers 5 6 8 9 12 14 13 15 16 1 19 28 21 23 24 25 26 DOMA: Distribution Operations Model & Analysis VVWS: Volt-Var-Watt FLIR: Fault Location, Isolation, Restoration MFR: Multi-Feeder Reconnection OMS: Outage Management System WMS: Work Management System 10 29 30 32 Customer EMS AMI Network 20 ESI/ Gatewa y 11 Collectors RTUs or IEDs 31 33 34 35 ESI/Gateway 17 18 27 Sensors 4 7 22 36

8. Xanthus Consulting International ¿Questions? Frances Cleveland fcleve@xanthus-consulting.com