1. Cyber Security of Smart Grid Systems
Vittal S. Rao
Texas Tech University
May 1, 2015

2. Phasor Data Concentrator
DFIG
Solar Data
Inverter Control
RTDS
Controller
RSCAD
Wind Data
Campus Wind Turbine
Solar
Battery Storage
Utility Grid
GTNET PMU
GE N60 & D90 plus
SEL-421
ABB-REL-670
D400 Substation Gateway
Phasor Data Concentrator
Visualization Screen in our lab
IEC 61850
IEEE C37.118
Cyber Security

3. Sponsors of Research Projects
National Science Foundation
Northrop Grumman Corporation
American Electric Power
Alstom Wind Power
Ball Aerospace Corporation

4. Networked Infrastructure Systems
Objectives
Infrastructure Systems
To develop real-time capabilities to detect, assess, analyze and mitigate cyber threats
To enhance resilient dynamics in networked systems for natural or man made disasters.
To develop decentralized security for complex systems
Smart Grid Energy Systems
Oil and Gas Pipeline Systems
Critical Manufacturing Systems
Intelligent Transportation Systems
Military Systems
Communication Systems

5. Background Information
Protection of critical physical infrastructure from cyber threats presents different challenges than standard cyber security practices. Conversely, while reliability and fault tolerance are well-developed areas of traditional systems engineering, probabilistic failure models do not suffice to capture the complexity of intelligent adversaries with undetermined capabilities and motives. However, critical physical infrastructure systems offer opportunities for powerful approaches to security, since they include a major physical component that must obey natural laws.
It is well known that standard cybersecurity practices developed by the information technology (IT) communities are inadequate to the challenges of networked engineering systems, due to real-time performance and uninterrupted service requirements, direct impact on human health and safety, a large base of vulnerable legacy hardware and software, and the culture gap between the engineering and IT communities.

6. Background Information (continued)
Referring to the fact that physical systems can be modeled using well-understood physical laws, Department of Homeland Security (DHS) Best Practices state that “The deterministic nature of the engineering systems can greatly improve the granularity of the signatures, because rogue or malicious behavior from an attacker may require actions that would be well beyond expected behavior levels.” The active cyber defense of engineering systems can be enhanced using the power of dynamical models of networked systems.

7. Information Security Key Concepts:
The CIA triad (confidentiality, integrity and availability)
Risk Management: Risk management is the process of identifying  vulnerabilities and threats to the information resources used by an organization in achieving business objectives, and deciding what countermeasures, if any, to take in reducing risk to an acceptable level, based on the value of the information resource to the organization.
Vulnerability: is a weakness that could be used to endanger or cause harm to an informational asset.
Threat: is anything (manmade or act of nature) that has the potential to cause harm.
Impact: is a loss of availability, integrity, and confidentiality, other losses (lost income, loss of life, loss of real property)
Mitigation of Risks: Administrative controls, logical controls, Physical controls 7

8. Differences IT Security Infrastructure Security
Highest priority: Confidentiality
Information Assurance
Architecture and Design for Security
Access Control
Network Security
Highest priority: Real-time performance
Legacy Systems
High Availability
Dynamic deployment and control of sensors
Ability to detect attacks and provide attribution based on physical models

9. Threats Against Cyber Physical Systems
Denial of service (DoS) attacks
Attacks against open ports and services
Attempt to change device settings
Attempt to inject malicious data
Attempt to change control settings
Attempt to place a man-in-the-middle(MITM) between physical systems.

10. Cyber Security of Critical Infrastructures
Assessment and monitoring of risk
Development and integration of protective measures
Detection of intrusion and implementation of response strategies
Enhancement of security methods

11. Intro-Efforts for securing SCADA systems
IT perspective: “Obscurity Principle”.
Control Engineering perspective:“reliability” .
Very few researchers have investigated how malicious attacks affect the estimation and control algorithms, and ultimately, how attacks affect the physical world
1. Today such protection relies mainly on standards, recommendations, policies, and suggestions for counter measures [6]
2. the protection of the system against random

12. Smart Grid Energy Systems
Integration of ‘Electrical Infrastructure’ with ‘Intelligence Infrastructure’
Smart Sensors, Protective Relays and Control Devices
On-Line Equipment Monitoring
Communications Infrastructure
New Operating Models and Algorithms
Real-Time Simulation and Contingency Analysis
Improved Operator Visualization Techniques
Interconnection Codes and Standards
Cyber Security

13. Smart Grid Energy Systems
Enables Active Consumer Participation
Accommodates all Generation and Storage Options
Enables New Products, Services, and Markets
Provides Power Quality for the Digital Economy
Optimize Asset Utilization and Operates Efficiently
Anticipates and Responds to System Disturbances (Self-heals)
Operates Resiliently Against Attack and Natural Disaster

14. Reference: Salvatore, et al
Reference: Salvatore, et al., Presentation on “Security analysis of a commercial synchrophasor device, May, 30-31,2011”

15. Intrusion Detection Methods
Anomaly detection:
Statistical models (Discrete Wavelet Transform)
Machine learning and data mining techniques
Specification-based methods
Information-theoretic measures
Misuse detection:
Rule-based language
Abstraction-based intrusion detection
State transition analysis tool kit
Colored Petri automata

16. Types of Stealth Attacks
Game-Theoretic approaches for addressing following stealth attacks:
Surge Attacks
Bias Attacks
Geometric Attacks

17. TTU Real Time Simulator
DFIG
Solar Data
Inverter Control
RTDS
Controller
RSCAD
Wind Data
Campus Wind Turbine
Solar
Battery Storage
Utility Grid
GTNET PMU
GE N60 & D90 plus
SEL-421
ABB-REL-670
D400 Substation Gateway
Phasor Data Concentrator
Visualization Screen in our lab
IEC 61850
IEEE C37.118
Cyber Security

18. State Estimation Techniques
Facilitate accurate and monitoring of operational quantities in dynamical systems.
Provide a real time data base of the system and will provide information to analyze contingencies and determine required corrective actions.
Broadens the capabilities of SCADA control systems.

19. Conclusions Emphasis on Cyber Physical Systems
Importance of Secure Critical Infrastructure Systems
Multidisciplinary Research Approaches
Real Time Detection Methods
Complex Systems and Big Data (Data Analytics)
Significant Shortage of Professionals
Academic Programs
Development of Test Beds
Next Big Thing!! [Internet of Things]
THANKS for YOUR ATTENTION