Maintaining a resilient utility grid in the face of cyber attacks

By Kevin Nesdale, General manager of Power Distribution, Eaton ANZ

The recent spate of malicious state-backed cyber activity directed at Australia has been a sobering reminder that without a resilient cyber security framework in place, all critical infrastructure is vulnerable. About 31% of industrial control systems have experienced a cybersecurity incident or an attempt in the past 12 months, a significant number of attempts are targeting commercial, industrial, utility and government networks, making virtually every system vulnerable. The recent attacks come as a reminder that cyber-attacks are here to stay and that certain measures must be implemented from the outset to ensure utilities are resilient in the event of a breach.

Cyber secure by design

A resilient utility grid with a trustworthy cyber-network is required to mitigate the impacts induced by cyber-attacks. To eliminate the impacts of cyber-incidents, a three-phase Cyber Resiliency framework, including attack detection, response, and recovery is needed to couple cyber and physical layers along with advanced algorithms developed and implemented in each phase. As a critical element in the cyber-incident defense framework, post-contingency recovery, which belongs to the phase of attack mitigation, acts as a last step in cyber-defense framework and plays a significant role of maintaining healthy and uninterrupted operation of modern distribution systems.

Utilities should ensure that equipment purchased has cybersecurity principles included from the initial design phase. It is crucial to understand the difference in nature between IT systems and Industrial Controls for physical systems when it comes to security measures and data traffic. Cyber Resiliency Framework considers “Cybersecurity by Design” as a principle to operational technology (OT) defence mechanisms. An example of the difference is the nature of what we are protecting - for IT systems, customer data and organisational information is the main concern for cybersecurity. On the other hand, system operations and protection against equipment damage are the sole concern when cyber resiliency plays a significant role, to ensure system availability and fallback planning when a cyber incident occurs.

Connected devices and the vast amounts of data they generate create opportunities and risks for organisations; from manufacturing and testing to installation and service, which dictates a secure development lifecycle applying a defence-in-depth approach to their field devices. Utilities need to work with equipment suppliers to ensure

all intelligent electronic devices (IEDs) meet industry cybersecurity standards, regardless the location where these IEDs are deployed, from the substation level and down to microgrid level. History has taught us that utilities should increase the supply chain vendor participation in their response plan. This will create a new era of resiliency in the market and boost attention to the response.

The state-of-the-art practice on system level security is bound by isolating organisational IT infrastructure and the Supervisory Control and Data Acquisition (SCADA) system using a firewall. Although this provides standardised assurance against potential attacks through the organisation IT infrastructure, the attack vectors through the OT layer is remarkably wider, due the possible lack of physical security for edge level cyber assets. At the IT level, intrusion detection is carried out by identifying an attack or vulnerabilities through monitoring access logs, audit logs, self-identification (e.g. version number and installation dates), configuration monitoring by comparison a predetermined baseline. It is also performed by monitoring software and firmware file integrity checks to identify potential tampering or design issues.

'cybersecurity techniques that are effective today may not be tomorrow. Administrators

of industrial networks must be

ever-alert to changes in their OT networks and constantly working to prevent operational exploits'

Holistic approach

In a recent publication of the World Economic Forum, it was revealed that 54% of global utilities expect a cyberattack on their operational system. Whether the objective is to disrupt operations or create an entry point to higher value business assets (intellectual property, email, customer data), the tools and the techniques used for unauthorised network access are becoming increasingly sophisticated.

Utilities would benefit from a broad-based defensive approach with an unwavering focus on the endangering malware, spyware and ransomware present across the globe. Many of the latest vulnerabilities are originating on assets with limited security oversight; electrical breakers, generators, industrial gateways, elevators, automatic transfer switches, fire protection systems, and motor controllers to name a few. A vulnerability on these provides access to higher value targets on the primary IT network, such as customer and personnel information, emails, financial records and more. Therefore, utilities should seek strategic collaboration with the vendor to employ current system level cyber resiliency measures and devote specific leadership attention to OT security so that awareness is amplified and capabilities to thwart attacks continue to evolve.

In conclusion, cybersecurity techniques that are effective today may not be tomorrow. Administrators of industrial networks must be ever-alert to changes in their OT networks and constantly working to prevent operational exploits - using equipment that is secure by design is one of the keyways in which utilities can combat this using vetted equipment, while advancing their grid modernisation process.