Smart Grid Threat Landscape and Good Practice Guide

Utgivare: Europeiska unionens cybersäkerhetsbyrå
Antagen: 2013-12-17
Språk: engelska
Källa: www.enisa.europa.eu

9 December 2013

European Union Agency for Network and Information Security www.enisa.europa.eu

About ENISA

The European Union Agency for Network and Information Security (ENISA) is a centre of network and information security expertise for the EU, its member states, the private sector and Europe’s citizens. ENISA works with these groups to develop advice and recommendations on good practice in information security. It assists EU member states in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in EU member states by supporting the development of cross-border communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found at www.enisa.europa.eu.

Authors

Louis Marinos, ENISA E-mail: Louis.marinos@enisa.europa.eu

Contact

For contacting the editors please use resilience@enisa.europa.eu. For media enquires about this paper, please use press@enisa.europa.eu.

Page ii

Smart Grid Threat Landscape and Good Practice Guide

Acknowledgements

This study has been carried out in collaboration a group of experts in the area of Smart Grids, namely: Ralph Eckmaier, Independent Advisor, Austria, Michael John, Elster GmbH, Germany and Jean-Pierre Mennella, Alstom Grid, France. Everis Aerospace and Defence, together with Universidad Politécnica de Madrid has contributed as external contractor in the phase of information collection and analysis. The involved experst within this contract were:  Everis Aerospace & Defence: María Pilar Torres Bruna, Fernando Sanchez Palencia  Universidad Politécnica de Madrid: Professor Dr Victor Villagrá González, Professor Dr Carmen Sanchez Ávila, Verónica Mateos Lanchas, Vicente Jara Vera

Legal notice

Page iii

Smart Grid Threat Landscape and Good Practice Guide

Executive summary

Smart grids are complex systems. A smart grid is a system of systems delivering energy to consumers. Smart grid stores, transports and manages energy. Smart grid is a de facto Critical Infrastructure as energy is important for the well-functioning of the society and economy. Being the blending of the energy and telecommunication critical infrastructures, smart grids should operate securely and by respecting end users’ privacy. Moreover, the protection of the smart grid is the key to energy availability. In this document we elaborate on cyber security issues with regards to smart grid information infrastructure. The security of a complex system is also a complex matter. In order to cope with this complex environment, this document leverages the following principles for simplifying the problem: Consider external and internal threats: In cyber-security the external environment are the cyberthreats. This cyber-threat environment originates from threat agents, the adversaries utilizing cyberthreats and launching cyber-attacks. Although dynamically changing, the cyber-threat landscape can be described and has finite elements. An understanding of the cyber-threat landscape is indispensable for the identification of the necessary protection measures. In this document, we provide a threat landscape affecting smart grid components. Internal threats are considered as well: a variety of threats emanating from errors and insider attacks are also taken into account. Decompose and classify the elements: A decomposition of smart grid components is one of the main tasks to tackle its complexity. This task is currently being performed by various experts around Europe and the World. Within this report, we have adopted the smart grid decomposition provided in the document Smart Grid Reference Architecture of the Smart Grid Standardization Coordination Group of CEN-CENELEC-ETSI. This is because this work is a highly reputed document among the security experts in Europe. Capture available knowledge: What have others done in the area of smart grid protection? This has been addressed by taking stock of available cyber-security approaches, protection approaches and good practices developed recently. In response to the urgent question of many stakeholders: How does this document support me in my work? this document provides tools to assess risk exposure of smart grid assets and will show what others have done in this respect. It elaborates on the threats smart grid components are exposed to and on the security controls to reduce threat exposure. But the assessment on the living object can be done only by the asset owner, just because asset owners master the complexity of infrastructures and the interdependencies among various assets. This task cannot be done as a generic exercise or it would have low value. Concluding, one should note that the use of these tools will depend on the capabilities of the expert users. In cyber-security preparedness, however, much depends on the capabilities of the adversary, which are not always known and certain; “That which depends on me, I can do; that which depends on the enemy cannot be certain. Therefore it is said that one may know how to win, but cannot necessarily do so” (Sun Tzu ).

Page iv

Smart Grid Threat Landscape and Good Practice Guide

Being knowledgeable about what can be achieved is one thing. The other is to reduce the impact. In cyber-security – an environment with asymmetric approaches - this can be achieved through common effort and coordination.

Page v

Smart Grid Threat Landscape and Good Practice Guide

Executive summary iv 1 Introduction 1 2 Method 4 3 Smart Grid Assets 6 4 Threats 9 5 Specific Smart Grid Threats 11 6 Smart Grid assets exposure to cyber threats 16 7 Threat agents 21 8 Vulnerabilities and Risks in Smart Grid 23 9 Good Practice of Smart Grid Security Measures 25 10 Conclusions 35

Page vi

Smart Grid Threat Landscape and Good Practice Guide

1 Introduction

This document elaborates on threats related to smart grids. Being an ENISA deliverable in the area of Threat Landscape, it comprises a detailed threat assessment in the area of smart grids, based on input form the generic ENISA Threat Landscape activities . The rationale behind this piece of work is to “deepen” the generic threat assessment by taking into account specificities of smart grids, a vital CIIP sector. By doing so, the objective is to complement various activities going on both within and outside ENISA, that is:  To perform a threat assessment on the basis of which smart grid security measures will be based. This activity is in support of related activities of the Commission: DG-ENER, in close cooperation with ENISA and DG CNECT, has decided to task the EG2 working group with the organisation of consultations security requirements with national cyber security authorities and the energy and ICT industry. 3 4  To deliver input to other international activities, in particular in the area of standardisation , . In this context, the threat analysis provided in this document will be reused in the definition of security measures for smart grid infrastructure models (scenarios). The present work is based on information developed within the ENISA Threat Landscape (ETL): relevant information about top threats is included in this document. The threats have been mapped to smart grid assets: this indicates the kind of exposure each asset has. Moreover, threat agents have been identified as originators of these threats. Through the established relationship among threats->assets->threat agents it becomes evident what threats smart grid assets are exposed to. Moreover, the capabilities of possible adversaries are also identified. This information is useful for a variety of security related activities in the area of smart grids, such as risk assessments, formulation of security requirements, identification of protection requirements, etc. This work is concluded with a good practice guide, consisting of an overview of smart grid security approaches. In particular, it is demonstrated how available smart grid controls from various existing standards protect against the identified threats. The structure of this report has been agreed with the expert group that has supported this ENISA work. Moreover, a contribution to the ENISA work on security measures for smart grids has been generated.

Policy Context

The Cyber Security Strategy for the EU stresses the importance of threat analysis and emerging trends in cyber security. The ENISA Threat Landscape is an activity towards the achievement of objectives formulated in this regulation, in particular by contributing to the identification of emerging trends in cyber-threats and understanding the evolution of cyber-crime (see 2.4 regarding proposed role of ENISA). Moreover, the new ENISA regulation mentions the necessity to analyse current and emerging risks (and their components), stating: “the Agency, in cooperation with Member States and, as

Smart Grid Threat Landscape and Good Practice Guide

appropriate, with statistical bodies and others, collects relevant information”. In particular, under Art. 3, Tasks, d), iii), the new ENISA regulations states that ENISA should “enable effective responses to current and emerging network and information security risks and threats”. From the above points it becomes apparent that the ENISA Threat Landscape is a significant contribution to the EU Cyber Security Strategy by streamlining and consolidating available information on cyber-threats and their evolution. Detailing the ENISA Threat Landscape for various emerging areas provides valuable contextual information to existing policy measures established by the commission. In the area of smart grids, in particular, this work supports a recommendation of the Commission: the European Commission included a number of data protection, privacy and security measures in the March 2012 Commission Recommendation on preparations for the roll-out of Smart Metering systems . Furthermore, it initiated action under the auspices of the smart grids Task Force with a dedicated Expert Group (EG2) focusing on two key concrete outcomes to be delivered in 2013, namely: 1) a Data Protection Impact Assessment (DPIA) template as a response to consumer concerns related to data protection and privacy; and 2) a cyber-security assessment framework as a response to investor and industry concerns related to system security. The cyber security assessment framework is composed of two sub-deliverables. First, a set of Best Available Techniques (BATs) pinpoints the potential cyber security risks inherent to each of the common minimal functional requirements for Smart Metering Systems recommended in the March 2012 Recommendation and identifies optimal controls and Privacy Enhancing Technologies to mitigate each of these risks. Second, a blueprint for a network will be elaborated, where information about incidents, threats, vulnerabilities and good practices can be shared for critical infrastructure protection . This work aims to provide a significant contribution towards assessing cyber threat exposure of smart grid infrastructures. As such it will directly contribute to the assessment of cyber security and comes to support investor and industry concerns.

Target Audience

This material is a tool for smart grid asset owners who wish to perform threat analysis and risk assessment according to their particular needs (i.e. asset protection level based on asset impact, vulnerabilities and detail of mitigation measures). While in this document the threat exposure of smart grid assets is being presented, asset owners may deepen their threat analysis and risk assessment by using asset and threat details provided in this document. A deeper analysis will be based on assessed threats, vulnerabilities and impact statements with regard to the concrete assets participating in a smart grid infrastructure scenario (see also specific threats in section 5). Moreover, the smart grid threat landscape will be of interest for policy makers: current threats and threat trend may be important input in policy actions in the area of cyber-security, critical infrastructure protection and smart grid in particular. Through the large number of collected reports, the smart grid threat landscape provides a unique collection of information regarding cyber-security threats. Hence, a further target group of this document are individuals who would like to obtain access to these sources in order to use them for their own purposes.

Smart Grid Threat Landscape and Good Practice Guide

Structure of this document

The rest of this document is organised as follows:  The rationale of the smart grid threat landscape is presented  A section that presents asset types that are typical for a smart grid environment. Moreover, composite assets are being presented, covering various asset types as they are foreseen within the Smart Grid Reference Architecture Model (SGAM) ;  A section on the threat categories smart grid assets are exposed to. In this section, smart grid specific threats are presented as they emerged from the performed information collection and analysis.  A section showing the smart grid asset types exposure to the threats and  A section showing which threats emerge from which threat agent groups.  A chapter with available smart grid security good practices indicating their protection against the identified threats.  A conclusion summarizes various issues and gives an outlook of activities/open issues and upcoming actions in this area. It is worth mentioning that in order to keep the size of this text as short as possible and enhance readability, detailed material is being provided by means of Annexes. This information is important for smart grid owners who wish to perform risk assessment and/or adapt the proposed security measures to their particular environment and needs.

Smart Grid Threat Landscape and Good Practice Guide

2 Method

In order to identify required protection levels of valuable assets it is common to perform a risk assessment. Subsequently, security measures have to be introduced to achieve the target level of protection by mitigating (part of) the assessed risks. As discussed below, threats are an important element in risk assessment. In this chapter we present the rationale and method followed within the Smart Grid Threat Landscape (SGTL). It consists of a number of threats to which smart grid assets are exposed. Hence, the presented SGTL is an important tool for those who want to assess the risks within a smart grid environment. Based on these risks, appropriate security measures can be selected to achieve risk mitigation. The role of threats in the risk assessment activity becomes evident when looking at the components of risks. According to the widely accepted ISO 27005 definition risks emerge when: “Threats abuse vulnerabilities of assets to generate harm for the organization”. In more detailed terms, we consider risk as taking into account the following elements: Asset (Vulnerabilities, Controls), Threat (Threat Agent Profile, Likelihood) and Impact The elements of risks are graphically depicted in the figure below:

This figure has been adopted from ISO 13335-4 and shows how threats try to exploit asset vulnerabilities in order to harm/take over the asset. The asset owner has implemented security measures to protect the asset, that is, to eliminate its vulnerabilities. The impact achieved by the potential materialization of a threat is the final element to evaluate the risk of an asset (see also risk definition above). While the definition of risks for an asset is a quite straight forward task, in complex environments it is often a challenge to assess risks. This is in particular the case in smart grids due to their technical complexity, interdependencies among components, multiplicity in operational responsibilities and 4

Smart Grid Threat Landscape and Good Practice Guide

complex supply processes. The present document is generic, hence it does not assume any particular smart grid environment and/or the processes implemented through it. As such, it is impossible to make any valid assumptions about impact and vulnerabilities of assets. These are activities that can solely be performed by the asset owner. Hence, the need for supporting tools for the performance of risk assessments becomes obvious and essential for the asset owner in this complex environment. In this document, we provide information on threats and threat exposure of typical smart grid assets, independently of any infrastructure scenarios. In other words, the smart grid Threat Landscape consists of a list of assets, and the threats applying to these assets. Further, by means of the presented good practices, we identify various security measures found in smart grid security approaches. By mapping these measures against threats we show how security measures are the used to avoid the assumed threat exposure. Given this information, the asset owner will need to assess vulnerabilities and impact in order to assess the risk and find risk mitigation measures (eventually among the ones from the processed good practices).

Smart Grid Threat Landscape and Good Practice Guide

3 Smart Grid Assets

A smart grid may consist of a plethora of asset types. For the sake of information security, we consider assets that are mainly related to information and communication technology. Due to the massive deployment of IT-based components in the area of electricity and transport network, some assets that are characteristic for smart grids have been added. These assets generate or process data and as such are exposed to cyber-security threats. In addition to the IT-assets, some non-IT assets have been included that are tightly related to the proper operation of IT assets. Examples hereto are: some electrical assets such as cables and relays, facilities, human resources, non-IT media, etc. The figure bellow gives an overview of the smart grid assets structure into relevant categories according to their use (see Figure 2). A more detailed description of these assets is given in Annex A. Besides these smart grid assets, some composite, more complex assets have been identified. These assets have been taken from the Smart Grid Architecture Model (SGAM) . By considering these assets, our intention is to take into account this standard, while at the same time showing the decomposition of the SGAM assets by means of the assets of Figure 2. This will allow interested individuals to find threats applying to such complex assets by cumulating the threats of their counterparts. Given the relatively young age of smart grid, it has to be taken as given that smart grid environments might grow over what is today being considered to be part of a smart grid infrastructure. Examples 11 12 of such assets might be elements currently considered as part of Smart Cities and Smart Mobility . Indicatively for this type of assets, we have included a relevant part of e-Mobility in the smart grid asset types. Hence, the asset taxonomy presented should be considered as a snapshot of the current state-of-play and as such non-exhaustive.

Smart Grid Threat Landscape and Good Practice Guide

The SGAM composite assets are decomposed by means of the asset groups shown in Figure 2. The decomposition of SGAM assets is presented in Table 1 below. It is worth mentioning that the terminology used, in particular zones and domains, has been taken as-is from the SGAM standard. Interested individuals might visit the SGAM document to find more explanations about zones, domains and their counterparts.

Smart Grid Threat Landscape and Good Practice Guide

4 Threats

For the purpose of the SGTL, a threat-taxonomy has been developed. The threats included in this collection of threats are all applicable to the smart grid assets presented in the previous section. The presented threat taxonomy covers mainly cyber-security threats, that is, threats applying to information and communication technology assets. Some additional non-IT threats have been assumed in order to cover threats to physical assets that are necessary to operate the considered ICT-assets. It is worth mentioning that the presented threats are a consolidation of threats from the ENISA Threat Landscape and threats used within a smart grid assessment performed by DG CONNECT . Moreover, the threats presented reflect the experience made within the ENISA Annual Incident Report 2012 regarding incidents in the telecommunication sector . This report is considered relevant, as attack methods and threats in smart grid and the telecommunication sector are considered to be very similar (i.e. as applying to similar IT-assets). The threats presented in Figure 3 are an overview. A detailed listing of these threats can be found in Annex B. This material contains additional information on threats such as:  Threat details: this field explains further details of a threat as they have been found in analysed material on cyber-threats.  Threat Agent: This field explains which threat agent group is considered to deploy attacks based on this threat.  Trend: This field indicates assessed trends for each particular threat. Such trends have been assessed by analysing publicly available threat reports. Threats that do not have a value in the trend field are not subject of ENISA Threat Landscape. They are mentioned because they might be potentially useful for risk assessments.

It should be noted, that the details presented reflect the current state of play within the ENISA Threat Landscape and are subject to changes according to new developments in that area and emerging threat issues (i.e. being a living document reflecting dynamic changes in the cyber-threat environment).

Smart Grid Threat Landscape and Good Practice Guide

5 Specific Smart Grid Threats

By analysing existing literature on smart grid security (see references and collected information in Annex D), we have identified specific threats that have been taken into account in existing assessments. The analysed material covers parts of smart grid infrastructure, in particular smart meters and some generic smart grid infrastructures within research projects. Thus, the specific smart grid threats presented in this section reflect the state-of-play in relevant available documents and, as such, are not exhaustive. Due to the complexity of smart grid infrastructures, one should argue that the set of threats presented in this chapter still have relevance for prospective infrastructure configurations and should be considered within risk assessments when relevant assets are part of the scenario at hand.

The specific smart grids encountered in the analysed literature are structured according to the categories mentioned in Figure 3. They are presented by means of threat details of particular threats and threat groups. It should be noted that the sequence of the specific smart grid threats presented below is not prioritized. This is because the analysed material has not provided any information that would allow prioritizing threats. Given the fact that no significant experience exists in this domain from existing implementations (i.e. through incident statistics in this area), no attempt has been undertaken to introduce any priorities for these threats. For obtaining a priority list of current cyber- 16,17,18 threats, we suggest interested readers to visit the ENISA Threat Landscape report . In the presentation of specific smart grid threats below, we use the same threat classification as the one used in Figure 3. Threat Group: Damage/Loss Threat: Loss of devices, media and documents In smart grid environments this threat involves rummaging through disposed magnetic media for retrieving sensitive data that is left behind on it. In particular, it is assumed that unauthorized people might come to possession of data related to Advanced Metering Infrastructure (AMI) communication . Threat: Information leakage Attacks of this type target various smart grid components and their main aim is to acquire private 19,20 sensitive information (energy consumption, credit cards, session data, access control data) .

Threat Group: Eavesdropping/Interception/Hijacking

Threat: Interfering radiation Electro ‐Magnetic/ Radio Frequency interception is a threat that aims at performing unauthorized interception of private communication. In particular, it is assumed that unauthorized people might come to possession of data related to Advanced Metering Infrastructure (AMI) communication .

Smart Grid Threat Landscape and Good Practice Guide

This threat materialises when threat agents are trying to interfere with the physical transmission and reception of wireless communications. It is one of the most efficient ways to launch physical-layer DoS attacks, especially targeting wireless communications. This can severely impact smart grid operations as they use wireless communication for various tasks . Another threat of this type in smart grid regards the extraction of data by analysis of various types of electromagnetic radiation emitted by a CPU, display, keyboard, etc. In case of smart grids, these attacks are viable because equipment is installed in the field, geographically distributed and they are accessible . Threat: Man in the middle, session hijacking In smart grid environments, interactions of AMI components with the infrastructure can be compromised. That could lead to unauthorized access to AMI communication information, modification of AMI data, denial of service to authorized users, and repudiation of actions . Threat: Interception of information Through interception of information several networks of different natures can be affected, such as WIFI, Zegbee and fixed networks. Particular variations of this threat may include:  Hijacking of the meter connection though a kind of unauthorized devices / messages to communicate with the DR system .  Intercepting information by side-channel attacks. Such attacks are based on physical accessibility (Substation, smart meters, collectors, etc.) to gain information from the physical implementation of a cryptosystem as the components of the smart grid are geographically distributed.  Intercepting and examining messages in order to deduce information from patterns in communication .  Sniffer attacks whereby an attacker with the appropriate access captures and analyses the 19,20,21 messages transmitted over the network .  Use of External Traffic with the aim to intercepting and examining messages in order to deduce information from patterns in communication . Threat: Network reconnaissance and information gathering Information gathering attacks of mobile communication (in particular 802.16e) may target the Advanced Encryption Standard (AES) cipher providing strong confidentiality on user data .

Threat: Replay of messages Acknowledges forgery is a threat where an attacker knows the DNS value and can send a false acknowledgement messages to the sender saying that the receiver has received the message when, in fact, it hasn't .

Threat Group: Failures/Malfunction Threat: Failure of devices and systems Given the complexity of smart grids and the multiplicity of devices and systems, it should be taken as given that a significant amount of incidents will be attributed to failures, misconfiguration and

Smart Grid Threat Landscape and Good Practice Guide

errors. This has been confirmed by incidents communicated to ENISA in the area of telecommunications , a sector with equally complex infrastructure. Threat: Failure or disruption of communication links (communication networks) Attacks abusing implementations of standards are based on missing or weak implementations of security mechanisms, in particular when standards used have not been developed with security in mind .

Threat Group: Nefarious Activity/Abuse Threat: Unsolicited e-mail Personnel engaged by various players in smart grid can be victims of anonymous, unsolicited e-mail attacks. This might be part of a targeted campaign . Threat: Denial of Service attacks These attacks attempt to make smart grid resources unavailable to its intended users (internal and 20,21 external). They can target to different layers of network and applications (physical / data-link) . Such attacks can be also performed by jamming the power-line . Threat: Manipulation of hard- and software Through manipulation, an attacker may manipulate scheduling by disabling antenna and changing Programmable Communicating Thermostat (PCT) Time locally . In particular:  Break into EWS, use engineering software to access field controllers and change their logic .  Get access to the operator station and perform targeted operator actions to stop all machines .  Manipulation of firmware of smart e-meters. This may include manipulated firmware that is sent from Central System to E-meter of manipulated firmware that is sent from Central system (via Data Concentrator) .  Compromise Central Systems to (1) switch off homes with E-meters; (2) delete all keys for the Emeters; and (3) distribute malicious firmware . Threat: Malicious code /Activity These threats affect smart grid as all the functioning of all involved IT components depends on the installed software. In detail, this threat consists of:  Exploit kits are a widely deployed form attack. Through exploit kits virus and malware infections are performed. Infected devices may be manipulated by the attacker. Malware infected operator stations may send targeted commands to DCS Server to disturb or manipulate they operation .  In smart grid, worms may be distributed by using the network to send copies to other nodes (computers on the network) . Worms may affect the operation of all smart grid components connected to the network.  Trojans are pieces of malware that facilitate unauthorized access to a computer system . Worms may affect the operation of all smart grid components connected to the network.

Smart Grid Threat Landscape and Good Practice Guide

 Backdoor / trapdoor is an undocumented entry point into a computer program, which is generally inserted by a programmer to allow access to the program . Vendors of smart meters, for example, may have installed firmware with backdoors or some hidden functionality to facilitate access to the device.  Service Spoofing is an attack in which the adversary successfully masquerades as another by falsifying data and thereby gaining an illegitimate advantage . A concrete example of spoofing is ARP spoofing in the MAC layer: the management frames are not authenticated in 802.11. Every frame has a source address. The attackers take advantage of the spoofed frame to redirect the traffic and corrupt the ARP tables .  With an ICMP-flooding attack, an adversary can flood a gateway with ICMP packets, thereby creating difficulties in the operation of clients associated to the same IP to send and receive packet.

A special case of a malicious activity that is leading to numerous incidents in all environments is that of “insider threat”. With this approach, adversaries would take advantage of access to systems at the operator’s end of the AMI system. The systems that the insider may be able to access include multiple appliances of a smart grid environment, including AMI, the system containing pricing information (either EMS or ICCP server to an ISO or generation entity), as well as the network infrastructure supporting those systems. Which malicious activity an insider uses, depends on their access to the various smart grid systems . Threat: Unauthorized access to information system / network External disclosure of information is an attack occurring when information is being disclosed to unauthorized entities. Smart grids manage privacy data, hence this threat is relevant in this environment. Regarding the unauthorized access to systems/network, the attacker may gain unauthorized access 19,21,25 to the information system / network from different locations of the smart grid such as:  Customer endpoint: There is a potential for AMI to allow access to the bulk electric grid from the residential or small business customer endpoint. The adversary can suborn the customer endpoint, intervene in wireless communication between the AMI meter and other endpoint equipment, or from the AMI meter to the local concentrator. These attacks will expose the head end equipment and systems to which the head end are connected. The exact details of this attack are greatly dependent on the implementation of AMI, particularly at the head end. Certain configurations would allow an attacker to affect the bulk electric grid. Through violation of the privacy of the consumer (1) disclose meter data or configuration data (Meter, Gateway or CLS configuration) or parts of it when transmitted between gateway and external entities in the WAN; (2) disclose meter data transmitted between the TOE and the meter. This threat is of specific importance if meters of more than one consumer are served by one gateway .  Remote access: Unauthorized remote access to SCADA systems via remote access from outside the smart grid network.  Remote access or physical access to the network: compromise DCS Server and disturb / disable communication with controllers in the field network . Compromise DCS Server and send commands to control and manipulate the configuration (parameters) of controllers. Compromise

Smart Grid Threat Landscape and Good Practice Guide

DCS Server and stop communication with Operator Station (stop delivery of data to Operator 24 24 Station) . Compromise RTU and send commands directly to controller . Threat: Manipulation of information This threat includes all kinds of manipulative activity regarding smart grid information, in particular AMI data and repudiation related information (e.g. AMI data, pricing information, invoicing 19,20 information, etc.). This threat relates to information of all software used, but also certificates . This threat might be deployed by means of the following methods:  Through buffer overflow attacks by inserting an incorrect value in the message fields, thus affecting message processing or sets the DFC flag. This might cause, for example, an outstation device to appear busy to the master. These attacks can result in data corruption, unexpected actions and device crashes .  Load redistribution attack is an injection of realistic false data with limited access to specific measurement data .  Delivery of wrong data to operator station that looks valid and harmless .  Manipulation of data received from TSO plant will cause working with wrong values, thus affecting the operation of RTU .  Manipulation of data sent to TSO and Energy Management Center, thus affecting the operation of RTU .  Attacker compromises an existing data concentrator and causes sending wrong data to the central system .  Attacker alters meter data when transmitted between meter and Gateway, Gateway and consumer or Gateway and external entities. The objective can be to alter billing-relevant information or grid status information; the attack may be performed via any interface (e.g. LMN, HAN or WAN) .  Attacker alters meter data, gateway configuration data, meter configuration data, CLS configuration data or a firmware update when transmitted between the gateway and an external entity in the Wan .  False data are injected by an attacker in the smart grid traffic. The attacker injects false or malicious DR events in DRAS (Demand Response Automation Server), causing blackouts and instability of the grid. Attacker modifies configuration data in the DRAS such as DR program data, customer list and shed event information, affecting the DR program behavior .  Through time modification of the Gateway time attackers aim at changing the relation between date / time measured consumption or production values in the meter data records . Threat: Misuse of information/Information Systems

In the absence of end-to-end encryption, a compromised data concentrator can be misused to monitor data of other customers .

Smart Grid Threat Landscape and Good Practice Guide

Threat Group: Physical attack

Threat: Fraud

Within a reverse engineering attack, the customer at an endpoint would achieve reduction of cost of electric and/or natural gas use. They would use information freely available from the AMI meter vendor or the standard used within AMI meters to reset the meter and reprogram it to report false information. If the information is not freely available, the attacker would reverse‐engineer a meter to develop a way to modify it. This is very similar to the many cable modem attacks that are openly available. Either the configuration settings from the utility or the actual firmware controlling the

operation of the meter would be modified in this attack . With the same objective, AMI meters can

be removed from one home and placed to another .

6 Smart Grid assets exposure to cyber threats

In this section the threat exposure of smart grid assets is presented. The association between assumed threats from Figure 3 and assets from Figure 2 is established through Table 2 below. As such, this table shows the threat exposure of assets and can be used as guidance in identification of

security needs. This table has been used within the document “Appropriate Security Measures”

that have been developed by ENISA on behalf of EG2 working group of the Commission .

Smart Grid Threat Landscape and Good Practice Guide

7 Threat agents

Threats emerge from groups of threat agents. For smart grid asset owners it is considered important to know which threats emerge from which threat agent group. This information is significant to decide on the kind of risks that should be mitigated: threat agent groups are indicative of the determination behind launched attacks and capability level. Given the importance of smart grids and the potential impact of attacks, smart grid asset owners will need to spend some thoughts on which protection might be appropriate in order to avoid exposure to attacks from a certain type of threat agent. The threat agents considered within this document are as follows:  Corporations: This kind of threat refers to corporations/organizations/enterprises that adopt and/or are engaged in offensive tactics. In this context, corporations are considered as hostile threat agents and their motivation is to build competitive advantage over competitors, who also make up their main target. Depending on their size and sector, corporations usually possess significant capabilities, ranging from technology up to human engineering intelligence, especially in their area of expertise.  Cybercriminals: Cybercriminals are hostile by nature. Moreover, their motivation is usually financial gain and their skill level is, nowadays, quite high. Cybercriminals can be organised on a local, national or even international level. It should be taken as given, that a certain degree of networking between cybercriminals is being maintained.  Employees: This category refers to the staff, contractors, operational staff or security guards of a company. They can have insider access to company’s resources and they are considered as both non-hostile threat agents (i.e. distracted employees) as well as hostile ones (i.e. disgruntled employees). This kind of threat agents possesses a significant amount of knowledge that allows them to place effective attacks against assets of their organization.  Hacktivists: Hacktivists are politically and socially motivated individuals that use computer systems in order to protest and promote their cause. Moreover, they are usually targeting high profile websites, corporations, intelligence agencies and military institutions.  Nation States: Nation states can have offensive cyber capabilities and use them against an adversary. Nation states have recently become a prominent threat agent due to the deployment of sophisticated attacks that are considered as cyber weapons. From the sophistication of these malware it can be confirmed that nation states have a plethora of resources and they have a high level of skills and expertise.  Natural disasters: Natural disasters are also threat agents and organizations are influenced by them, as they can cause potential physical damage. Natural disasters include lightning, fires, floods, earthquakes, windstorms etc. Although not a human threat agent, natural disasters are considered as such, as they can cause severe physical damage and impact the availability of information systems.  Terrorists: Terrorists have expanded their activities and engage also in cyber-attacks. Their motivation can be political or religious and their capability varies from low to high. Preferred targets of cyber terrorists are mostly critical infrastructures (e.g. public health, energy production, telecommunication etc.), as their failures causes severe impact in society and government. It has to be noted, that in the public material analyses, the profile of cyber terrorists still seems to be blurry.

Smart Grid Threat Landscape and Good Practice Guide

 Cyber fighters: an emerging phenomenon is that of patriotic motivated groups of citizens with the potential to launch cyber-attacks . Such groups might have strong feelings when their political, national or religious values seem to be threatened by another group and are capable of launching cyber-attacks . Having said that, one can argue that such groups are special cases (maybe an evolution or yet another instance) of hacktivism. To an extent, such groups may be supporters of totalitarian regimes and, rightly or wrongly, act on behalf of their supporting parties (i.e. governments) by contributing to national activities in the cyber-space . Their activities may include conflicts with other groups (i.e. hacktivists) .

Based on these short threat agent profiles, the threats presented in this document can be assigned to relevant groups. This assignment is based on the threat agent group profile and in particular on assumed motives. Table 3 below presents the potential involvement of threat agent groups in the threats considered for smart grid assets.

Smart Grid Threat Landscape and Good Practice Guide

8 Vulnerabilities and Risks in Smart Grid

In this section some reflections are provided on smart grid vulnerabilities and risks. Before going into the findings, one should note that both developments of smart grid infrastructures and smart grid security are at an early stage of maturity. This is mainly because not very many such infrastructures are operational for a sufficient period such that experiences have been gained, analysed and shared. On the other hand, smart grid developments and security assessments are in many cases managed confidentially, either for reasons of competitiveness or for security reasons. Hence, publicly available information on smart grid security issues originates from research and standardisation activities and is based on requirements and generic assumptions. The validation of this material through real-life experience/examples is currently not feasible, at least at European level. Due to the immense investments that are necessary to set up a smart grid environment, standardisation activities are an important issue towards security of investments. Hence, a big amount of effort is currently invested in standardisation activities. Such activities are based on generic assumptions (i.e. infrastructure components, scenarios, security requirements, etc.) and are aiming at establishing a context that will serve as basis for industrial developments. Having said that, some interesting information on vulnerabilities and risk has been found in the 20,24,25 collected documents . Given the general situation in smart grids the following vulnerabilities and risks were assessed:  Smart grid vulnerabilities: Currently, vulnerabilities assumed within smart grid environments related to some areas that are not differentiated from other IT systems. In particular we have seen vulnerabilities related to the areas : of customer security, physical security (in particular of publicly accessible devices), implicit trust between used components, teams with different skills and competences, involvement of multiple stakeholders (supply chain issues). Further, through to the utilization of wireless communication, relevant components might be vulnerable to threats targeting such components. Besides typical vulnerabilities in the area of 34 20 wireless communication , some relevant material can be found in . In the same document a number of generic non-smart grid related vulnerabilities can also be found. Concluding, one should mention that in the public domain there is a lack of information of vulnerabilities related to smart grid specific infrastructures, scenarios and components. There are some European projects that would cover this gap . Also the analysis has identified a Spanish Centre that is currently working in two European projects related with vulnerabilities in smart grids: n-SHIELD (www.newshield.eu/) and RISC (DG-HOME CIPS call).  Smart grid risks: Regarding smart grid risks, only one document has been found that provides a comprehensive assessment of risks . The risks assessed are related to the unavailability of some key smart grid components such as DCS and RTU; and AMI related components such as data concentrators, smart meters and central system to control and manage smart meters. The risks related to key smart grid components are mainly impact the stability and availability of the smart grid through manipulations in hard- and software (see nefarious activity, eavesdropping, and physical attack threat groups in Figure 3). Risks assessed for AMI are related to manipulation of components by users in order to perform fraud (i.e. primarily manipulating billing information and secondary affect operations of multiple meters). (see nefarious activity, eavesdropping, and physical attack threat groups in Figure 3).

Smart Grid Threat Landscape and Good Practice Guide

Although thoroughly done, this assessment covers only a part of the smart grid infrastructure and takes into account a reduced number of vulnerabilities. As already stated, more assessments will be necessary, ideally based on real infrastructures (even at the level of a laboratory) in order to achieve a better maturity in the implementation of smart grid cyber security measures. Concluding, one should note that due to the fact that a smart grid is a system of systems, it is important to understand the dependencies among involved components. Certainly, work that has been done in the area of SCADA is highly relevant to smart grid environments. Moreover, with increasing proliferation of mobile devices in industrial systems work on mobile security is another important part of such a complex system. Hence, vulnerability and risk assessment will depend on the particular mix of components, processes and human infrastructure involved in a particular scenario.

Smart Grid Threat Landscape and Good Practice Guide

9 Good Practice of Smart Grid Security Measures

In order to elaborate on good practices we took stock of publicly available smart grid security approaches. In doing so, existing literature has been analysed and security measures/controls proposed by these approaches have been identified. The security measures have been categorised in:  Security measures related to IT Systems and Logical Networks used within smart grid infrastructures: Such measures are related to assets such as Wide Area Networks, Gateways, Home Area Network (HAN) and Zigbee (IEEE 802.15.4) protocol, Advanced Metering Infrastructure (AMI), Master Terminal Unit (MTU) and Remote Terminal Unit (RTU)  Security measures related to Supply Chain of smart grid: Such measures are related to Providers, Distribution and Logistics and Customers. In the following sections, the identified security measures are presented with indication of their origin. In summary it is noticeable that three existing good practices provide a comprehensive set of 19,20,36, security measures . The majority of other documents analysed cover only a relatively small part 21,37,38,39,40,41,42 of security measures . This is quite natural thought, as this material is dedicated to some specific portions of smart grid infrastructure. ENISA has also performed some work on security measures for smart grid. A report has been published on the minimum security measures for smart grids in 2012 . Based on this report, ENISA, in collaboration with the Commission, has initiated a number of consultations with both private and public sector stakeholders, under the umbrella of EG2 , aiming at delivering a report with a set of smart grid appropriate cyber security measures which might end up to a Commission Recommendation on minimum cyber security requirements for smart grids in 2014. Both the ENISA report on minimum security measures and the contribution to EG2 are not covered within this good practice guide. The coverage of security measures proposed by ENISA with regard to threats mentioned in the present document can be found in the ENISA contribution to EG2 and are not repeated in this report. The identified security measures are then mapped to the threats, completing thus the picture between threat exposure and proposed security measure. This information can be found in Annex C.

Smart Grid Threat Landscape and Good Practice Guide

9.1 IT Systems and Logical Networks

This group of security measures relates to information and communication systems, nodes and links, transmission systems, control and management. Best practices related to security measures for protection of IT systems and logical networks are:

1. Align cyber-security to the organization’s overall IT strategy based on the defined risk 19,20 profile . 19,20

2. Establish a rigorous, on-going risk management process .

3. Establish effective configuration management process .

4. Utilities to formally publish internal security program (policies, guidelines, procedures) and 19,20 ensure compliance . 19,20

5. Develop cyber-security around IEC 62351 .

6. Adopt the security measures regarding the defined SGIS Security Levels (SGIS-SL) .

7. Adopt the defined smart grid Data Protection classes (SG-DPC) .

8. Document network architecture and identify systems that serve critical functions or contain 19,20 sensitive information that require additional levels of protection .

9. Conduct routine self-assessments . 19,20

10. Ensure Interoperability and Testing/Certification .

11. Implement a Security View per Layer, that is, establish a network protection strategy based on 19,20 the principle of defence-in-depth . 20,37

12. Establish 24-hour-a-day incident monitoring and logging and audit systems .

13. Implement attack mitigation mechanisms and network security proactive measures: prevention, 19,20,21 detection and analysis of vulnerabilities, correlation of events, etc .

14. Implement internal and external Intrusion Detection Systems (IDS) and Attack detection 20,21,37 tools .

15. Establish incident response mechanisms: a breach is inevitable since no system can be 100% secure. Incident response procedures must be developed so that it is used in the event of an 19,20 incident. Incident response includes disaster-recovery and business-continuity plans .

16. Maintain safe start, stop and fail modes for smart grid components: systems shall be capable of operating in an operational or non-operational state according to some policies. These may include activities allowed during initialization state, management functions necessary for element configuration, policy establishment and security domain establishment. The system shall transition into the operational state only upon completion of the critical initialization activities. The system shall transition into the non-operational state upon detection of a critical failure and transition into the operational state when the critical failure has been solved. At this point, the system shall be able to operating in a degraded mode while in an operational state. Also, supporting activities pertaining to the health of the system (e.g., diagnostics, maintenance, 19,20 training, etc.) shall only be allowed during the operational state . 19,20

17. Establish system backups and disaster recovery plans .

18. Apply regular updates: applying software patches on a regular basis to the SCADA operation 19,20 system, applications and components in the smart grid . 37,20

19. Removing or disabling unnecessary services . 26 Smart Grid Threat Landscape and Good Practice Guide

20. Perform technical audits of SCADA devices and networks, and any other connected networks, to identify security concerns: analyse identified vulnerabilities to determine their significance, and take corrective actions as appropriate. Track corrective actions and analyse this information to identify trends. Additionally, retest systems after corrective actions have been taken to ensure that vulnerabilities were actually eliminated. Scan non-production environments actively to identify and address potential problems .

21. Conduct physical security surveys and assess all remote sites connected to the SCADA network to evaluate their security .

22. Identify and develop a comprehensive understanding of all connections to SCADA networks and evaluate and strengthen the security of these connections in order to protect them: internal local area and wide area networks, including business networks, Internet, wireless network devices, including satellite uplinks, modem or dial-up connections, connections to business 37,19 partners, vendors or regulatory agencies, etc . Some security measures can be adopted to protect these connections, such as, conduct penetration testing or vulnerability analysis, use of firewalls, Intrusion Detection Systems (IDSs), and other appropriate security measures at each 37,20 point of entry .

23. Disconnect unnecessary connections to the SCADA network or isolate the SCADA network from other network connections: isolate the SCADA network from other networks as possible using 19,37 “Demilitarized Zones” (DMZs) and data warehousing .

24. Establish strong controls over any medium that is used as a backdoor into the SCADA 19,37 network .

25. Do not rely on proprietary protocols to protect your system: additionally, demand that vendors disclose any backdoors or vendor interfaces to your SCADA systems, and expect them to provide systems that are capable of being secured .

26. Implant Identification, Authentication and Access Control to all network devices, systems and 19,20,21 users . 19,20

27. Support of biometric authentication for user access to critical components .

28. Establish a Role-based Access Control (RBAC): roles or responsibilities that a subject or a user has within the organization and on rules which determine what access rights are permitted for the subject in a given role. Clearly define cyber security roles, responsibilities, and authorities 19,20 for managers, system administrators, and users .

29. Establish an Access Control List (ACL) and a Discretionary Access Control (DAC): list of permissions associated with an object that is used to specify which subjects, users, process, components or systems are allowed to access that particular object as well as which operations 19,20 the subject can perform on that particular object .

30. Establish the necessary Capability Lists (CL): list of objects associated with the permission to it .

31. Establish a Mandatory Access Control (MAC): access policy used in multiple-level systems that 19,20 require highly sensitive data .

32. Data Classification and Retention: data classification refers to classifying data according their security (confidentiality, integrity, or availability) level. Retention refers to how long data is kept before destroyed . 19,20

33. Define a strong Password Requirements and Guidelines and follow them .

34. Follow a correct policy of Control Key Management: all cryptographic keys, load control commands and network management commands must be encrypted before being shared on 19,20 the network and only the intended recipients must possess the decryption keys . 27 Smart Grid Threat Landscape and Good Practice Guide

35. Protect sensitive information using cryptographic functions to avoid external or not authorized 19,20,21 access to it . Sensitive information should be assessed by means of proper risk assessment.

36. Encrypt consumer usage data: only entities that are authorized to view the data possess the 19,20 decryption keys .

37. Keep personally identifiable information in a minimum number of systems from which it may be 19,20 securely accessed .

38. Encrypt the application level load control commands with the trust centre link key: Replay protection will be provided for this command by using a monotonically increasing sequence number .

39. Use Smart Energy Profile 2 (SEP 2) protocol: end-to-end Network Authentication and Authorization. Application Authentication (ACL). Authorization context (HTTPS, TLS). Digital 20,38 Signatures ECDSA-SHA256 and X.509v3 Certificates. Cryptography: ECDHE, ECDSA, AES128 .

40. The network key will be exchanged only with devices that successfully complete the join procedure: the join procedure requires the joining devices to establish a shared secret with the trust centre and use that to initiate communications. The shared key must be derived from the device installation code and shared with the trust centre using a secure out-of-band mechanism. Once the device joins the network successfully, the trust centre sends it the network key encrypted with the shared secret .

41. Avoid any unnecessary trade-offs between privacy and legitimate objectives of smart grid projects .

42. Visible and transparent to consumers — engaging in accountable business practices — to 19,20 ensure that new smart grid systems operate according to stated objectives .

43. Make privacy a core functionality in the design and architecture of smart grid systems and 19,20 practices .

44. Build in privacy end-to-end, throughout the entire life cycle of any personal information 19,20 collected .

45. The trust centre must ensure availability: the centre must implement mechanisms for high availability including protection from denial of service attacks, resource starvation, or network 19,20 congestion . Some best practices are related to specific asset type, such as Wireless Neighbourhood Area Network (WNAN), Demand Response (DR) systems, Gateway, Home Area Network (HAN), Advanced Metering Infrastructure (AMI), or Master Terminal Unit (MTU). 9.1.1 WAN This group of security measures covers all wireless communication that is necessary within smart grids. It covers WNAN (Wireless Neighbourhood Area Network, Wireless Local Area Network (WLAN) and Wireless Wide Area Network (WWAN). 1. IEEE 802.11: Use Media Access Control (MAC) address filtering; Wi-Fi Protected Access (WPA); IEEE 802.11w-2009 (an approved amendment to IEEE 802.11 to increase security of the management frames. The objective of this protocol is to increase the security by providing data confidentiality of management frames, mechanisms that enable data integrity, data origin 19,20 authenticity, and replay protection) . 2. IEEE 802.15.4: Use MAC address filtering; Flash memories; AES encryption; Source Node 19,20 Authentication . 28 Smart Grid Threat Landscape and Good Practice Guide

3. IEEE 802.16: Use Message Authentication Code (MAC) techniques; Protection against masquerading parties, AES-CCM5 . 9.1.2 Gateway 19,20 1. Low Power Encryption techniques (power consumption . 19,20 2. Central Authority for Public Key Infrastructure . 19,20 3. Trusted Platform Module . 19,20 4. MAC address filtering . 5. Virtual Home Command Exec. Execute all the commands received from the outside world on itself (Virtual Home Command Exec.) before deploying it on the real environment . 9.1.3 Home Area Network (HAN) and Zigbee (IEEE 802.15.4) protocol 1. Use Flash memory . 2. Avoiding Counter Mode (not secure Mode) in AES encryption . 19,20 3. Use MAC Address Filtering and Access Control List (ACL . 19,20 4. Source node authentication . 5. Restrict node connectivity using a pre-assigned PAN Identifier . 6. Secure Network Admission Control . 7. Out-of-band key loading method . 8. Trust Center address to be preconfigured in all nodes . 9. Establish an interference control (adequate band of frequency, increase, transmit power, mesh 19,20 topology, frequency hopping . 10. Secure the Demand Response (DR) system. Proper data handling practices must be carried out 19,20 in order to protect the security and privacy of customer information . 9.1.4 Advanced Metering Infrastructure (AMI) 19,20 1. Adopt an open reference standard for security of advanced meters . 2. Enforce full implementation of the security standard by advanced meter vendors . 3. Implement strong separation between the AMI network and the electronic security perimeters 19,20 of other systems . 4. Implement network separation, strong firewalls, and limited router access control lists in the 19,20 AMI network . 5. Traffic Control. Session control and mechanisms of detection and halting of rapid market fluctuations . 19,20 6. Ensure the existence of audit log maintenance . 7. Cryptographically authenticate metering assets to the network to ensure that only known and 19,20 approved devices participate in the network . 8. Authenticate and integrity check system commands, at the meter, to ensure they are 19,20 authorized and haven’t been tampered . 9. Guard against replay attacks to prevent denial of service attacks or load shedding and ensure 19,20 availability of system resources . 29 Smart Grid Threat Landscape and Good Practice Guide

9.2 Supply Chain

9.2.1 Providers 20,36,39 1. Recommend/enforce implementation of security standards .

Smart Grid Threat Landscape and Good Practice Guide

46. Keep the confidentiality (and access control) of customer equipment, the integrity of control 36,41 messaging and message information and the availability of customer devices .

47. Keep the confidentiality (privacy) and integrity of customer data and payments. Integrity of control messaging and message information containing prepayment data, and also the 36,41 availability of customer payment data and usage balances .

48. Ensure that any personally identifiable information retained is securely destroyed at the end of its lifecycle . 36,42

49. Implement and use a Disaster Recovery System .

50. Establish alternative providers on major lanes .

51. Separate break areas from storage and staging areas .

52. Require contractually electronic seals for monitoring access to containers .

53. Maintain proper storage of empty and full containers in a protected environment to prevent unauthorized access, including use of seals .

54. Segregate and mark international, domestic, high-value, and dangerous goods cargo within the warehouse by a safe, vault, caged, or otherwise fenced-in area .

55. Prohibits private passenger vehicles from parking in cargo areas or immediately adjacent to cargo storage buildings . 9.2.3 Customers 1. Provide information regarding security concerns . 2. Include appropriate language in contractual agreements to safeguard consumers . 36,41,20 3. Keep the confidentiality (privacy) and integrity of customer data and payments . 4. Keep the confidentiality (access control) of customer equipment, the integrity of control 20,41 messaging and message information and the availability of customer devices . 33 Smart Grid Threat Landscape and Good Practice Guide 34 Smart Grid Threat Landscape and Good Practice Guide

10 Conclusions

Based on the experience gained within this activity, a number of issues have been identified that are worth further elaboration and/or action from relevant stakeholders. In particular:  Develop attack scenarios for smart grid components. The next step towards facilitating risk assessments for smart grid infrastructures would be to develop some kind of threat intelligence in the form of attack scenarios.  Elaborate on criticality assessment. Stakeholders have expressed the necessity to develop criteria that allow assessing criticality of smart grid components. This would facilitate impact identification and necessary protection levels.  Develop assessments for various scenarios. It seems to be very advantageous to come up with some smart grid scenarios. Risk assessments would contribute to the specification of appropriate security measures for these scenarios.  Elaborate on levels of impact for smart grid incidents. Discussions with stakeholders have shown the need to define impact thresholds for incidents in the area of smart grids. Such thresholds would be important parameters for the definition of security levels, identification and management of critical situations, etc.  As in all CIIP areas, words matter: develop and maintain smart grid security terms and definitions.  Establish better coordination of European/International activities in the area of smart grids, including standardisation. Currently, various activities are on-going in this area, involving multiple organisations and stakeholders. It is important to identify common areas and coordinate the agendas. This will enable coherence and exploitation of synergies.  Elaborate on the overlapping issues of safety vs. security: smart grid is a traditional engineering sector in which safety standards are implemented. Cyber security overlaps with safety as it concerns the operation of parts of the grid. These overlaps need to be identified and interfaces need to be established.  Establish a platform for information exchange on smart grid security. Following the coordination of activities, it is important to establish the platform for information flow. This will enable coherence and exploitation of synergies.  Initiate a debate on need/importance maturity/compliance/certification approaches for (areas of) smart grid security. As in any industrial area, and in particular in CIIP, it is important to discuss the importance in setting criteria for measuring security maturity in smart grids.  Track developments in smart grid security and update relevant material. Both smart grid and cyber security are in a dynamic phase of change/development. This will make updates important in order to maintain their usability.  Link smart grid activities with other related emerging areas such as smart cities, smart (home) environments, eMobility, Future Internet, and liaise with related stakeholders. As the scope of all these areas is quite wide and overlapping, it will be important to identify interfaces and coordinate common topics.  Create circles of trust to share information about smart grid security. Smart grid security is falls into CIIP and as such parts of the work need to be kept in confidentiality. For this purpose, circles of trust among relevant stakeholders need to be developed and modalities need to be developed for managing this information.

Smart Grid Threat Landscape and Good Practice Guide

Annex A: Description of Smart Grid assets

Information

Information is a valuable asset as, depending on it, machines and staff will make decisions. It can travel by different supports or represent different meanings. Information assets identified are:  Inventory of electrical assets: physical components that storage the information while it is travelling or it is being converted: cables, relays, transformers, power switches, earth switches, controllable/regulating inverter, distribution automation, sensors, equipment health sensor, fault current limiter, FACTS devices.  Operational information about electrical assets: status indicators, alerts, events and shortage - disturbance information.  Historical information: information related to the past that must be storage by law or due to its value / nature.  Trending information: information related to the past that can be used to predict future behaviour, and so, to be prepared for it.  Trading information: information related with commercial issues.  System Configuration: information related with the network itself: network topology, IP addresses Allocation, inventory of MAC addresses, user credentials, user permissions, configuration files, geolocation. Different information may be susceptible to the security principles: confidentiality, integrity, availability.

Software

The Software of an infrastructure will let us manage the information (access it, modify it and store new information). No availability of the required software will mean any access to information. Main software in a smart grid is:  Applications: we will find different types of applications with different connectivity: connected with the Internet but only accessed by the staff of the company; application oriented to end users, to access its own information; real time applications (utility IT information system capable of integrating, organizing, displaying and analysing real-time or near real-time electric distribution data to offer a wide range of operational benefits; SCADA systems: the application that will control industrial processes, in general no connected with Internet.  Standard Software: software needed to make the applications work. o Database. o Web server.  Operating System.  Device Driver: software installed in the different used drivers as USBs, CDs, DVDs, printers, scanners.  Firmware. When we analyse this asset, we will need to think about: the origin of the software (is this origin trustworthy? Do we know the source code?); access to it (who is able to access it and with what kind of permissions? What procedures of access does it have?); real location of the software (where is the server that holds is located?). 36

Smart Grid Threat Landscape and Good Practice Guide

Services

The services are activities between a client and a provider. They are considered as valuable assets because its correct functioning is needed to the correct functioning of the smart grid. Services oriented to the staff of the smart grid:  Mail Service.  Terminal Service.  Print Service.  Authentication Service. Services oriented to the network itself and to make possible the necessary communications:  File Service.  Network Service.  Name Service.  Address Service. Cloud services:  Software as a service.  Infrastructure as a service.

Hardware

The hardware components considered as main assets of a smart grids are:  Smart grid: o Remote Terminal Unit (RTU): microprocessor-controlled electronic device that interfaces objects in the physical world to a distributed control system or SCADA (supervisory control and data acquisition) system by transmitting telemetry data to a master system, and by using messages from the master supervisory system to control connected objects. o Intelligent Electronic Device (IED): term used in the electric power industry to describe microprocessor-based controllers of power system equipment, such as circuit breakers, transformers, and capacitor banks. o Programmable Logic Controller (PLC): digital computer used for automation of electromechanical processes, such as control of machinery on factory assembly lines, amusement rides, or light fixtures. o Distributed Control System (DCS): is a system used in manufacturing to control set of devices in a distributed environment.  Micro grid: electrical systems that include multiple loads and distributed energy resources that can be operated in parallel with the grid or as an electrical island; Micro grid Controller: devices that control and enable the establishment of micro grids.  Smart Meter: electrical meter that records consumption of electric energy in intervals of an hour or less and communicates that information at least daily back to the utility for monitoring and billing purposes. The components of smart meters to take into account are: o Metering End Device, which let us read date at the end points: Electricity; Gas; Water; Heat. 37

Smart Grid Threat Landscape and Good Practice Guide

Infrastructure

Infrastructures are also main assets to protect. There are several types of infrastructures:  Facilities: o Premises o Building o Server Room o Office o Auxiliary Room o Collector o Data centre  Power: o Transformer o Emergency Generator o UPS  Air Conditioning  Cabling

Personnel

Personnel are now considered a main asset in all the organizations, due to its knowledge and experience. The existing profiles of personnel in a smart grid are:  User  Operator  Administrator  Developer Every profile has different access to the rest of the assets.

eMobility

EMobility represents the concept of using electric powertrain technologies, in-vehicle information, and communication technologies and connected infrastructures to enable the electric propulsion of 39

Smart Grid Threat Landscape and Good Practice Guide

Annex B: Threats assumed for Smart Grid assets

Smart Grid Threat Landscape and Good Practice Guide

Annex C: Good Practices: protection against the Threats

In this annex, various security measures used within the analysed good practices are referenced in the table through the number of the section their section and thir sequence number within each section.

Smart Grid Threat Landscape and Good Practice Guide

Annex D: Collected Information: Inventory of Smart Grid Documents

Page 1

Smart Grid Threat Landscape and Good Practice Guide

Page 2

Smart Grid Threat Landscape and Good Practice Guide

Page 3

Smart Grid Threat Landscape and Good Practice Guide

Page 4

Smart Grid Threat Landscape and Good Practice Guide

Page 5

Smart Grid Threat Landscape and Good Practice Guide

Page 6

Smart Grid Threat Landscape and Good Practice Guide

ENISA

European Union Agency for Network and Information Security Science and Technology Park of Crete (ITE) Vassilika Vouton, 700 13, Heraklion, Greece

Athens Office

1 Vass. Sofias & Meg. Alexandrou Marousi 151 24, Athens, Greece

PO Box 1309, 710 01 Heraklion, Greece Tel: +30 28 14 40 9710 info@enisa.europa.eu Page 7 www.enisa.europa.eu

Fotnoter

9 December 2013
9 December 2013
Notice must be taken that this publication represents the views and interpretations of the authors and editors, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the Regulation (EU) No 526/2013. This publication does not necessarily represent state-of the-art and ENISA may update it from time to time. Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication. This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.
© European Union Agency for Network and Information Security (ENISA), 2013 Reproduction is authorised provided the source is acknowledged.
9 December 2013
http://ec.europa.eu/dgs/home-affairs/what-we-do/policies/crisis-and-terrorism/criticalinfrastructure/index_en.htm, accessed 13 Nov 2013. http://en.wikipedia.org/wiki/The_Art_of_War, accessed 13 Nov 2013.
9 December 2013
9 December 2013
9.1 IT Systems and Logical Networks 26
9.1.1 WAN 28 9.1.2 Gateway 29 9.1.3 Home Area Network (HAN) and Zigbee (IEEE 802.15.4) protocol 29 9.1.4 Advanced Metering Infrastructure (AMI) 29 9.1.5 Master Terminal Unit (MTU) and Remote Terminal Unit (RTU)’ 30
9.2 Supply Chain 30
9.2.1 Providers 30 9.2.2 Distribution and Logistics 31 9.2.3 Customers 33
9 December 2013
3 http://www.cen.eu/cen/Sectors/Sectors/UtilitiesAndEnergy/SmartGrids/Pages/default.aspx#, accessed 11 November 2013. 4 http://www.cenelec.eu/aboutcenelec/whatwedo/technologysectors/smartgrids.html, accessed 11 November 2013. 5 http://www.ec.europa.eu/digital-agenda/en/news/eu-cybersecurity-plan-protect-open-internet-and-online-freedomand-opportunity-cyber-security, accessed 28 Nov 2013. 6 http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2013:165:0041:0058:EN:PDF, accessed 28 Nov 2013. 1
9 December 2013
7 http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2012:073:0009:0022:EN:PDF, accessed 3 December 2013. defined in points 3.f and 18 of the Recommendation 2012/148/EU "Evaluation of available methodologies for a trustworthy network sharing vulnerabilities and threats analysis of Smart Grid and Smart Metering systems among stakeholders" 2
9 December 2013
http://ec.europa.eu/energy/gas_electricity/smartgrids/doc/xpert_group1_reference_architecture.pdf, accessed 10 Sept 2013. 3
9 December 2013
T Threat
Figure 1: Threats targeting an asset by trying to exploit its vulnerabilities.
9 December 2013
9 December 2013
11 http://www.smart-cities.eu/press-ressources.html, accessed 5 September 2013. http://www.mobincity.eu/, accessed 5 September 2013. 6
9 December 2013
Rem. Term. Unit Adv. Met. Infr (AMI) Cables
(RTU) Smart Grid
Metering End Dev. Relays Intellig. Electr. Device (IED) Loc. Netw. Acc. (LNAP) Transformers Smart Progr. Logic Neighb. Netw. Acc. Power Switches Meter (NNAP) Controller (PLC) Earth Switches Emission Control Server Ext. Display
Inventory of (ECS) Home Autom. Comp. Sensors Electrical Assets Engineering Workstation Cables Actuators (EWS) Relays
Operational Distributed Control System Transformers Status Server (DCS)
information about Electrical
Power Switches
Events Electrical Assets Assets
Earth Switches Shortage/Disturbance
Information Actuators
Alerts Sensors
Server PC
Network Mobile Device Information (Tablet, Phone, PDA) Topology
IP Address System Thin Client
Allocation Configuration Printer
Inventory of MAC Addresses Switch
Client Adv.
User Permissions Interr.
Information MG
Switch Configuration Files Controller
Micro Router
Security Parameters
Hardware Network Operating System
Gateway Firewall
Device Driver
WLAN Acc.
Software SSD Point Firmware
Smart Grid
Mag. Disk Web Server Standard Software Opt. Disk
Office Suite Paper
Virtual Database
File HID
Mail Keyboard
Terminal Mouse
Building Facilities
Network Comp
Office Aux. room
Address Infrastructure
Power Collector
Authentication Data
SaaS (Cloud) Airco
IasS (Cloud) Cabling
Generator Developer UPS Administrator
Electric Vehicle E-Mobility Persons
Charging Station Operator
Figure 2: Overview of smart grid assets
9 December 2013
Routers, Routers, Routers, Routers, Switches, Switches, Routers, Switches, Switches, Switches, Market Firewalls, Firewalls, Firewalls, Servers, Firewalls, Servers, Firewalls, Servers, Servers, Servers, Workstations Workstations Workstations Workstations Workstations
Routers, Routers, Routers, Routers, Switches, Switches, Routers, Switches, Switches, Switches, Enterprise Firewalls, Firewalls, Firewalls, Servers, Firewalls, Servers, Firewalls, Servers, Servers, Servers, Workstations Workstations Workstations Workstations Workstations
Routers, Routers, Routers, Routers, Switches, Switches, Routers, Switches, Switches, Switches, Operation Firewalls, Firewalls, Firewalls, Servers, Firewalls, Servers, Firewalls, Servers, Servers, Servers, Workstations Workstations Workstations Workstations Workstations
Routers, Routers, Routers, Routers, ES Switches, Switches, Routers, Switches, N Switches, Switches, Firewalls, Firewalls, Firewalls, Servers, ZO Station Firewalls, Servers, Firewalls, Servers, Servers, Servers, Workstations Workstations Workstations Workstations Workstations
IEDs, Router,
Servers, Field RTUs, IEDs RTUs, IEDs RTUs, IEDs RTUs, IEDs Workstations,
Actuators and
Actuators and Actuators and Actuators and Actuators and Sensors (local
Sensors (local Sensors (local Sensors (local Sensors (local communication line
communication communication communication communication wired with IEDs or Process line wired with line wired with line wired with line wired with Customer Energy
RTUs or IEDs at RTUs or IEDs at RTUs or IEDs at RTUs or IEDs at Management
Field level) Field level) Field level) Field level) Systems at Field
Generation Transmission Distribution DER Customer Premises
Table 1: List of SGAM assets and their decomposition
9 December 2013
13 http://www.enisa.europa.eu/activities/risk-management/evolving-threat-environment/ENISA_Threat_Landscape, accessed 5 September 2013. 14 http://ec.europa.eu/information_society/newsroom/cf/dae/document.cfm?action=display&doc_id=1763, accessed 5 September 2013. http://www.enisa.europa.eu/activities/Resilience-and-CIIP/Incidents-reporting/annual-reports/annual-incident-reports- 2012/at_download/fullReport, accessed 5 September 2013. 9
9 December 2013
Bomb attack, threat Natural disaster Natural
Disaster Sabotage
Environmental disaster Vandalism Fire Deliberate Theft (device, media)
Flood physical
Polution, dust, corrosion attacks Information leakage, sharing
Thunder stroke Unauthorised physical access Unfavourable climatic conditions Fraud Major environmental events
Erroneous information sharing, lekage Erroneous use or adminisration of devices, systems
Damage, Loss
Damage by third party of IT assets Usage of information Damage, corruption from testing from unreliable source
Integrity loss of information Unintentional alteration of data Loss of devices, media, documents Unintentional Inadequate design, planning, adaptation Destruction of records, devices, media data damage
Information leakage
Failures of devices and services Failure, disruption of Internet outage communication links Network outage Failure, disruption of main sypply functions Loss of support services Threats Failures, Malfunction Failure, disruption of Strike service providers
Shortage of personnel Malfunction of devices, Energy outage systems
Lack of resources
Identity theft War driving Unsolicited e-mail Intercepting, Denial of service compromizing emissions
Malicious code, activity Interception, Interception of information Social Engineering Hijacking Interferring radiation Nefarious Man in the middle, Abuse of Information Leakage Activity, Abuse session hijacking Generation and use of rogue certificates Repudiation of actions Manipulation of HW and SW Network Manipulation of information reconnaissance, information gathering Misuse of audit tools Replay of messages Falsification of records Misuse of information, information systems Unauthorised use of administration Unauthorized use of copyright material Unauthorised access to systems Legal Failure to meet contractual agreements
Unauthorised software installation Violation of laws, breach of legislation Unauthorised use of software
Compromising confidential information Abuse of authorizations Hoax Badware Remore activity (execution) Targeted attacks
Figure 3: Overview of threats assumed for smart grid assets
9 December 2013
http://www.enisa.europa.eu/activities/risk-management/evolving-threatenvironment/ENISA_Threat_Landscape/at_download/fullReport, accessed 11 Nov 2013. http://www.enisa.europa.eu/activities/risk-management/evolving-threat-environment/enisa-threatlandscape-mid-year-2013/at_download/fullReport, accessed 11 Nov 2103. http://www.enisa.europa.eu/activities/risk-management/evolving-threat-environment/enisa-threatlandscape-2013-overview-of-current-and-emerging-cyber-threats/at_download/fullReport, accessed 11 Dec 2013. http://www.energy.ca.gov/2013publications/CEC-500-2013-056/CEC-500-2013-056.pdf, accessed 11 Nov 2013. 11
9 December 2013
http://csrc.nist.gov/publications/nistir/ir7628/introduction-to-nistir-7628.pdf, accessed 11 Nov 2013. http://www.ece.ncsu.edu/netwis/papers/13wl-comnet.pdf, accessed 11 Von 2013. 12
9 December 2013
http://www.enisa.europa.eu/activities/Resilience-and-CIIP/Incidents-reporting/annual-reports/annualincident-reports-2012/at_download/fullReport, accessed 11 Nov 2013. http://www.etsi.org/WebSite/document/0905_RA%20smart%20grids-Bdef.pdf, accessed 11 Nov 2013. Crisalis Project EU (http://www.crisalis-project.eu/), Deliverable D2.2 Final Requirement Definition. 13
9 December 2013
http://www.ijsgce.com/uploadfile/2012/1011/20121011121836539.pdf, accessed 11 Nov 2013. 14
9 December 2013
http://www.iitmicrogrid.net/event/greatlake2012/publication/PPTs/32- Smart%20Grid%20Monitoring%20and%20Cyber%20Security/32-ZuyiLi- Load%20Redistribution%20Attacks%20and%20Protection%20Strategy%20in%20Electric%20Power%20Syste ms.pdf, accessed 11 Nov 2013. https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/SmartMeter/PP- SmartMeter.pdf?__blob=publicationFile, accessed 11 Nov 2013. 15
9 December 2013
Threat Group Threat Asset Group Asset/Detail Comment
Infrastructure Physical attack (deliberate/ intentional) Hardware E-Mobility Persons
Bomb attack / threat
Fraud Ditto
Sabotage Ditto
Theft (of devices, storage Ditto
media and documents)
Information leakage/sharing
Unauthorized physical access / Unauthorised entry to premises
Coercion, extortion or corruption
Hardware Unintentional damage Software (accidental) Information Services
Information leakage/sharing due to user error
This ENISA contribution to Commission’s EG2 working group is going to be published in short. Upon availability, the URL is going to be referenced.
http://di.dk/SiteCollectionDocuments/Virksomhed/Sikkerhed/Presentations/05-Moulinos.pdf, accessed 3 Dec 2013
9 December 2013
Threat Group Threat Asset Group Asset/Detail Comment
Erroneous use or administration of devices and systems
Using information from an unreliable source
Unintentional change of Ditto
data in an information system
Inadequate design and Ditto
planning or lack of adaptation
Infrastructure Disaster (natural, environmental) Hardware E-Mobility Persons
Disaster (natural earthquakes, floods, landslides, tsunamis)
Disaster (environmental fire, explosion, dangerous radiation leak)
Flood Ditto
Pollution, dust, corrosion Ditto
Thunder stroke
Water Ditto
Unfavourable climatic conditions
Major events in the Ditto
Damage/Loss (IT Assets) Hardware Software Information Services
Damage caused by a third Ditto
party Damages resulting from Software penetration testing Information Services Loss of (integrity of) Software Information sensitive information Services Loss of devices, storage Hardware media and documents Facilities
Software Destruction of records, devices or storage media Information Services
Information Leakage Ditto
Failures/ Malfunction Hardware Software Information Services Hardware Failure of devices or systems Software Services
9 December 2013
Threat Group Threat Asset Group Asset/Detail Comment Network Failure or disruption of communication links Services (communication networks) Failure or disruption of Facilities main supply Power Airco
Failure or disruption of service providers (supply chain) Hardware Malfunction of equipment (devices or systems) Software Services Insecure Interfaces (APIs) Hardware Software Services
Infrastructure Outages Hardware Software Services E-Mobility
Lack of resources Ditto Persons
Loss of electricity
Absence of personnel Ditto
Strike Ditto Persons
Loss of support services
Internet outage Ditto
Network outage Ditto
Eavesdropping/Interception/ Network Hijacking Hardware Software Services Information War driving Network Services Network Intercepting Services compromising emissions Interception of Information Network information Media Interfering radiation HID Displays Electrical Assets Network Replay of messages Services Software Network Reconnaissance Network Information and Information gathering Persons
Man in the middle/ Network Services Session hijacking Hardware Software Repudiation of actions Network Services Hardware Software Persons
9 December 2013
Threat Group Threat Asset Group Asset/Detail Comment
Network Nefarious Activity/ Abuse Services Hardware Software Person Identity theft Network Services Software Person Unsolicited E-mail Person
Denial of service Network Service Software Malicious code/ Software software/ activity Service
Person Social Engineering
Abuse of Information Ditto
Leakage Network Generation and use of rogue certificates Service Software Manipulation of Hardware Software hardware and software Service Information Manipulation of information Service Software Misuse of audit tools Software Information Information Falsification of records Software Information Misuse of information/ information systems Software
Unauthorised use or Ditto
administration of devices and systems
Unauthorized access to the information system / network Information Unauthorized changes of Software records Unauthorized installation Software of software Software Unauthorized use of software Network Compromising confidential information Information (data breaches) Service Software
Abuse of authorizations
Abuse of personal data Ditto
Hoax Ditto
Network Badware Information Service Software Remote activity Network Information (execution) Software
9 December 2013
Threat Group Threat Asset Group Asset/Detail Comment
Ditto Information
Targeted attacks (APTs etc.)
Information Legal Software People
Violation of laws or Ditto
regulations / Breach of legislation
Failure to meet Ditto
contractual requirements
Unauthorized use of copyrighted material
Table 2: Association between Threats and smart grid Assets
9 December 2013
9 December 2013
Cyber- Employee Hackti- Nation Natural Cyber Corporation Terrorists criminals s vists States Disasters fighters
Physical attacks √ √
Unintentional √ damage
Failures / √ √ √ √ √ Malfunction
Eavesdropping / Interception / √ √ √ √ √ √ √ Hacking
Legal √
Nefarious √ √ √ √ √ √ √ activity / abuse
Outages √ √ √
Damage / Loss √ √ √ √ √ √ √ (IT-Assets)
Disaster √ √
Table 3: Involvement of Threat Agents in the threats
http://krebsonsecurity.com/2013/06/iranian-elections-bring-lull-in-bank-attacks/ , accessed 13 Nov 2013. http://www.dailymail.co.uk/news/article-2313652/AP-Twitter-hackers-break-news-White-Houseexplosions-injured-Obama.html http://www.mcafee.com/us/resources/white-papers/wp-hacktivism.pdf http://mashable.com/2012/08/10/syrian-electronic-army/
9 December 2013
Vast amount of material does exist in this area. The reference give is just an example: http://www.ijarcce.com/upload/2013/july/49-h-marigowdasecurity%20vulnerability%20issues%20in%20wireless.pdf accessed 11 Nov 2013. http://www.tecnalia.com/, accessed 11 Nov 2013. 23
9 December 2013
9 December 2013
http://www- 304.ibm.com/jct03001c/procurement/proweb.nsf/objectdocswebview/filesupply+chain+security+white+pap er+and+assessment+guide+april+2004/$file/supply+chain+security+white+paper+and+assessment+guide+ap ril+2004.pdf, accessed 12 Nov 2013. http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=5452993, accessed 12 Nov 2013. http://ieeexplore.ieee.org/xpl/articleDetails.jsp?reload=true&arnumber=6309314, accessed 12 Nov 2013. http://s3.amazonaws.com/sdieee/207-SG-Threats_Vulns_Countermeasure.pdf, accessed 12 Nov 2013. http://www.smartgrid.gov/sites/default/files/doc/files/2012_Cybersecurity_Information_Exchange.pdf, accessed 12 Nov 2013. http://energy.gov/sites/prod/files/oeprod/DocumentsandMedia/14- AMI_System_Security_Requirements_updated.pdf, accessed 12 Nov 2013. http://www.navigantresearch.com/wp-assets/uploads/2013/03/WP-SG10T-13-Navigant-Research.pdf, accessed 12 Nov 2013. http://www.enisa.europa.eu/activities/Resilience-and-CIIP/critical-infrastructure-and-services/smart-gridsand-smart-metering/appropriate-security-measures-for-smart-grids, accessed 2 Dec 2013. 25
9 December 2013
9 December 2013
9 December 2013
9 December 2013
9 December 2013
19,20 10. Encrypt meter data to protect consumer privacy . 19,20 11. Provide integrity protection and origin authentication of meter data . 12. Provide a means of non‐repudiation for consumer demand response programs . 19,20 13. Physical protection security and tamper-protection . 14. Authenticate and integrity check meter firmware and configuration images when updates are provisioned. It is when firmware is being reprogrammed that devices can be most 19,20 vulnerable . 15. Code Signing. It is a mechanism whereby publishers of software and content can use a certificate-based digital signature to verify their identities to users of the code, thus allowing users to decide whether or not to install it based on whether they trust the publisher . 16. Virtual Home Command Exec. Execute all the commands received from the outside world on itself (Virtual Home Command Exec.) before deploying it on the real environment . 17. Authenticate all commands from the head-end to the customer endpoint. The Head‐End manages the information exchanges between external systems, such as the Meter Data 19,20 Management (MDM) system and the AMI network .` 19,20 18. Authenticate all reporting from the customer endpoint to the head-end . 19,20 19. Protect Head‐End systems as if they were critical cyber assets . 20. Implement host‐based Intrusion Detection with software integrity checking of the Head-End 19,20 systems . 21. Perform frequent, irregularly scheduled audits of Head-End outputs to ensure they reflect inputs . 19,20 22. Use strong user authentication on all Head-End systems and log all user actions . 23. Implement safety logic to prevent rapid changes in pricing information sent from the Head-End 19,20 to the customer endpoint . 9.1.5 Master Terminal Unit (MTU) and Remote Terminal Unit (RTU)’ 1. Security Architecture Design . 2. Security features provided by device and system vendors . 19,20 3. Check regularly and see if there is an abnormal operations taking place . 4. Conducting physical security surveys and assessing all remote sites connected to SCADA Network . 19,20 5. Use of firewalls and Demilitarized Zones (DMZs . 19,20 by 6. Implement electronic Perimeter Control means of a more rigorous scheme to implement network protection beyond IDS and Firewall. 7. Use of Intrusion Detection Systems (external and internal), including Domain-Specific IDS . 19,20 8. Proper implementation of IEC-60870 101, IEC-60870 104, DNP 3.0 and Modbus protocols .
9 December 2013 2. Build a common understanding in security with vendors: standards, testing, checking, audits… 36,40 (Work collaboratively with suppliers to refine security requirements.) . 39,36 3. Evaluation of vendors . 36,40 4. Provide strong contractual language in Request for Proposals (RFPs . 5. Implement the security features provided by device and system vendors. Many SCADA systems (old) in use have no security features whatsoever. SCADA system owners must insist that their system vendor implement security features in the form of product patches or upgrades. Some newer SCADA devices are shipped with basic security features, but these are usually disabled to ensure ease of installation. Analyse each SCADA device to determine whether security features 36,37 are present . 36,40 6. To ensure the secure device design . 7. Develop database of components and too with all the discrete components, though this can be difficult to maintain with thousands of components . 36,39 8. To make available to vendors devices to track end of life of their products . 9. Provide regular feedback for terminal/port operator regarding supply chain security requirements and performance . 10. Test proactively terminal operators’ supply chain security capabilities . 11. Control access to order and shipment information . 12. Inform the consumers of how information collected from them will be used . 13. Provide the consumers with clear instructions on how to use the privacy safeguards offered, such as a secure login and password, as well as how to de-enrol or delete personally identifiable information relating to them . 14. Require verification of carrier and driver prior to allowing entry . 15. Use Radio Frequency (RFDC) to track storage and retrieval of product and movement by employee . 16. Have backup power for key operational areas and high-value cargo areas . 17. Establish alternative source as part of contracting process . 18. Require contractually electronic seals for monitoring access to containers . 19. Employ closed-circuit monitoring of cargo loading process with recordings to be maintained for a specified period . 9.2.2 Distribution and Logistics 1. Include specific supply chain security requirements in contracts as a condition for acceptance . 2. Mandate that suppliers adhere to established standards, help them to do it and supervise periodically . 3. Include appropriate language in contractual agreements to safeguard consumers . 4. Have information regarding customer supply chain security concerns and to develop implications . 5. Work collaboratively with suppliers to refine security requirements . 6. Replicate best practices and results among trading partners . 7. Pre-screen potential suppliers with security capabilities as a major consideration . 31
9 December 2013 8. Demand transparency and visibility across the supply chain . 9. Adequate control in all the points: Supplier, Terminal/Port Operator, Carrier, Customer . 10. Require use of closed-circuit video monitoring of facilities, docks, and cargo . 11. Monitor the process closely during the cargo loading process and transportation journey and record it for a specific period of time . 12. Automate the chain of custody . 13. Record and reports detected deviations from approved transport routes . 14. Secure the cross-border supply chains . 15. Inspect products and containers at the points of origin and maintain cargo integrity . 16. Require Supply Chain Event Management (SCEM) capability to proactively manage transport movements . 17. Use Radio Frequency (RFDC) to track storage and retrieval of product and movement by employee . 18. Have extensive policies such as two drivers, use of GPS, escorted service, driver security training, and route varying for high-risk shipments . 19. Require verification of carrier and driver prior to allowing entry . 20. Require approval by firm security of any deviation from approved transport routes . 21. Require satellite tracking of trucks and containers as a condition of contract . 22. Use tracking and protocols to allow real-time notification of diversion to security and law enforcement . 23. Check systematically containers prior to release for re-use . 24. Have a mode-shifting protocol to accommodate unexpected delays, interruptions and disasters . 25. Plan to guarantee continuous supply of critical components to the customers . 26. Employ backup power supply for operations and security systems . 27. Establish comprehensive metrics for evaluating supply chain security performance and makes them available . 28. Test and review regularly, objectively and proactively carrier supply chain security capabilities and response plans . 29. Perform unannounced inspections/assessments or validation by third party . 30. Acquire comprehensive education regarding the role in enhancing supply chain security . 31. Have a comprehensive “code of ethics” regarding supply chain security practices . 32. Train personnel to observe for signs of employees who might respond to coercion . 33. Require contractually international carriers to transmit electronic crew and cargo manifests . 34. Identify supply chain security education initiatives and have a formal plan for moving employees through the program . 35. Participate actively in cross-organizational initiatives to develop and influence governmental supply chain security policies .
9 December 2013 36. Take active role in initiatives to educate and exchange information with government officials responsible for enhancing supply chain security . 37. Take active role in guiding and providing feedback for government initiatives to enhance supply chain security initiatives . 38. Provide carrier drivers with comprehensive education regarding their role in enhancing supply chain security . 39. Adjust processes based on government security levels . 40. Provide facility security using a combination of passive and active measures including fences, locks, video, and human inspections . 41. Establish an Internet supply-chain-theft report that contains all the information to be reported to law enforcement . 42. Employ redundant communications system for critical incident management . 43. Define procedures and conditions for notifying customs and other law enforcement agencies regarding shortages, overages, anomalies, or illegal activities . 44. Centralize responsibility for supply chain security management with a high-visibility crossfunctional team . 36,41 45. Keep the integrity and confidentiality of system data .
9 December 2013 5. Requires verification of carrier and driver prior to allowing entry . 6. Document receiving discrepancies using electronic and video means . 7. Require matches for production and inventory receipt quantities . 8. Require proper weighing, counting, and documenting of cargo equipment verified against manifest documents .
9 December 2013
9 December 2013
9 December 2013
9 December 2013 o Local Network Access Point (LNAP). o Neighbourhood Network Access Point (NNAP). o External Display. o Home Automation Components. o AMI Head End (Advanced Metering Infrastructure).  Servers: related with hardware, computer hardware that holds the necessary software to run an infrastructure.  Clients: devices from which personal staff, end users and potential clients will connect with available applications: o PC. o Notebook. o Tablet. o ThinClient. o PDA. o (Mobil-)Phone. o Printer. o Smart Appliances and Equipment (Customer): home appliances and devices (i.e., thermostats, pool pumps, clothes washers/dryers, water heaters, etc.) that use wireless technology to receive real-time data from the AMI system to control or modulate their operation.  Network Components: physical devices needed for the correct functioning of the network: o Advanced Interrupting Switch: switches or technologies that can detect and clear faults more quickly or without a traditional reclosing sequence. o Switch. o Router. o Bridge. o Repeater. o Modem. o Gateway. o Firewall. o WLAN Access Point.  Media: physical support to storage the information: o Semiconductor Storage. o Magnetic Storage. o Optical Storage o Paper
9 December 2013 o Human  Displays: devices to present the information to the user: o Monitor o Beamer  Human Interaction Devices (HID): devices to let the user introduce information to the system. o Keyboard o Mouse A main issue talking about hardware is the supply chain. For the critical hardware, the supply chain should be controlled by the owner of the infrastructure.
9 December 2013 vehicles and fleets. Powertrain technologies include full electric vehicles and plug-in hybrids, as well as hydrogen fuel cell vehicles that convert hydrogen into electricity. The main assets are:  Electric Vehicle Charging Station.  Vehicles
9 December 2013
Threat Group Threat Threat details Threat Agent Trend Comments
Physical attack (deliberate/ intentional) Bomb attack / threat Fraud
Fraud by Employees Increasing employees Sabotage Corporations Cybercriminals Employees Hacktivists Nation States Terrorists
Vandalism Employees Terrorists Rioter
Theft (of devices, storage media and documents)
Theft of Corporations Increasing mobile devices Employees (smartphones/ Nation States Stable (theft tablets) Terrorists internal staff) Theft of other Corporations Stable hardware Employees Nation States Terrorists
Information Corporations Increasing leakage/sharing Cybercriminals Employees Hacktivists Nation States Terrorists
Unauthorized Employees physical access / Hacktivists Unauthorised Terrorists
entry to premises
Coercion, extortion Corporations or corruption Cybercriminals Employees Hacktivists Nation States Terrorists
Threats that have been assigned a trend are the ones that have been encountered within the ENISA Threat Landscape 2012.
Terrorists as a Threat Agent: Based on the publicly available information resources, the profile of cyber terrorists still seems to be blurry due to lack of concrete evidence. There are opinions in the literature that cyber criminals and cyber terrorists are involved in similar activities with the difference being solely in their content. On the other hand, it is reported that terrorists are involved mostly in sabotage attacks against high impact targets and their capability resources vary from low to average. Finally, it is often reported that cybercriminals can be engaged by individuals with terroristic motive to perform an attack on their behalf.
9 December 2013
Threat Group Threat Threat details Threat Agent Trend Comments
Unintentional damage (accidental) Information leakage/sharing due to user error
Accidental Employees Increasing leaks/sharing of data by staff Mobile privacy Employees Increasing and mobile applications Web Employees Increasing applications Network Employees Increasing Erroneous use or Overall administration of increasing devices and (additional systems mobile devices)
Decreasing (as Internal threat) Errors in Employees maintenance Configuration/ Employees installation error Technological Employees obsolescence Increasing Employees recover time Unpatched Employees software (delayed patching processes) Using information Employees
from an unreliable source
Unintentional Employees
change of data in an information system
Inadequate design Employees
and planning or lack of adaptation
Disaster (natural, environmental)
Disaster (natural NA
earthquakes, floods, landslides, tsunamis)
Disaster NA
(environmental fire, explosion, dangerous radiation leak)
Fire NA Flood NA Pollution, dust, NA
9 December 2013
Threat Group Threat Threat details Threat Agent Trend Comments
Thunder stroke NA Water NA Unfavourable NA
climatic conditions
Major events in NA
the environment
Damage/Loss (IT Assets)
Damage caused by Security Third party Increasing a third party failure by third provider party Damages resulting Third party from penetration provider
Loss of (integrity Loss of Corporations Increasing of) sensitive integrity of Cybercriminals information certificates Employees Hacktivists Nation States Terrorists
Loss of devices, storage media and documents
Mobile Corporations Increasing devices Cybercriminals Employees Hacktivists Nation States Terrorists
Storage media Corporations Increasing Cybercriminals Employees Hacktivists Nation States Terrorists
Documentatio Corporations n of IT Cybercriminals Infrastructure Employees Hacktivists Nation States Terrorists
Destruction of records, devices or storage media
Infection of Corporations Increasing removable Cybercriminals media Employees Hacktivists Nation States
Abuse of Corporations Increasing storage Cybercriminals Employees Hacktivists Nation States
Information Leakage
Mobile data Corporations increasing and data of Cybercriminals mobile Employees
9 December 2013
Threat Group Threat Threat details Threat Agent Trend Comments
applications Hacktivists Nation States Terrorists
Web privacy Corporations and web Cybercriminals applications Employees Hacktivists Nation States Terrorists Network Corporations increasing traffic Cybercriminals Employees Hacktivists Nation States Terrorists
Failures/ Malfunction Failure of devices or systems
Defective data NA media Hardware NA failure Failure of NA applications and services
Failure or disruption of communication links (communication networks)
Failure of NA cable networks Failure of NA wireless networks Failure of NA mobile networks Failure or NA
disruption of main supply
Failure or NA
disruption of service providers (supply chain)
Malfunction of NA
equipment (devices or systems) Insecure Interfaces (APIs)
Lack of resources NA Loss of electricity NA Absence of NA
Strike NA Loss of support NA
9 December 2013
Threat Group Threat Threat details Threat Agent Trend Comments services
Internet outage NA
Network outage
Outage of NA cable networks Outage of NA wireless networks Outages of NA mobile networks
Eavesdropping/Inter War driving Search and ception/ Hijacking cartography of free Wi-Fi networks with the objective to abuse them. Intercepting Numerous Corporations compromising devices use Cybercriminals emissions air-interfaces Employees (Wi-Fi, Hacktivists Bluetooth, Nation States Infrared, etc.). Terrorists These can be abused.
Interception of information
Corporate Corporations Decreasing Espionage Employees Nation States
Unsecured Wi- Corporations Fi, rogue Cybercriminals access points Employees Hacktivists Nation States Terrorists
Interfering High Corporations radiation frequency Nation States devices (e.g. Terrorists displays) radiate. This information can be misused. Replay of Cybercriminals messages Employees
Network The activity to Corporations To be taken Reconnaissan-ce collect Cybercriminals seriously in and Information sufficient Employees the middle gathering information Hacktivists term. from Nation States legitimate Terrorists channels about the structure of a network. Man in the Corporations Increasing middle/ Session Cybercriminals hijacking Employees Hacktivists
9 December 2013
Threat Group Threat Threat details Threat Agent Trend Comments
Nation States Terrorists
Repudiation of Corporations actions Cybercriminals Employees Hacktivists Nation States Terrorists
Nefarious Activity/ Identity theft Credentials Corporations Overall Identity Abuse stealing Cybercriminals increasing theft, trojans Employees (with some achieved by Hacktivists stability/ exploiting Nation States decrease in existing Terrorists reported vulnerabilitie cases) s via threats, especially Trojans over private PCs.
Unsolicited E-mail
SPAM Cybercriminals Decreasing/ Stable
Unsolicited Cybercriminals Stable/ infected e- Increasing mails
Denial of service
Plain denial of Cybercriminals Increasing service (DoS) Hacktivists (e.g. against application services of critical infrastructure) Distributed Cybercriminals Increasing DoS (DDoS) Hacktivists
Malicious code/ software/ activity
Search Engine Cybercriminals Increasing Poisoning Exploitation of Cybercriminals Increasing fake trust of social media
Worms/Trojan Corporations Increasing s Cybercriminals (strongly for Nation States mobile devices) Mobile Cybercriminals Increasing malware Hacktivists strongly Nation States
Alternation of Corporations Increasing software Cybercriminals Employees Hacktivists Nation States
Infected Corporations trusted mobile Cybercriminals apps Employees Hacktivists Nation States
9 December 2013
Threat Group Threat Threat details Threat Agent Trend Comments
Elevation of Corporations privileges Cybercriminals Hacktivists Nation States
Phishing Corporations Stable/ attacks Cybercriminals Decreasing Employees Hacktivists Nation States Terrorists
Web injection Corporations Increasing attacks (Code Cybercriminals injection: SQL, Hacktivists XSS) Nation States
Exploit Kits Corporations Increasing Cybercriminals Hacktivists Nation States
Social Engineering
Rogue security Cybercriminals Increasing software/ Hacktivists Rogueware/ Scareware
Ransomware Cybercriminals Increasing
Abuse of Information Leakage
Leakage Corporations affecting Cybercriminals mobile privacy Employees and mobile Hacktivists applications Nation States
Leakage Corporations affecting web Cybercriminals privacy and Employees web Hacktivists applications Nation States
Leakage Corporations affecting Cybercriminals network traffic Employees Hacktivists Nation States
Generation and use of rogue certificates
Loss of Corporations Increasing (integrity of) Cybercriminals sensitive Hacktivists information Nation States
Man in the Cybercriminals Increasing middle/ Hacktivists Session Nation States hijacking Social Corporations Increasing Engineering Cybercriminals (e.g. install Employees
9 December 2013
Threat Group Threat Threat details Threat Agent Trend Comments
fake trust OS Hacktivists updates) Nation States
Manipulation of hardware and software
Anonymous Corporations Increasing proxies Cybercriminals Hacktivists Nation States
Abuse of Corporations computing Cybercriminals power of Hacktivists cloud to Nation States launch attacks (cybercrime as a service)
Abuse of 0- Corporations day Cybercriminals vulnerabilities Employees Hacktivists Nation States
Access of web Cybercriminals sites through chains of HTTP Proxies (Obfuscation)
Manipulation of information
Misuse of audit Corporations tools Cybercriminals Employees Hacktivists Nation States
Falsification of records
Misuse of Corporations Increasing information/ Cybercriminals information Employees systems Hacktivists Nation States
Unauthorised use Corporations or administration Cybercriminals of devices and Employees systems Hacktivists Nation States
Unauthorized Network Corporations Stable/ access to the Intrusion Cybercriminals Decreasing information Employees system / network Hacktivists Nation States
Unauthorized Cybercriminals
changes of records
Unauthorized Drive-by Corporations Increasing installation of download / Cybercriminals software malicious URLs Employees Hacktivists Nation States
9 December 2013
Threat Group Threat Threat details Threat Agent Trend Comments
Unauthorized use Corporations of software Cybercriminals Employees Hacktivists Nation States
Compromising Corporations Increasing confidential Cybercriminals information (data Employees breaches) Hacktivists Nation States
Abuse of Corporations Stable/Decre authorizations Cybercriminals asing Employees Hacktivists Nation States
Abuse of personal data
Hoax False rumour Corporations and/or a fake Cybercriminals warning Employees Hacktivists Nation States Terrorists
Badware Spyware or Corporations deceptive Cybercriminals adware Nation States
Remote activity (execution)
Remote Corporations Increasing Command Cybercriminals slowly and Execution Employees steadily Hacktivists Nation States Terrorists
Botnets / Corporations Increasing Remote Cybercriminals activity Employees Hacktivists Nation States Terrorists
Targeted attacks (APTs etc.)
Spear phishing Corporations Increasing attacks Cybercriminals Nation States
Installation of Corporations Stable/ sophisticated Cybercriminals Increasing and targeted Nation States malware
Legal Violation of laws Corporations Increasing or regulations / Cybercriminals Breach of Employees legislation Nation States
Failure to meet Employees
contractual requirements
9 December 2013
Threat Group Threat Threat details Threat Agent Trend Comments
Unauthorized use File Sharing Corporations Increasing of copyrighted services Cybercriminals material Employees Nation States
9 December 2013
SOURCES Smart grid Information Enhancing Security Threat 20 Assurance and Security 21,37,38,39,40,41,42 Threat Threat details NIST Throughout the Supply Other Group 36 Technology Assessment Chain (IBM Center) 19 (Sacramento State) Physical Bomb attack / threat [9.1].1-2 // [9.1].4 // [9.2.1].1 // [9.2.1].7-19 [9.1].1-4 // [9.1].6-11 // [9.1].12 // [9.1].14 // attack [9.1].8 // [9.1].10-17 // // [9.2.2] // [9.2.3].1 // [9.1].13 // [9.1].15 // [9.1].20-22 // [9.1].23 // (deliberate/ [9.1].22 // [9.1].26-29 // [9.2.3].5-8 [9.1].16 // [9.1].17 // [9.1].24 // [9.1].26 // intentional) [9.1].31 // [9.1].33-35 // [2.1.].22-24 // [9.1].26-35 [9.1].28 // [9.1].35 // [9.1.4].13 // [9.2.1].1 // [9.1.4].13 // [9.1.5].4 // [9.2.1].1 // [9.2.2].45-47 // [9.2.2].49 Fraud Cheating customer [9.1].1-2 // [9.1].4 // [9.2.1].1 // [9.2.1].7-19 [9.1].1-4 // [9.1].6-11 // [9.1].12 // [9.1].14 // (Reverse [9.1].8 // [9.1].10-15 // // [9.2.2] // [9.2.3].1 // [9.1].13 // [9.1].15 // [9.1].20-22 // [9.1].24 // engineering) [9.1].22 // [9.1].26-29 // [9.2.3].3 // [9.2.3].5-8 [2.1.].22 // [9.1].24 // [9.1].26 // [9.1].28 // [9.1].31 // [9.1].33-35 // [9.1].26-35 // [9.1.4].13 // [9.1].35 // [9.2.1].1 // [9.1.4].13 // [9.2.1].1 // [9.1.5].4 // [9.2.2].45-47 // [9.2.2].49 [9.2.3].3-4 // [9.2.3].3-4 Cheating companies [9.1].1-2 // [9.1].4 // [9.2.1].1 // [9.2.1].7-19 [9.1].1-4 // [9.1].6-11 // [9.1].12 // [9.1].14 // [9.1].8 // [9.1].10-17 // // [9.2.2] // [9.2.3].1 // [9.1].13 // [9.1].15 // [9.1].20-22 // [9.1].24 // [9.1].22 // [9.1].26-29 // [9.2.3].5-8 [9.1].16 // [9.1].17 // [9.1].26 // [9.1].28 // [9.1].31 // [9.1].33-35 // [2.1.].22 // [9.1].24 // [9.1].35 // [9.2.1].1 // [9.1.4].13 // [9.2.1].1 [9.1].26-35 // [9.1.4].13 // [9.2.2].45-47 // [9.2.2].49 [9.1.5].4 // Sabotage [9.1].1-2 // [9.1].4 // [9.2.1].1 // [9.2.1].7-19 [9.1].1-4 // [9.1].6-11 // [9.1].12 // [9.1].14 // [9.1].8 // [9.1].10-17 // // [9.2.2] // [9.2.3].1 // [9.1].13 // [9.1].15 // [9.1].20-22 // [9.1].23 // [9.1].22 // [9.1].26-29 // [9.2.3].5-8 [9.1].16 // [9.1].17 // [9.1].24 // [9.1].26 // [9.1].31 // [9.1].33-35 // [2.1.].22-24 // [9.1].26-35 [9.1].28 // [9.1].35 // [9.1.4].13 // [9.2.1].1 // [9.1.4].13 // [9.1.5].4 // [9.2.1].1 // [9.2.2].45-47 //
9 December 2013
SOURCES Smart grid Information Enhancing Security Threat 20 Assurance and Security 21,37,38,39,40,41,42 Threat Threat details NIST Throughout the Supply Other Group 36 Technology Assessment Chain (IBM Center) 19 (Sacramento State) [9.2.2].49 Vandalism [9.1].1-2 // [9.1].4 // [9.2.1].1 // [9.2.1].7-19 [9.1].1-4 // [9.1].6-11 // [9.1].12 // [9.1].14 // [9.1].8 // [9.1].10-15 // // [9.2.2] // [9.2.3].1 // [9.1].13 // [9.1].15 // [9.1].20-22 // [9.1].23 // [9.1].17 // [9.1].22 // [9.2.3].5-8 [9.1].17 // [2.1.].22-24 // [9.1].24 // [9.1].26 // [9.1].26-29 // [9.1].31 // [9.1].26-35 // [9.1.4].13 // [9.1].28 // [9.1].35 // [9.1].33-35 // [9.1.4].13 [9.1.5].4 // [9.2.1].1 // [9.2.2].45-47 // // [9.2.1].1 [9.2.2].49 Theft (of devices, [9.1].1-2 // [9.1].4 // [9.2.1].1 // [9.2.1].7-19 [9.1].1-4 // [9.1].6-11 // [9.1].12 // [9.1].14 // storage media and [9.1].8 // [9.1].10-15 // // [9.2.2] // [9.2.3].1 // [9.1].13 // [9.1].15 // [9.1].20-22 // [9.1].23 // documents) [9.1].22 // [9.1].26-29 // [9.2.3].5-8 [2.1.].22-24 // [9.1].26-35 [9.1].24 // [9.1].26 // [9.1].31 // [9.1].33-35 // // [9.1].28 // [9.1].35 // [9.2.1].1 [9.2.1].1 // [9.2.2].45-47 // [9.2.2].49 Information [9.1].1-2 // [9.1].4 // [9.2.1].1 // [9.2.1].7-19 [9.1].1-4 // [9.1].6-11 // [9.1].12 // [9.1].14 // leakage/sharing [9.1].8 // [9.1].10-15 // // [9.2.2] // [9.2.3].1 // [9.1].13 // [9.1].15 // [9.1].19 // [9.1].20-22 // [9.1].22 // [9.1].26-29 // [9.2.3].5-8 [2.1.].22-24 // [9.1].26-35 [9.1].23 // [9.1].24 // [9.1].31 // [9.1].33-35 // // [9.1.4].13 // [9.1.5].4 // [9.1].26 // [9.1].28 // [9.1.4].13 // [9.2.1].1 [9.1].35 // [9.2.1].1 // [9.2.2].45-47 // [9.2.2].49 Unauthorized [9.1].1-2 // [9.1].4 // [9.2.1].1 // [9.2.1].7-19 [9.1].1-4 // [9.1].6-11 // [9.1].12 // [9.1].14 // physical access / [9.1].8 // [9.1].10-16 // // [9.2.2] // [9.2.3].1 // [9.1].13 // [9.1].15 // [9.1].20-22 // [9.1].23 // Unauthorised entry [9.1].22 // [9.1].26-29 // [9.2.3].5-8 [9.1].16 // [2.1.].22-24 // [9.1].24 // [9.1].26 // to premises [9.1].31 // [9.1].33-35 // [9.1].26-35 // [9.1.4].13 // [9.1].28 // [9.1].35 // [9.1.4].13 // [9.2.1].1 [9.1.5].4 // [9.2.1].1 // [9.2.2].45-47 // [9.2.2].49 Coercion, extortion [9.1].1-2 // [9.1].4 // [9.2.1].1 // [9.2.1].7-19 [9.1].1-4 // [9.1].6-11 // [9.1].12 // [9.1].14 // or corruption [9.1].8 // [9.1].10-15 // // [9.2.2] // [9.2.3].1 // [9.1].13 // [9.1].15 // [9.1].19 // [9.1].20-22 // [9.1].17 // [9.1].19 // [9.2.3].5-8 [9.1].17 // [2.1.].22 // [9.1].24 // [9.1].26 // [9.1].22 // [9.1].26-29 // [9.1].24 // [9.1].26-35 // [9.1].28 // [9.1].35 //
9 December 2013
SOURCES Smart grid Information Enhancing Security Threat 20 Assurance and Security 21,37,38,39,40,41,42 Threat Threat details NIST Throughout the Supply Other Group 36 Technology Assessment Chain (IBM Center) 19 (Sacramento State) [9.1].31 // [9.1].33-35 // [9.2.1].1 // [9.2.2].45-47 // [9.2.1].1 [9.2.2].49 Unintention Information [9.1].2 // [9.1].8 // [9.1].2-3 // [9.1].8 // [9.1].12-13 // [9.1].19 // al damage leakage/sharing due [9.1].11-13 // [9.1].15-19 [9.1].11 // [9.1].13 // [9.1].23 (accidental) to user error // [9.1.5].3 [9.1].15-18 // [9.1].23 // [9.1.2].5 // [9.1.3].7 // [9.1.4].15-16 // [9.1.5].3 Erroneous use or [9.1].2 // [9.1].8 // [9.1].2-3 // [9.1].8 // [9.1].12-13 // [9.1].19 // administration of [9.1].11-13 // [9.1].15-19 [9.1].11 // [9.1].13 // [9.1].23 devices and systems // [9.1.5].3 [9.1].15-18 // [9.1].23 // [9.1.2].5 // [9.1.3].7 // [9.1.4].15-16 // [9.1.5].3 Using information [9.1.5].3 [9.1.2].5 // [9.1.3].7 // from an unreliable [9.1.4].15-16 // [9.1.5].3 source Unintentional change [9.1].2 // [9.1].8 // [9.1].2-3 // [9.1].8 // [9.1].12-13 // [9.1].19 // of data in an [9.1].11-13 // [9.1].15-19 [9.1].11 // [9.1].13 // [9.1].23 information system // [9.1.5].3 [9.1].15-18 // [9.1].23 // [9.1.2].5 // [9.1.3].7 // [9.1.4].15-16 // [9.1.5].3 Unintentional loss of [9.1].2 // [9.1].8 // [9.1].2-3 // [9.1].8 // [9.1].12-13 // [9.1].19 // data [9.1].11-13 // [9.1].15-19 [9.1].11 // [9.1].13 // [9.1].23 // [9.1.5].3 [9.1].15-18 // [9.1].23 // [9.1.2].5 // [9.1.3].7 // [9.1.4].15-16 // [9.1.5].3 Inadequate system [9.1].43 [9.1].43 // [9.1.5].1 [9.2.1].6 design and planning or lack of adaptation Lack of awareness [9.1].1 // [9.2.1].1 [9.2.1].1-2 // [9.2.2].1-6 [9.1].1 [9.2.1].1-2
9 December 2013
SOURCES Smart grid Information Enhancing Security Threat 20 Assurance and Security 21,37,38,39,40,41,42 Threat Threat details NIST Throughout the Supply Other Group 36 Technology Assessment Chain (IBM Center) 19 (Sacramento State) // [9.2.2].28-32 Disaster Disaster (natural [9.1].15 // [9.1].17 [9.2.2].24 // [9.2.2].49 [9.1].15 // [9.1].17 [9.2.2].49 (natural, earthquakes, floods, environment landslides, tsunamis) al) Disaster [9.1].15 // [9.1].17 [9.2.2].24 // [9.2.2].49 [9.1].15 // [9.1].17 [9.2.2].49 (environmental - fire, explosion, dangerous radiation leak) Fire [9.1].15 // [9.1].17 [9.2.2].24 // [9.2.2].49 [9.1].15 // [9.1].17 [9.2.2].49 Flood [9.1].15 // [9.1].17 [9.2.2].24 // [9.2.2].49 [9.1].15 // [9.1].17 [9.2.2].49 Pollution, dust, [9.1].15 // [9.1].17 [9.2.2].24 // [9.2.2].49 [9.1].15 // [9.1].17 [9.2.2].49 corrosion Thunder stroke [9.1].15 // [9.1].17 [9.2.2].24 // [9.2.2].49 [9.1].15 // [9.1].17 [9.2.2].49 Water [9.1].15 // [9.1].17 [9.2.2].24 // [9.2.2].49 [9.1].15 // [9.1].17 [9.2.2].49 Unfavourable [9.1].15 // [9.1].17 [9.2.2].24 // [9.2.2].49 [9.1].15 // [9.1].17 [9.2.2].49 climatic conditions Major events in the [9.1].15 // [9.1].17 [9.2.2].24 // [9.2.2].49 [9.1].15 // [9.1].17 [9.2.2].49 environment Animal [9.1].15 // [9.1].17 [9.2.2].24 // [9.2.2].49 [9.1].15 // [9.1].17 [9.2.2].49 Damage/Los Damage caused by a [9.1].1-2 // [9.1].4 // [9.2.1].1 // [9.2.1].7-19 [9.1].1-4 // [9.1].6-11 // [9.1].12 // [9.1].14 // s (IT Assets) third party [9.1].8 // [9.1].10-15 // // [9.2.2] // [9.2.3].1 // [9.1].13 // [9.1].15 // [9.1].20-22 // [9.1].23 // [9.1].22 // [9.1].26-29 // [9.2.3].5-8 [2.1.].22-24 // [9.1].26-35 [9.1].24 // [9.1].26 // [9.1].31 // [9.1].33-35 // // [9.1].28 // [9.1].35 // [9.2.1].1 [9.2.1].1 // [9.2.2].45-47 // [9.2.2].49 Damages resulting [9.1].5 // [9.1].14 // [9.1].5 // [9.1].22-24 // [9.1].14 // [9.1].22 // from penetration [9.1].22 // [9.1].26 // [9.1].26 // [9.1].28-38 // [9.1].23-26 // [9.1].28 // testing [9.1].28-29 // [9.1].31 // [9.1].40-44 // [9.1.1].1-3 // [9.1].35 // [9.1].39 [9.1].33-37 // [9.1].39 // [9.1.2]. 2 // [9.1.3].4-6 //
9 December 2013
SOURCES Smart grid Information Enhancing Security Threat 20 Assurance and Security 21,37,38,39,40,41,42 Threat Threat details NIST Throughout the Supply Other Group 36 Technology Assessment Chain (IBM Center) 19 (Sacramento State) [9.1].42-44 // [9.1.1].1-2 [9.1.3].8 // [9.1.4].3-5 // // [9.1.2]. 2 // [9.1.3].4 // [9.1.4].14 // [9.1.4].17-18 [9.1.4].3-4 // [9.1.4].14 // [9.1.4].20 // [9.1.5].5-8 // [9.1.4].17-18 // [9.1.4].20 // [9.1.5].5-6 // [9.1.5].8 Loss of (integrity of) [9.1].5 // [9.1].8 // [9.1].5-8 // [9.1].10-11 // [9.1].22 // [9.1].24-26 // sensitive information [9.1].10-11 // [9.1].22 // [9.1].24 // [9.1].26 // [9.1].35 // [9.1].39 [9.1].26 // [9.1].33-36 // [9.1].33-36 // [9.1].38 // [9.1].39 // [9.1].43-44 // [9.1].40-41 // [9.1].43-44 [9.1.1].1-2 // [9.1.2].1 // // [9.1.1].1-3 // [9.1.2].1 // [9.1.3].10 // [9.1.4].1 // [9.1.3].2 // [9.1.3].5 // [9.1.4].7-8 // [9.1.4].10- [9.1.3].10 // [9.1.4].1-2 // 11 // [9.1.4].14 // [9.1.4].7-8 // [9.1.4].10-11 [9.1.4].19 // [9.1.5].8 // [9.1.4].14 // [9.1.4].19 // [9.1.5].1-2 // [9.1.5].8 Loss of devices, Media scavenging [9.1].1-2 // [9.1].4 // [9.2.1].1 // [9.2.1].7-19 [9.1].1-4 // [9.1].6-11 // [9.1].12 // [9.1].14 // storage media and [9.1].8 // [9.1].10-15 // // [9.2.2] // [9.2.3].1 // [9.1].13 // [9.1].15 // [9.1].20-22 // [9.1].23 // documents [2.1.].22 // [9.1].26-29 // [9.2.3].5-8 [2.1.].22-24 // [9.1].26-35 [9.1].24 // [9.1].26 // [9.1].31 // [9.1].33-35 // // [9.1].28 // [9.1].35 // [9.2.1].1 [9.2.1].1 // [9.2.2].45-47 // [9.2.2].49 Destruction of [9.1].1-2 // [9.1].4 // [9.2.1].1 // [9.2.1].7-19 [9.1].1-4 // [9.1].6-11 // [9.1].12 // [9.1].14 // records, devices or [9.1].8 // [9.1].10-15 // // [9.2.2] // [9.2.3].1 // [9.1].13 // [9.1].15 // [9.1].20-22 // [9.1].23 // storage media [2.1.].22 // [9.1].26-29 // [9.2.3].5-8 [2.1.].22-24 // [9.1].26-35 [9.1].24 // [9.1].26 // [9.1].31 // [9.1].33-35 // // [9.1].28 // [9.1].35 // [9.2.1].1 [9.2.1].1 // [9.2.2].45-47 // [9.2.2].49 Information Leakage [9.1].1-2 // [9.1].4 // [9.2.1].1 // [9.2.1].7-19 [9.1].1-4 // [9.1].6-11 // [9.1].12 // [9.1].14 //
9 December 2013
SOURCES Smart grid Information Enhancing Security Threat 20 Assurance and Security 21,37,38,39,40,41,42 Threat Threat details NIST Throughout the Supply Other Group 36 Technology Assessment Chain (IBM Center) 19 (Sacramento State) [9.1].8 // [9.1].10-15 // // [9.2.2] // [9.2.3].1 // [9.1].13 // [9.1].15 // [9.1].19 // [9.1].20-22 // [9.1].19 // [2.1.].22 // [9.2.3].5-8 [2.1.].22-24 // [9.1].26-35 [9.1].23 // [9.1].24 // [9.1].26-29 // [9.1].31 // // [9.1.4].13 // [9.1.5].4 // [9.1].26 // [9.1].28 // [9.1].33-35 // [9.1.4].13 [9.1].35 // [9.2.1].1 // // [9.2.1].1 [9.2.2].45-47 // [9.2.2].49 Failures/ Failure of devices or [9.1].2 // [9.1].8 // [9.1].2-3 // [9.1].8 // [9.1].12-13 // [9.1].19 // Malfunction systems [9.1].11-13 // [9.1].15-19 [9.1].11 // [9.1].13 // [9.1].23 // [9.1.2].5 // [9.1.3].7 // [9.1].15-18 // [9.1].23 // [9.1.4].15-16 // [9.1.5].3 [9.1.2].5 // [9.1.3].7 // [9.1.4].15-16 // [9.1.5].3 Failure or disruption [9.1].40 [9.1].42 of communication links (communication networks) Failure or disruption [9.1.3].9 [9.2.1].16 // [9.2.2].26 [9.1.3].9 of main supply Failure or disruption [9.2.1].1 [9.2.1].1 // [9.2.1].4-11 [9.2.1].1-2 // [9.2.1].4-6 // of service providers // [9.2.1].14-19 [9.2.1].8 (supply chain) Malfunction of [9.1].2 // [9.1].8 // [9.1].2-3 // [9.1].8 // [9.1].12-13 // [9.1].19 // equipment (devices [9.1].11-13 // [9.1].15-19 [9.1].11 // [9.1].13 // [9.1].23 or systems) // [9.1.2].5 // [9.1.3].7 // [9.1].15-18 // [9.1].23 [9.1.4].15-16 // [9.1.5].3 //[9.1.2].5 // [9.1.3].7 // [9.1.4].15-16 // [9.1.5].3 Insecure Interfaces [9.1].25 (APIs) Outages Lack of resources [9.2.1].1 [9.2.1].1 // [9.2.1].4-11 [9.2.1].1-2 // [9.2.1].4-6 // // [9.2.1].14-19 [9.2.1].8 Loss of electricity [9.1.3].9 [9.2.1].16 // [9.2.2].26 [9.1.3].9
9 December 2013
SOURCES Smart grid Information Enhancing Security Threat 20 Assurance and Security 21,37,38,39,40,41,42 Threat Threat details NIST Throughout the Supply Other Group 36 Technology Assessment Chain (IBM Center) 19 (Sacramento State) Absence of personnel [9.2.2].1-2 // [9.2.2].25 // [9.2.2].50 Strike [9.2.2].1-2 // [9.2.2].25 // [9.2.2].50 Loss of support [9.2.1].1 [9.2.1].1 // [9.2.1].4-11 [9.2.1].1-2 // [9.2.1].4-6 // services // [9.2.1].14-19 [9.2.1].8 Internet outage [9.1].40 [9.1].42 Network outage [9.1].40 [9.1].42 Lack in the supply [9.2.1].1 [9.2.1].1 // [9.2.1].4-11 [9.2.1].1-2 // [9.2.1].4-6 // line // [9.2.1].14-19 [9.2.1].8 Eavesdroppi War driving [9.1].5 // [9.1].34-35 // [9.1].5 // [9.1].34-35 // [9.1].35 // [9.1].39 // ng/ [9.1].39 // [9.1.1].1-2 // [9.1.1].1-3 // [9.1.5].8 Interception [9.1.5].8 / Hijacking Intercepting, [9.1].5 // [9.1].8 // [9.1].5-8 // [9.1].10-11 // [9.1].14 // [9.1].22 // compromising [9.1].10-11 // [9.1].14 // [9.1].22-24 // [9.1].26 // [9.1].23-26 // [9.1].28 // emissions [9.1].22 // [9.1].26 // [9.1].28-38 // [9.1].40-44 [9.1].35 // [9.1].39 [9.1].28-29 // [9.1].31 // // [9.1.1].1-3 // [9.1.2].1-2 [9.1].33-37 // [9.1].39 // // [9.1.3].2 // [9.1.3].4-6 // [9.1].42-44 // [9.1.1].1-2 [9.1.3].8 // [9.1.3].10 // // [9.1.2].1-2 // [9.1.3].4 [9.1.4].1-5 // [9.1.4].7-8 // // [9.1.3].10 // [9.1.4].1 [9.1.4].10-11 // [9.1.4].14 // [9.1.4].3-4 // [9.1.4].7- // [9.1.4].17-20 // 8 // [9.1.4].10-11 // [9.1.5].1-2 // [9.1.5].5-8 [9.1.4].14 // [9.1.4].17- 20 // [9.1.5].1 // [9.1.5].5-6 // [9.1.5].8 Interception of Hijacking of the [9.1.4].1 // [9.1.4].3-4 // [9.1.4].1-5 // [9.1.4].7-9 // information meter connection [9.1.4].7-9 // [9.1.4].11 [9.1.4].11-20 // [9.1.4].22 // [9.1.4].13-14 //
9 December 2013
SOURCES Smart grid Information Enhancing Security Threat 20 Assurance and Security 21,37,38,39,40,41,42 Threat Threat details NIST Throughout the Supply Other Group 36 Technology Assessment Chain (IBM Center) 19 (Sacramento State) [9.1.4].17-20 // [9.1.4].22 Side-channel attack [9.1.3].9 // [9.1.4].1 // [9.1.3].9 // [9.1.4].1-2 // [9.1.4].8 // [9.1.4].13 [9.1.4].8 // [9.1.4].13 Scanning / Sniffer / [9.1].1-2 // [9.1].4 // [9.1].1-4 // [9.1].11 // [9.1].12 // [9.1].14 // External traffic [9.1].11-14 // [9.1].19 // [9.1].13 // [9.1].23-24 // [9.1].19 // [9.1].23-24 // analyser [9.1].34-37 // [9.1].39 // [9.1].34-38 // [9.1.1].1-3 // [9.1].35 // [9.1].39 // [9.1.1].1-3 // [9.1.4].7 // [9.1.4].7 // [9.1.4].11 [9.1.4].11 Interfering radiation EM /RF Interception. [9.1.3].9 // [9.1.4].1 // [9.1.3].9 // [9.1.4].1-2 // Tempest attack [9.1.4].8 // [9.1.4].13 [9.1.4].8 // [9.1.4].13 Replay of messages Acknowledges [9.1.1].1 // [9.1.4].9 [9.1].38 // [9.1.1].1 // forgery [9.1.4].9 Network [9.1].1-2 // [9.1].4 // [9.1].1-4 // [9.1].11 // [9.1].12 // [9.1].14 // Reconnaissance and [9.1].11-14 // [9.1].19 // [9.1].13 // [9.1].23-24 // [9.1].19 // [9.1].23-24 // Information [9.1].34-37 // [9.1].39 // [9.1].34-38 // [9.1.1].1-3 // [9.1].35 // [9.1].39 // gathering [9.1.1].1-3 // [9.1.4].7 // [9.1.4].7 // [9.1.4].11 [9.1.4].11 Man in the middle/ [9.1].5 // [9.1].8 // [9.1].5-8 // [9.1].10-11 // [9.1].14 // [9.1].22 // Session hijacking [9.1].10-11 // [9.1].14 // [9.1].22-24 // [9.1].26 // [9.1].23-26 // [9.1].28 // [9.1].22 // [9.1].26 // [9.1].28-38 // [9.1].40-44 [9.1].35 // [9.1].39 [9.1].28-29 // [9.1].31 // // [9.1.1].1-3 // [9.1.2].1-2 [9.1].33-37 // [9.1].39 // // [9.1.3].2 // [9.1.3].4-6 // [9.1].42-44 // [9.1.1].1-2 [9.1.3].8 // [9.1.3].10 // // [9.1.2].1-2 // [9.1.3].4 [9.1.4].1-5 // [9.1.4].7-8 // // [9.1.3].10 // [9.1.4].1 [9.1.4].10-11 // [9.1.4].14 // [9.1.4].3-4 // [9.1.4].7- // [9.1.4].17-20 // 8 // [9.1.4].10-11 // [9.1.5].1-2 // [9.1.5].5-8 [9.1.4].14 // [9.1.4].17-
9 December 2013
SOURCES Smart grid Information Enhancing Security Threat 20 Assurance and Security 21,37,38,39,40,41,42 Threat Threat details NIST Throughout the Supply Other Group 36 Technology Assessment Chain (IBM Center) 19 (Sacramento State) 20 // [9.1.5].1 // [9.1.5].5-6 // [9.1.5].8 Repudiation of [9.1].5 // [9.1].11-12 // [9.1].5-7 // [9.1].11 // [9.1].12 // [9.1].26 actions [9.1].26-27 // [9.1].34 // [9.1].26-27 // [9.1].34 // //[9.1].39 [9.1].39-40 // [9.1.1].1-2 [9.1].40 // [9.1.1].1-3 // // [9.1.2].1-4 // [9.1.3].4 [9.1.2].1-4 // [9.1.3].4 // // [9.1.3].10 // [9.1.4].4 [9.1.3].6 // [9.1.3].8 // // [9.1.4].6-8 // [9.1.3].10 // [9.1.4].4 // [9.1.4].11 // [9.1.4].14 // [9.1.4].6-8 // [9.1.4].11-12 [9.1.4].17-18 // // [9.1.4].14-15 // [9.1.4].22 // [9.1.5].8 [9.1.4].17-18 // [9.1.4].22 // [9.1.5].8 Nefarious Identity theft [9.1].5 // [9.1].8 // [9.1].5-8 // [9.1].10-11 // [9.1].14 // [9.1].22 // Activity/ [9.1].10-11 // [9.1].14 // [9.1].22-24 // [9.1].26 // [9.1].23-26 // [9.1].28 // Abuse [9.1].22 // [9.1].26 // [9.1].28-38 // [9.1].40-44 [9.1].35 // [9.1].39 [9.1].28-29 // [9.1].31 // // [9.1.1].1-3 // [9.1.2].1-2 [9.1].33-37 // [9.1].39 // // [9.1.3].2 // [9.1.3].4-6 // [9.1].42-44 // [9.1.1].1-2 [9.1.3].8 // [9.1.3].10 // // [9.1.2].1-2 // [9.1.3].4 [9.1.4].1-5 // [9.1.4].7-8 // // [9.1.3].10 // [9.1.4].1 [9.1.4].10-11 // [9.1.4].14 // [9.1.4].3-4 // [9.1.4].7- // [9.1.4].17-20 // 8 // [9.1.4].10-11 // [9.1.5].1-2 // [9.1.5].5-8 [9.1.4].14 // [9.1.4].17- 20 // [9.1.5].1 // [9.1.5].5-6 // [9.1.5].8 Unsolicited E-mail [9.1].22 // [9.1].26 // [9.1].22 // [9.1].26 // [9.1].26 Anonymous or [9.1.1].1-2 // [9.1.2].4 // [9.1.1].1-3 // [9.1.2].4 // Unsolicited e-mail to [9.1.3].3 // [9.1.4].4 // [9.1.3].3 // [9.1.3].6 // smart grid staff [9.1.5].5 [9.1.4].4 // [9.1.5].5
9 December 2013
SOURCES Smart grid Information Enhancing Security Threat 20 Assurance and Security 21,37,38,39,40,41,42 Threat Threat details NIST Throughout the Supply Other Group 36 Technology Assessment Chain (IBM Center) 19 (Sacramento State) Denial of service [9.1].45 // [9.1.4].9 [9.1].45 // [9.1.4].9 Malicious code/ Exploits / Worms / [9.1].1-2 // [9.1].4 // [9.2.1].1 // [9.2.1].6 // [9.1].1-4 // [9.1].11 // [9.1].12 // [9.1].14 // software/ activity Trojans / Backdoor / [9.1].11-18 // [9.1].22 // [9.2.3].1 [9.1].13 // [9.1].15-18 // [9.1].18-20 // [9.1].22-26 Trapdoor / Targeted [9.1].26 // [9.1].33-37 // [9.1].22 // [9.1].24 // // [9.1].35 // [9.1].39 // attacks (APTs etc.) [9.1].39 // [9.1.1].1-2 // [9.1].26 // [9.1].33-38 // [9.2.1].1 // [9.2.1].6 // [9.1.2].1-4 // [9.1.4].1 // [9.1.1].1-3 // [9.1.2].1-5 // [9.1.4].3-4 // [9.1.4].6 // [9.1.4].1-6 // [9.1.4].20-23 [9.1.4].20 // [9.1.4].22- // [9.1.5].1-3 // [9.1.5]5-7 23 // [9.1.5].1 // [9.1.5].3 // [9.1.5]5-6 // [2.2.1.].1 Service spoofing (ARP [9.1].1-2 // [9.1].4 // [9.2.1].1 // [9.2.1].6 // [9.1].1-4 // [9.1].11 // [9.1].12 // [9.1].14 // spoofing) [9.1].11-18 // [9.1].22 // [9.2.3].1 [9.1].13 // [9.1].15-18 // [9.1].18-20 // [9.1].22-26 [9.1].26 // [9.1].33-37 // [9.1].22 // [9.1].24 // // [9.1].35 // [9.1].39 // [9.1].39 // [9.1.1].1-2 // [9.1].26 // [9.1].33-38 // [9.2.1].1 // [9.2.1].6 // [9.1.2].1-4 // [9.1.4].1 // [9.1.1].1-3 // [9.1.2].1-5 // [9.1.4].3-4 // [9.1.4].6 // [9.1.4].1-6 // [9.1.4].20-23 [9.1.4].20 // [9.1.4].22- // [9.1.5].1-3 // [9.1.5]5-7 23 // [9.1.5].1 // [9.1.5].3 // [9.1.5]5-6 // [2.2.1.].1 ICMP flooding [9.1].1-2 // [9.1].4 // [9.2.1].1 // [9.2.1].6 // [9.1].1-4 // [9.1].11 // [9.1].12 // [9.1].14 // [9.1].11-18 // [9.1].22 // [9.2.3].1 [9.1].13 // [9.1].15-18 // [9.1].18-20 // [9.1].22-26 [9.1].26 // [9.1].33-37 // [9.1].22 // [9.1].24 // // [9.1].35 // [9.1].39 // [9.1].39 // [9.1.1].1-2 // [9.1].26 // [9.1].33-38 // [9.2.1].1 // [9.2.1].6 // [9.1.2].1-4 // [9.1.4].1 // [9.1.1].1-3 // [9.1.2].1-5 // [9.1.4].3-4 // [9.1.4].6 // [9.1.4].1-6 // [9.1.4].20-23 [9.1.4].20 // [9.1.4].22- // [9.1.5].1-3 // [9.1.5]5-7 23 // [9.1.5].1 // [9.1.5].3 // [9.1.5]5-6 // [2.2.1.].1 Social Engineering [9.2.2].32 // [9.2.2].34
9 December 2013
SOURCES Smart grid Information Enhancing Security Threat 20 Assurance and Security 21,37,38,39,40,41,42 Threat Threat details NIST Throughout the Supply Other Group 36 Technology Assessment Chain (IBM Center) 19 (Sacramento State) Abuse of Information [9.1].1-2 // [9.1].4 // [9.2.1].1 // [9.2.1].7-19 [9.1].1-4 // [9.1].6-11 // [9.1].12 // [9.1].14 // Leakage [9.1].8 // [9.1].10-15 // // [9.2.2] // [9.2.3].1 // [9.1].13 // [9.1].15 // [9.1].19 // [9.1].20-22 // [9.1].19 // [9.1].22 // [9.2.3].5-8 [2.1.].22-24 // [9.1].26-35 [9.1].23 // [9.1].24 // [9.1].26-29 // [9.1].31 // // [9.1.4].13 // [9.1.5].4 // [9.1].26 // [9.1].28 // [9.1].33-35 // [9.1.4].13 [9.1].35 // [9.2.1].1 // // [9.2.1].1 [9.2.2].45-47 // [9.2.2].49 Generation and use [9.1].39 [9.1].39 of rogue certificates Manipulation of False data injection in [9.1].5 // [9.1].8 // [9.1].5-8 // [9.1].10-11 // [9.1].14 // [9.1].22 // information: smart grid traffic [9.1].10-11 // [9.1].14 // [9.1].22-24 // [9.1].26 // [9.1].23-26 // [9.1].28 // authenticity [9.1].22 // [9.1].26 // [9.1].28-38 // [9.1].40-44 [9.1].35 // [9.1].39 [9.1].28-37 // [9.1].39 // // [9.1.1].1-3 // [9.1.2].1-2 [9.1].42-44 // [9.1.1].1-2 // [9.1.3].2 // [9.1.3].4-6 // // [9.1.2].1-2 // [9.1.3].4 [9.1.3].8 // [9.1.3].10 // // [9.1.3].10 // [9.1.4].1 [9.1.4].1-5 // [9.1.4].7-8 // // [9.1.4].3-4 // [9.1.4].7- [9.1.4].10-11 // [9.1.4].14 8 // [9.1.4].10-11 // // [9.1.4].17-20 // [9.1.4].14 // [9.1.4].17- [9.1.5].1-2 // [9.1.5].5-8 20 // [9.1.5].1 // [9.1.5].5-6 // [9.1.5].8 Manipulation of Buffer overflow [9.1].16 [9.1].16 // [9.1.2].5 // information: [9.1.4].16 intercept / alter / repudiation Load redistribution [9.1].16 [9.1].16 // [9.1.2].5 // attack [9.1.4].16 Deliver wrong data to [9.1].16 [9.1].16 // [9.1.2].5 // operator station [9.1.4].16 Manipulation data [9.1].16 [9.1].16 // [9.1.2].5 //
9 December 2013
SOURCES Smart grid Information Enhancing Security Threat 20 Assurance and Security 21,37,38,39,40,41,42 Threat Threat details NIST Throughout the Supply Other Group 36 Technology Assessment Chain (IBM Center) 19 (Sacramento State) sent or received [9.1.4].16 to/from TSO or central system Alter meter data, [9.1].5 // [9.1].8 // [9.1].5-8 // [9.1].10-11 // [9.1].22 // [9.1].24-26 // gateway [9.1].10-11 // [9.1].22 // [9.1].24 // [9.1].26 // [9.1].35 // [9.1].39 configuration data, [9.1].26 // [9.1].33-36 // [9.1].33-36 // [9.1].38 // meter configuration [9.1].39 // [9.1].43-44 // [9.1].40-41 // [9.1].43-44 data, CLS [9.1.1].1-2 // [9.1.2].1 // // [9.1.1].1-3 // [9.1.2].1 // configuration data, [9.1.3].10 // [9.1.4].1 // [9.1.3].2 // [9.1.3].5 // etc. [9.1.4].7-8 // [9.1.4].10- [9.1.3].10 // [9.1.4].1-2 // 11 // [9.1.4].14 // [9.1.4].7-8 // [9.1.4].10-11 [9.1.4].19 // [9.1.5].1 // // [9.1.4].14 // [9.1.4].19 [9.1.5].8 // [9.1.5].1-2 // [9.1.5].8 Misuse of audit tools [9.1].20 Falsification of [9.1].5 // [9.1].8 // [9.1].5-8 // [9.1].10-11 // [9.1].14 // [9.1].22 // records [9.1].10-11 // [9.1].14 // [9.1].22-24 // [9.1].26 // [9.1].23-26 // [9.1].28 // [9.1].22 // [9.1].26 // [9.1].28-38 // [9.1].40-44 [9.1].35 // [9.1].39 [9.1].28-29 // [9.1].31 // // [9.1.1].1-3 // [9.1.2].1-2 [9.1].33-39 // [9.1].20-44 // [9.1.3].2 // [9.1.3].4-6 // // [9.1.1].1-2 // [9.1.2].1- [9.1.3].8 // [9.1.3].10 // 2 // [9.1.3].4 // [9.1.3].10 [9.1.4].1-5 // [9.1.4].7-8 // // [9.1.4].1 // [9.1.4].3-4 [9.1.4].10-11 // [9.1.4].14 // [9.1.4].7-8 // // [9.1.4].17-20 // [9.1.4].10-11 // [9.1.5].1-2 // [9.1.5].5-8 [9.1.4].14 // [9.1.4].17- 20 // [9.1.5].1 // [9.1.5].5-6 // [9.1.5].8 Misuse of [9.1].2 // [9.1].8 // [9.1].2-3 // [9.1].8 // [9.1].12-13 // [9.1].19 // information/ [9.1].11-13 // [9.1].15-19 [9.1].11 // [9.1].13 // [9.1].23
9 December 2013
SOURCES Smart grid Information Enhancing Security Threat 20 Assurance and Security 21,37,38,39,40,41,42 Threat Threat details NIST Throughout the Supply Other Group 36 Technology Assessment Chain (IBM Center) 19 (Sacramento State) information systems // [9.1.5].3 [9.1].15-18 // [9.1].23 // [9.1.2].5 // [9.1.3].7 // [9.1.4].15-16 // [9.1.5].3 Unauthorized use or Unauthorized use of [9.1].1 // [9.1].4-5 // [9.1].1 // [9.1].4-8 // // [9.1].12-14 // [9.1].21-22 administration of facilities and [9.1].8 // [9.1].10-15 // [9.1].10-11 // [9.1].13 // // [9.1].24 // [9.1].26 // devices, systems and infrastructure [9.1].22 // [9.1].26-29 // [9.1].15 // [9.1].24 // [9.1].28 // [9.1].39 communications [9.1].31 // [9.1].33-37 // [9.1].26-37 // [9.1].40-41 [9.1].39 // [9.1.1].1-2 // // [9.1.1].1-3 // [9.1.2].2 // [9.1.2].2 // [9.1.2].4 // [9.1.2].4 // [9.1.3].3-10 // [9.1.3].3-4 // [9.1.3].9-10 [9.1.4].4-5 // [9.1.4].7-8 // // [9.1.4].4 // [9.1.4].7-8 [9.1.4].12 // [9.1.4].14 // // [9.1.4].14 // [9.1.4].17-20 // [9.1.5].5-8 [9.1.4].17-20 // [9.1.5].5- 6 // [9.1.5].8 Unauthorized use of [9.1].1 // [9.1].4-5 // [9.1].1 // [9.1].4-8 // // [9.1].12-14 // [9.1].21-22 files and information [9.1].8 // [9.1].10-15 // [9.1].10-11 // [9.1].13 // // [9.1].24 // [9.1].26 // [9.1].22 // [9.1].26-29 // [9.1].15 // [9.1].24 // [9.1].28 // [9.1].39 [9.1].31 // [9.1].33-37 // [9.1].26-37 // [9.1].40-41 [9.1].39 // [9.1.1].1-2 // // [9.1.1].1-3 // [9.1.2].2 // [9.1.2].2 // [9.1.2].4 // [9.1.2].4 // [9.1.3].3-10 // [9.1.3].3-4 // [9.1.3].9-10 [9.1.4].4-5 // [9.1.4].7-8 // // [9.1.4].4 // [9.1.4].7-8 [9.1.4].12 // [9.1.4].14 // // [9.1.4].14 // [9.1.4].17-20 // [9.1.5].5-8 [9.1.4].17-20 // [9.1.5].5- 6 // [9.1.5].8 Unauthorized use of [9.1].1 // [9.1].4-5 // [9.1].1 // [9.1].4-8 // // [9.1].12-14 // [9.1].21-22 software [9.1].8 // [9.1].10-15 // [9.1].10-11 // [9.1].13 // // [9.1].24 // [9.1].26 // [9.1].22 // [9.1].26-29 // [9.1].15 // [9.1].24 // [9.1].28 // [9.1].39 [9.1].31 // [9.1].33-37 // [9.1].26-37 // [9.1].40-41
9 December 2013
SOURCES Smart grid Information Enhancing Security Threat 20 Assurance and Security 21,37,38,39,40,41,42 Threat Threat details NIST Throughout the Supply Other Group 36 Technology Assessment Chain (IBM Center) 19 (Sacramento State) [9.1].39 // [9.1.1].1-2 // // [9.1.1].1-3 // [9.1.2].2 // [9.1.2].2 // [9.1.2].4 // [9.1.2].4 // [9.1.3].3-10 // [9.1.3].3-4 // [9.1.3].9-10 [9.1.4].4-5 // [9.1.4].7-8 // // [9.1.4].4 // [9.1.4].7-8 [9.1.4].12 // [9.1.4].14 // // [9.1.4].14 // [9.1.4].17-20 // [9.1.5].5-8 [9.1.4].17-20 // [9.1.5].5- 6 // [9.1.5].8 Unauthorized access Unauthorized access [9.1.2].1-4 // [9.2.3].3-4 [9.2.3].3 [9.1.1] // [9.1.2].1-4 // [9.2.3].3-4 to the information from customer [9.1.5] /information system endpoint / network Masquerade (gained [9.1.2].1-4 [9.1.1] // [9.1.2].1-4 // access and privileges [9.1.5] escalation) Password attacks [9.1].33 [9.1].33 Unauthorized access [9.1].1 // [9.1].4-5 // [9.1].1 // [9.1].4-8 // // [9.1].12-14 // [9.1].21-22 to the information, [9.1].8 // [9.1].10-15 // [9.1].10-11 // [9.1].13 // // [9.1].24 // [9.1].26 // system or data [9.1].22 // [9.1].26-29 // [9.1].15 // [9.1].24 // [9.1].28 // [9.1].39 [9.1].31 // [9.1].33-37 // [9.1].26-37 // [9.1].40-41 [9.1].39 // [9.1.1].1-2 // // [9.1.1].1-3 // [9.1.2].2 // [9.1.2].2 // [9.1.2].4 // [9.1.2].4 // [9.1.3].3-10 // [9.1.3].3-4 // [9.1.3].9-10 [9.1.4].4-5 // [9.1.4].7-8 // // [9.1.4].4 // [9.1.4].7-8 [9.1.4].12 // [9.1.4].14 // // [9.1.4].14 // [9.1.4].17-20 // [9.1.5].5-8 [9.1.4].17-20 // [9.1.5].5- 6 // [9.1.5].8 Unauthorized remote [9.1].1 // [9.1].4-5 // [9.1].1 // [9.1].4-8 // // [9.1].12-14 // [9.1].21-22 access to SCADA [9.1].8 // [9.1].10-15 // [9.1].10-11 // [9.1].13 // // [9.1].24 // [9.1].26 // systems [9.1].22 // [9.1].26-29 // [9.1].15 // [9.1].24 // [9.1].28 // [9.1].39 [9.1].31 // [9.1].33-37 // [9.1].26-37 // [9.1].40-41
9 December 2013
SOURCES Smart grid Information Enhancing Security Threat 20 Assurance and Security 21,37,38,39,40,41,42 Threat Threat details NIST Throughout the Supply Other Group 36 Technology Assessment Chain (IBM Center) 19 (Sacramento State) [9.1].39 // [9.1.1].1-2 // // [9.1.1].1-3 // [9.1.2].2 // [9.1.2].2 // [9.1.2].4 // [9.1.2].4 // [9.1.3].3-10 // [9.1.3].3-4 // [9.1.3].9-10 [9.1.4].4-5 // [9.1.4].7-8 // // [9.1.4].4 // [9.1.4].7-8 [9.1.4].12 // [9.1.4].14 // // [9.1.4].14 // [9.1.4].17-20 // [9.1.5].5-8 [9.1.4].17-20 // [9.1.5].5- 6 // [9.1.5].8 Unauthorized [9.1].1 // [9.1].4-5 // [9.1].1 // [9.1].4-8 // // [9.1].12-14 // [9.1].21-22 information [9.1].8 // [9.1].10-15 // [9.1].10-11 // [9.1].13 // // [9.1].24 // [9.1].26 // manipulation or [9.1].22 // [9.1].26-29 // [9.1].15 // [9.1].24 // [9.1].28 // [9.1].39 deletion [9.1].31 // [9.1].33-37 // [9.1].26-37 // [9.1].40-41 [9.1].39 // [9.1.1].1-2 // // [9.1.1].1-3 // [9.1.2].2 // [9.1.2].2 // [9.1.2].4 // [9.1.2].4 // [9.1.3].3-10 // [9.1.3].3-4 // [9.1.3].9-10 [9.1.4].4-5 // [9.1.4].7-8 // // [9.1.4].4 // [9.1.4].7-8 [9.1.4].12 // [9.1.4].14 // // [9.1.4].14 // [9.1.4].17-20 // [9.1.5].5-8 [9.1.4].17-20 // [9.1.5].5- 6 // [9.1.5].8 Compromise DCS [9.1].1 // [9.1].4-5 // [9.1].1 // [9.1].4-8 // // [9.1].12-14 // [9.1].21-22 server and disable [9.1].8 // [9.1].10-15 // [9.1].10-11 // [9.1].13 // // [9.1].24 // [9.1].26 // communication with [9.1].22 // [9.1].26-29 // [9.1].15 // [9.1].24 // [9.1].28 // [9.1].39 controllers, [9.1].31 // [9.1].33-37 // [9.1].26-37 // [9.1].40-41 //[9.1].42 manipulate [9.1].39 // [9.1].42 // // [9.1].45 // [9.1.1].1-3 // configuration [9.1].45 //[9.1.1].1-2 // [9.1.2].2 // [9.1.2].4 // parameters of [9.1.2].2 // [9.1.2].4 // [9.1.3].3-10 // [9.1.4].4-5 controllers, or stop [9.1.3].3-4 // [9.1.3].9-10 // [9.1.4].7-9 // [9.1.4].12 communication with // [9.1.4].4 // [9.1.4].7-9 // [9.1.4].14 // [9.1.4].17operator station // [9.1.4].14 // 20 // [9.1.5].5-8 [9.1.4].17-20 // [9.1.5].5-
9 December 2013
SOURCES Smart grid Information Enhancing Security Threat 20 Assurance and Security 21,37,38,39,40,41,42 Threat Threat details NIST Throughout the Supply Other Group 36 Technology Assessment Chain (IBM Center) 19 (Sacramento State) 6 // [9.1.5].8 Compromise RTU [9.1].1 // [9.1].4-5 // [9.1].1 // [9.1].4-8 // // [9.1].12-14 // [9.1].21-22 [9.1].8 // [9.1].10-15 // [9.1].10-11 // [9.1].13 // // [9.1].24 // [9.1].26 // [9.1].22 // [9.1].26-29 // [9.1].15 // [9.1].24 // [9.1].28 // [9.1].39 [9.1].31 // [9.1].33-37 // [9.1].26-37 // [9.1].40-41 [9.1].39 // [9.1.1].1-2 // // [9.1.1].1-3 // [9.1.2].2 // [9.1.2].2 // [9.1.2].4 // [9.1.2].4 // [9.1.3].3-10 // [9.1.3].3-4 // [9.1.3].9-10 [9.1.4].4-5 // [9.1.4].7-8 // // [9.1.4].4 // [9.1.4].7-8 [9.1.4].12 // [9.1.4].14 // // [9.1.4].14 // [9.1.4].17-20 // [9.1.5].5-8 [9.1.4].17-20 // [9.1.5].5- 6 // [9.1.5].8 Violation of the [9.1].5 // [9.1].8 // [9.1].5-8 // [9.1].10-11 // [9.1].22 // [9.1].24-26 // privacy of the [9.1].10-11 // [9.1].22 // [9.1].24 // [9.1].26 // [9.1].35 // [9.1].39 consumer [9.1].26 // [9.1].33-36 // [9.1].33-36 // [9.1].38 // [9.1].39 // [9.1].43-44 // [9.1].40-41 // [9.1].43-44 [9.1.1].1-2 // [9.1.2].1 // // [9.1.1].1-3 // [9.1.2].1 // [9.1.3].10 // [9.1.4].1 // [9.1.3].2 // [9.1.3].5 // [9.1.4].7-8 // [9.1.4].10- [9.1.3].10 // [9.1.4].1-2 // 11 // [9.1.4].14 // [9.1.4].7-8 // [9.1.4].10-11 [9.1.4].19 // [9.1.5].1 // // [9.1.4].14 // [9.1.4].19 [9.1.5].8 // [9.1.5].1-2 // [9.1.5].8 Unauthorized [9.1].1 // [9.1].4-5 // [9.1].1 // [9.1].4-8 // // [9.1].12-14 // [9.1].21-22 changes of records [9.1].8 // [9.1].10-15 // [9.1].10-11 // [9.1].13 // // [9.1].24 // [9.1].26 // [9.1].22 // [9.1].26-29 // [9.1].15 // [9.1].24 // [9.1].28 // [9.1].39 [9.1].31 // [9.1].33-37 // [9.1].26-37 // [9.1].40-41 [9.1].39 // [9.1.1].1-2 // // [9.1.1].1-3 // [9.1.2].2 // [9.1.2].2 // [9.1.2].4 // [9.1.2].4 // [9.1.3].3-10 // [9.1.3].3-4 // [9.1.3].9-10 [9.1.4].4-5 // [9.1.4].7-8 //
9 December 2013
SOURCES Smart grid Information Enhancing Security Threat 20 Assurance and Security 21,37,38,39,40,41,42 Threat Threat details NIST Throughout the Supply Other Group 36 Technology Assessment Chain (IBM Center) 19 (Sacramento State) // [9.1.4].4 // [9.1.4].7-8 [9.1.4].12 // [9.1.4].14 // // [9.1.4].14 // [9.1.4].17-20 // [9.1.5].5-8 [9.1.4].17-20 // [9.1.5].5- 6 // [9.1.5].8 Unauthorized [9.1].1 // [9.1].4-5 // [9.1].1 // [9.1].4-8 // // [9.1].12-14 // [9.1].21-22 installation of [9.1].8 // [9.1].10-15 // [9.1].10-11 // [9.1].13 // // [9.1].24 // [9.1].26 // software [9.1].22 // [9.1].26-29 // [9.1].15 // [9.1].24 // [9.1].28 // [9.1].39 [9.1].31 // [9.1].33-37 // [9.1].26-37 // [9.1].40-41 [9.1].39 // [9.1.1].1-2 // // [9.1.1].1-3 // [9.1.2].2 // [9.1.2].2 // [9.1.2].4 // [9.1.2].4 // [9.1.3].3-10 // [9.1.3].3-4 // [9.1.3].9-10 [9.1.4].4-5 // [9.1.4].7-8 // // [9.1.4].4 // [9.1.4].7-8 [9.1.4].12 // [9.1.4].14 // // [9.1.4].14 // [9.1.4].17-20 // [9.1.5].5-8 [9.1.4].17-20 // [9.1.5].5- 6 // [9.1.5].8 Compromising [9.1].5 // [9.1].8 // [9.1].5-8 // [9.1].10-11 // [9.1].22 // [9.1].24-26 // confidential [9.1].10-11 // [9.1].22 // [9.1].24 // [9.1].26 // [9.1].35 // [9.1].39 information (data [9.1].26 // [9.1].33-36 // [9.1].33-36 // [9.1].38 // breaches) [9.1].39 // [9.1].43-44 // [9.1].40-41 // [9.1].43-44 [9.1.1].1-2 // [9.1.2].1 // // [9.1.1].1-3 // [9.1.2].1 // [9.1.3].10 // [9.1.4].1 // [9.1.3].2 // [9.1.3].5 // [9.1.4].7-8 // [9.1.4].10- [9.1.3].10 // [9.1.4].1-2 // 11 // [9.1.4].14 // [9.1.4].7-8 // [9.1.4].10-11 [9.1.4].19 // [9.1.5].1 // // [9.1.4].14 // [9.1.4].19 [9.1.5].8 // [9.1.5].1-2 // [9.1.5].8 Abuse of [9.1].1 // [9.1].4-5 // [9.1].1 // [9.1].4-8 // // [9.1].12-14 // [9.1].21-22 authorizations [9.1].8 // [9.1].10-15 // [9.1].10-11 // [9.1].13 // // [9.1].24 // [9.1].26 // [9.1].22 // [9.1].26-29 // [9.1].15 // [9.1].24 // [9.1].28 // [9.1].39 [9.1].31 // [9.1].33-37 // [9.1].26-37 // [9.1].40-41
9 December 2013
SOURCES Smart grid Information Enhancing Security Threat 20 Assurance and Security 21,37,38,39,40,41,42 Threat Threat details NIST Throughout the Supply Other Group 36 Technology Assessment Chain (IBM Center) 19 (Sacramento State) [9.1].39 // [9.1.1].1-2 // // [9.1.1].1-3 // [9.1.2].2 // [9.1.2].2 // [9.1.2].4 // [9.1.2].4 // [9.1.3].3-10 // [9.1.3].3-4 // [9.1.3].9-10 [9.1.4].4-5 // [9.1.4].7-8 // // [9.1.4].4 // [9.1.4].7-8 [9.1.4].12 // [9.1.4].14 // // [9.1.4].14 // [9.1.4].17-20 // [9.1.5].5-8 [9.1.4].17-20 // [9.1.5].5- 6 // [9.1.5].8 Remote activity [9.1].11 // [9.1].13-14 // [9.1].11 // [9.1].13 // [9.1] [9.1].13-14 // [9.1].26 // (execution) [9.1] 26-29 // [9.1].31 // 26-33 // [9.1.2].3 // [9.1].28 // [9.1].39 // [9.1].33 // [9.1].39 // [9.1.3].3-10 // [9.1.4]1-5 // [9.1.2].3 // [9.1.3].3-4 // [9.1.4].8 // [9.1.5].1-8 [9.1.3].9-10 // [9.1.4]1 // [9.1.4].3-4 // [9.1.4].8 // [9.1.5].1 // [9.1.5].3 // [9.1.5]5-6 // [9.1.5].8 Communication [9.1.3].9 // [9.1.4].1 // [9.1.3].9 // [9.1.4].1-2 // jamming [9.1.4].8 // [9.1.4].13 [9.1.4].8 // [9.1.4].13 Bypass of devices [9.1].1 // [9.1].4-5 // [9.2.3].3 [9.1].1 // [9.1].4-8 // // [9.1].12-14 // [9.1].21-22 (bypass security [9.1].8 // [9.1].10-15 // [9.1].10-11 // [9.1].13 // // [9.1].24 // [9.1].26 // controls) [9.1].22 // [9.1].26-29 // [9.1].15 // [9.1].24 // [9.1].28 // [9.1].39 // [9.1].31 // [9.1].33-37 // [9.1].26-37 // [9.1].40-41 [9.2.3].3-4 [9.1].39 // [9.1.1].1-2 // // [9.1.1].1-3 // [9.1.2].2 // [9.1.2].2 // [9.1.2].4 // [9.1.2].4 // [9.1.3].3-10 // [9.1.3].3-4 // [9.1.3].9-10 [9.1.4].4-5 // [9.1.4].7-8 // // [9.1.4].4 // [9.1.4].7-8 [9.1.4].12 // [9.1.4].14 // // [9.1.4].14 // [9.1.4].17-20 // [9.1.5].5-8 [9.1.4].17-20 // [9.1.5].5- 6 // [9.1.5].8 // [9.2.3].3- 4
9 December 2013
SOURCES Smart grid Information Enhancing Security Threat 20 Assurance and Security 21,37,38,39,40,41,42 Threat Threat details NIST Throughout the Supply Other Group 36 Technology Assessment Chain (IBM Center) 19 (Sacramento State) Insider attack Hardware, Software PCT manipulation [9.1].1 // [9.1].4-5 // [9.1].1 // [9.1].4-8 // // [9.1].12-14 // [9.1].21-22 and Device [9.1].8 // [9.1].10-15 // [9.1].10-11 // [9.1].13 // // [9.1].24 // [9.1].26 // manipulation [9.1].22 // [9.1].26-29 // [9.1].15 // [9.1].24 // [9.1].28 // [9.1].39 [9.1].31 // [9.1].33-37 // [9.1].26-37 // [9.1].40-41 [9.1].39 // [9.1.1].1-2 // // [9.1.1].1-3 // [9.1.2].2 // [9.1.2].2 // [9.1.2].4 // [9.1.2].4 // [9.1.3].3-10 // [9.1.3].3-4 // [9.1.3].9-10 [9.1.4].4-5 // [9.1.4].7-8 // // [9.1.4].4 // [9.1.4].7-8 [9.1.4].12 // [9.1.4].14 // // [9.1.4].14 // [9.1.4].17-20 // [9.1.5].5-8 [9.1.4].17-20 // [9.1.5].5- 6 // [9.1.5].8 Firmware [9.1.4].14 [9.1.4].14 manipulation Compromise Central [9.1.4].1 // [9.1.4].3-4 // [9.1.3] // [9.1.4].1-6 // Systems to switch off [9.1.4].6 // [9.1.4].8-11 [9.1.4].8-23 // [9.1.5] homes with E- // [9.1.4].13-14 // meters, deletes all [9.1.4].17-20 // keys for the E-meters [9.1.4].22-23 and distribute malicious firmware. Time manipulation [9.1.4].8 //[9.1.4].11 [9.1.4].8 //[9.1.4].11 //[9.1.4].13-14 //[9.1.4].13-14 Legal Violation of laws or [9.1.4].1 // [9.2.1].1 [9.2.1].1-3 // [9.2.2].1-2 [9.1.4].1-2 [9.2.1].1-3 regulations / Breach of legislation Failure to meet [9.1.4].1 // [9.2.1].1 [9.2.1].1-3 // [9.2.1].4 // [9.1.4].1-2 [9.2.1].1-3 // [9.2.1].4 contractual [9.2.1].17-18 // [9.2.2].1requirements 3 // [9.2.2].21 //
9 December 2013
SOURCES Smart grid Information Enhancing Security Threat 20 Assurance and Security 21,37,38,39,40,41,42 Threat Threat details NIST Throughout the Supply Other Group 36 Technology Assessment Chain (IBM Center) 19 (Sacramento State) [9.2.2].33 // [9.2.2].35- 37 // [9.2.2].39 // [9.2.2].52 // [9.2.3].2 Unauthorized use of [9.1.4].1 // [9.2.1].1 [9.2.1].1-3 // [9.2.2].1-2 [9.1.4].1-2 [9.2.1].1-3 copyrighted material
9 December 2013
Name of the Information Information Item (URL Relevance DATE of Item Comments Item/Document or file) (High/Medium/L ow)
http://www.cencenelec 1 M/490 Document base High .eu/STANDARDS/HOTT OPICS/SMARTGRIDS/Pa ges/default.aspx http://ec.europa.eu/inf 2 Documentation on Smart High relevance. It ormation_society/news Grids of DG-CONNECT includes a threat room/cf/dae/itemdetail assessment. .cfm?item_id=9817
3 Documents on Smart Grid http://ec.europa.eu/en High of DG ENERGY ergy/gas_electricity/sm artgrids/taskforce_en.h tm
4 Draft of M/441 on Smart High Meters regarding Privacy and Security approach SM-CG AHWG PS report v0 9.pdf
5 ENISA Documents from Items are available at Medium Mid 2012 last year’s survey ENISA. Can be delivered on demand
6 BSI Protection Profile for https://www.bsi.bund. High March 2013 Smart Meters de/SharedDocs/Downlo ads/DE/BSI/SmartMete r/PP- SmartMeter.pdf?__blo b=publicationFile
7 Crisalis risk assessment High May 2013 Risk Assessment
crisalis_deliverable-D 2.2.pdf
8 Functional reference ftp://ftp.cen.eu/cen/Se Medium December 2011 architecture for ctors/List/Measuremen communications in smart t/Smartmeters/CENCLC metering systems. ETSI_TR50572.pdf (Technical Report http://www.cenelec.eu CEN/CLC/ETSI/TR 50572) /aboutcenelec/whatwe do/technologysectors/s martmetering.html
9 Steps towards http://www.eos- Low November 2011 implementing a European eu.com/files/Document cyber-security strategy s/WhitePapers/Steps_c yber_security.pdf
10 EURACOM (EUropean http://www.eos- Medium 2012 Main Risk Assessment and eu.com/?Page=euraco objectives: Contingency planning m - Promote a Methodologies for
9 December 2013
Name of the Information Information Item (URL Relevance DATE of Item Comments Item/Document or file) (High/Medium/L ow)
interconnected networks) dialogue reports and deliverables between energy and security stakeholders to attend the security of energy infrastructures. - Support European policies for the protection of critical energy infrastructures.
11 Sicherheit im Smart Grid. http://www.stiftungakt Medium 2011 Key elements of Eckpunkte für ein uell.de/files/sr90_siche a smart grid Energieinformationsnetz rheit_im_energieinform security. ationsnetz_gesamt.pdf
12 NISTIR 7628. Guidelines http://csrc.nist.gov/pub High September 2010 for Smart Grid Cyber lications/nistir/ir7628/i Security ntroduction-to-nistir- 7628.pdf
13 Supply Chain Solutions http://www.us- High 2012 Emerging risks for Smart Grid Security: nesco.org/files/2013/01 and supply Building on Business Best /SupplyChain-Solutions- chain solutions. Practices for-Smart-Grid- Business best Security.pdf practices to secure the smart grid supply chain.
14 Smart Grid Cyber http://www.energy.ca. High May 2012 Security. Potential gov/2012publications/C Threats, Vulnerabilities EC-500-2012-047/CECand Risks 500-2012-047.pdf
15 Cisco Smart Grid Security http://www.cisco.com/ Medium 2009 www.cisco.com Solutions web/strategy/docs/ene /go/smartgrid rgy/CiscoSmartGridSec urity_solutions_brief_c 22-556936.pdf
16 Cisco GridBlocks http://www.cisco.com/ Medium 2011 www.cisco.com Reference Model web/strategy/docs/ene /go/smartgrid rgy/gridblocks_ref_mod el.pdf
17 Cisco GridBlocks http://www.cisco.com/ Medium 2012 www.cisco.com Overview web/strategy/docs/ene /go/smartgrid rgy/overview_gba.pdf
18 Smart Grid Security: http://www.aloul.net/P High September 2012 Research paper Threats, Vulnerabilities apers/faloul_ijsgce12.p and Solutions df
9 December 2013
Name of the Information Information Item (URL Relevance DATE of Item Comments Item/Document or file) (High/Medium/L ow)
19 Cyber Attack Exposure http://ieeexplore.ieee.o Medium December 2011 Research paper Evaluation Framework for rg/stamp/stamp.jsp?tp the Smart Grid =&arnumber=6025254
20 Cyber Security and Power http://ieeexplore.ieee.o Medium July 2010 Research paper System Communication— rg/stamp/stamp.jsp?tp Essential Parts of a Smart =&arnumber=5452993 Grid Infrastructure
21 Security Technology for http://ieeexplore.ieee.o Medium June 2010 Research paper Smart Grid Networks rg/stamp/stamp.jsp?tp =&arnumber=5460903
22 Smart-grid security issues http://ieeexplore.ieee.o Medium Feb 2010 Research paper rg/stamp/stamp.jsp?tp =&arnumber=5403159
23 Towards a Framework for http://ieeexplore.ieee.o Medium 2010 Research paper Cyber Attack Impact rg/stamp/stamp.jsp?tp Analysis of the Electric =&arnumber=5622049 Smart Grid
24 Decreased time delay and http://ieeexplore.ieee.o Medium 2010 Specific security enhancement rg/stamp/stamp.jsp?tp Research paper recommendations for =&arnumber=5434780 AMI smart meter networks
25 Smart Grid Privacy via http://ieeexplore.ieee.o Medium 2010 Specific Anonymization of Smart rg/stamp/stamp.jsp?tp Research paper Metering Data =&arnumber=5622050
26 Security and Privacy http://ieeexplore.ieee.o Medium June 2009 Specific Challenges in the Smart rg/stamp/stamp.jsp?tp Research paper Grid =&arnumber=5054916
27 Securing where smart http://www.embedded. Medium May 2013 grids meets SCADA com/design/safety-andsecurity/4413576/4/Sec uring-the-smart-gridand-SCADA
28 Energy measurement and http://www.maximinte Medium Jan 2013 security for the smart grid grated.com/app- – too long overlooked notes/index.mvp/id/55 36
29 Information of EEUU http://www.smartgrid.g High Currently updated initiatives in smart grids. ov/ and http://www.smartgrid.g ov/library
9 December 2013
Name of the Information Information Item (URL Relevance DATE of Item Comments Item/Document or file) (High/Medium/L ow)
30 21 steps to improve cyber 21 Steps to improve CS High Not specified security of SCADA of SCADA networks networks
31 AMI System Security http://energy.gov/sites Medium 17/12/2008 Requirements /prod/files/oeprod/Doc umentsandMedia/14- AMI_System_Security_ Requirements_updated .pdf
32 Industrial control systems Industrial Control Medium 4Q 2012 security Systems Security
33 Infrastructure protection: http://www.homelands Medium 19 august 2013 U.S. power plants, ecuritynewswire.com/d utilities face growing r20130819-u-s-powercyber vulnerability plants-utilities-facegrowing-cybervulnerability
34 Guidelines for Assessing http://collaborate.nist.g Medium February 2011 Wireless Standards for ov/twiki- Smart Grid sggrid/pub/SmartGrid/ PAP02Wireless/NISTIR7 Applications 761.pdf
35 Protecting SCADA devices http://www.embedded. Medium September 2012 from threats and hackers com/design/safety-andsecurity/4397214/Prote cting-SCADA-devicesfrom-threats-andhackers-
36 Recommendations for http://www.etsi.org/W Medium May 2011 smart grid ebSite/document/0905 standardization _RA%20smart%20grids- Bdef.pdf
37 Utility Cyber Security http://www.navigantre Medium 4Q 2011 Research report search.com/wp- Seven Key Smart Grid assets/uploads/2011/1 Security 1/UCS-11-Pike- Trends to Watch in 2012 Research.pdf and Beyond
38 Smart Grid: 10 Trends to http://www.navigantre Medium 1Q 2013 White paper Watch in 2013 and search.com/wp- Beyond assets/uploads/2013/0 3/WP-SG10T-13- Navigant-Research.pdf
39 Smart Grid Information http://ec.europa.eu/en Medium November 2012 Security ergy/gas_electricity/sm artgrids/doc/xpert_gro up1_security.pdf
40 Smart Grid Security: http://s3.amazonaws.c High October 2012 PPT
9 December 2013
Name of the Information Information Item (URL Relevance DATE of Item Comments Item/Document or file) (High/Medium/L ow)
threats, vulnerabilities & om/sdieee/207-SG- presentation potential Threats_Vulns_Counter countermeasures measure.pdf
41 Cyber security in smart http://www.ece.ncsu.e High January 2013 grids - survey and du/netwis/papers/13wl challenges -comnet.pdf
42 2012 DOE Smart Grid http://www.smartgrid.g High December 2012 It shows a Cybersecurity ov/sites/default/files/d summary of Information Exchange oc/files/2012_Cybersec best practices urity_Information_Exch exposed in the ange.pdf event.
43 Smart management is the http://www.embedded. High December 2010 The article key to smart grid meter com/design/connectivit defends the security y/4211457/Smart- smart management-is-the- management key-to-smart-grid- for smart grids. meter-security
44 Supply Chain Solutions US_ResilienceProject High 2012 for Smart Grid Security: Building on Business Best Practices
45 Load Redistribution Load Redistribution Medium 2012 Attacks and Protection Attacks and Protection Strategy in Electric Power Strategy in Electric Systems Power Systems
46 Developing a Solid SCADA DevelopingASolidSCAD Medium 11/2002 Security Strategy ASecurityStrategy
47 Next Generation SCADA NextGenerationSCADAs 2005 Security: Best Practices ecurityBestPracticesAn High and Client Puzzles dClientPuzzles
48 Security as a New SecurityASANewDimens High 2004 Dimension in Embedded ionInEmbeddedSystem System Design Design
49 Enhancing security http://www- High 2004 Throughout the Supply 304.ibm.com/jct03001c Chain /procurement/proweb. nsf/objectdocswebview /filesupply+chain+secur ity+white+paper+and+a ssessment+guide+april+ 2004/$file/supply+chai n+security+white+pape r+and+assessment+guid e+april+2004.pdf
50 Smart grid information http://www.energy.ca. High 2010-2013 assurance and security gov/2013publications/C technology assessment EC-500-2013-056/CEC- 500-2013-056.pdf
9 December 2013
Name of the Information Information Item (URL Relevance DATE of Item Comments Item/Document or file) (High/Medium/L ow)
51 Best practices in the BestPracticesInTheDepl High 2010 deployment of smart oymentOfSmartGridTec grids technologies hnologies
52 Privacy by Design Privacy by Design: High 2010 Achieving the Gold Achieving the gold Standard in Data standard in data Protection for the protection for the smart Smart Grid grid.
53 Embedding Privacy into Embedding privacy in High 2010 Smart Grid Initiatives smart grids
54 Towards Addressing http://ieeexplore.ieee.o High 2012 Common Security Issues rg/xpl/articleDetails.jsp in Smart Grid ?reload=true&arnumbe Specifications r=6309314
9 December 2013

About ENISA

Authors

Contact

Acknowledgements

Executive summary

Table of Contents

Executive summary iv 1 Introduction 1 2 Method 4 3 Smart Grid Assets 6 4 Threats 9 5 Specific Smart Grid Threats 11 6 Smart Grid assets exposure to cyber threats 16 7 Threat agents 21 8 Vulnerabilities and Risks in Smart Grid 23 9 Good Practice of Smart Grid Security Measures 25 10 Conclusions 35

1 Introduction

Policy Context

Target Audience

Structure of this document

2 Method

3 Smart Grid Assets

4 Threats

5 Specific Smart Grid Threats

6 Smart Grid assets exposure to cyber threats

7 Threat agents

8 Vulnerabilities and Risks in Smart Grid

9 Good Practice of Smart Grid Security Measures

9.1 IT Systems and Logical Networks

9.2 Supply Chain

10 Conclusions

Annex A: Description of Smart Grid assets

Annex B: Threats assumed for Smart Grid assets

Annex C: Good Practices: protection against the Threats

Annex D: Collected Information: Inventory of Smart Grid Documents

Fotnoter