Smart Grid Security and Defensive Military Architecture of the Middle- ages; an Interesting Comparison

We need to start looking more at the low-voltage grid

Of course, the focus on any defence is to protect the points where the most damage can be done if successfully attacked. The SCADA systems of the high and medium voltage grid have received the attention and budgets they deserve due to their asset value and centralised position in the supply of energy. The same focus needs to be applied to the low-voltage grids so that the latest ICT industry honed security practices are implemented in this domain because:

• Even if there are no records of attacks on the low-voltage grids that does not mean there are no attacks or intelligence gathering activities
•The cost of implementing traditional protection mechanisms or regulatory compliance-based security features in the low-voltage grid need not be a major blocker with the introduction of advanced threat detection solutions.

The result has been to develop a semi-static position, just like a castle, where the focus is on building protection mechanisms. Whilst not quite “set in stone” like in the castle, the cost and effort required to adapt existing defences to face new threats can be prohibitive.

The important point is to recognise a threat, a change in the level of threat, or whether an attack is taking place. Without evidence of threat or attack, the only option is to make assumptions: either there is no threat or attack (the optimistic view), or the information gathering attacks being mounted by cyber-attackers are completely successful, and the potential victims are unaware they are taking place.

Will regulatory standards make me secure?

Several countries and international bodies are implementing stringent new security practices which the equipment vendor is responsible for complying with. Of course, these help as they establish a minimum set of defences and should be applied where possible even if not mandated.

However, certifications are public and help the cyber-attacker in two ways:
•They will know what to expect and may have attack methods from other industries that they know to have been successful against similar or identical forms of defence.
•They will know what to avoid, and so they do not waste time on the harder defences, and look instead for the gaps.

The cyber-attackers are agile and will quickly establish and then possibly publicise potential or actual weaknesses.

Reliance purely on certifications may also lead to other deficiencies:

• Certifications are “point in time”; whilst cyber-security should be a process of continuous assessment and improvement. Furthermore, there is a risk that cyber-security budgets are consumed on compliance, and so starve the on-going and continuous nature of cyber-security of funds

How to improve the security of our castle

So, we have built a castle using all the perimeter defences that we can. We have used as much technology as is practical, limited by the cost, available time, infrastructure age and other limiting factors.

Let’s start by assuming that the perimeter is not perfect – the castle walls may have loop-holes that can’t be blocked or that we don’t even know about and the locks are too expensive to replace in this year’s budget. OK, so let’s start by putting cheap trip-wires outside the castle so that we know about reconnaissance and preparatory activity beyond our walls and can be prepared for an attack. That way, we know about the threat and can sensibly respond to a change in underlying threat level.

Let’s now develop ways that we can see the attackers in more detail from the trip-wires they hit, learn something of their intentions, assess the threat they pose and even identify who they are. This way, we know if this is a reconnaissance expedition or a major attack, and can then respond accordingly.

Let’s now assume that someone can get in and so there is a need to put trip-wires within the castle walls. Maybe, we put more where we think we are weak, but we also put some where we believe ourselves to be stronger just in case we are wrong.

Finally, let’s develop mechanisms to limit the damage that can be done; trap-doors that slam shut to limit the access the attacker has to more vulnerable parts. Sure, that might make life harder for the defenders in the short-term (as some of their flexibility may be limited), but it is far worse for the attacker, as their means of exploitation has been blocked.

A practical solution – Protect, Detect and Respond

NES Grid Watch provides advanced analytics and threat detection that have been developed for specific low-voltage smart grid security threats and attacks. This identifies specific types of security incidents, which may indicate cyber-attacker reconnaissance, preparations for attacks, actual attacks, and successful penetrations. These capabilities are deployed out-of-the-box and immediately available – there is no need to enter a major development programme to create these analytics capabilities.

Through Grid Watch, you obtain visibility of the activities of cyber-attackers, for multiple attack scenarios including:
• Denial of service, power outages
• Derailment of operational and business algorithms, Billing, Operations
• Ransom, of customer information, of corporate information, of assets and of service.

NES Grid Watch sits “on-top” of your smart grid infrastructure, monitoring incidents from the information you are probably already receiving from the smart grid and providing you with a far more refined and focused assessment of your current threat level and changes in that threat level. By integrating this information with your SIEM, you can embed an appreciation of the low-voltage smart grid threat level into the wider context to protect yourself from multi-vector attacks.

With Grid Watch, you have added threat detection and response to complement your protection mechanisms, and you can now start looking at how to respond to the inevitable successful attack on your defences.

Protect. Detect. Respond!