Tabulating Cybersecurity Solutions for Substations: Towards Pragmatic Design and Planning

Tan, Heng Chuan; Cheh, Carmen; Chen, Binbin; Mashima, Daisuke

doi:10.1109/isgt-asia.2019.8881706

Cited by 21 publications

(9 citation statements)

References 31 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The next point of attack will be the devices and data flowing in between them. In order to enhance cybersecurity, various defense mechanisms such as zoning (physical or network) of power system, securing communication protocols as per IEC 62351, intruder detection system (IDS) based on statistics, machine learning (ML) [18] with integration of artificial intelligence (AI) [19], remote attestation (software or hardware based), deception technology such as honeypots and incident response (basically damage control after the attack) can be deployed by weighing in their advantages and demerits [20]. Machine learning techniques and algorithms provide efficient results when applied to network traffic for anomaly detection [21].…”

Section: Discussion On Cybersecurity Solutionsmentioning

confidence: 99%

A novel methodology to validate cyberattacks and evaluate their impact on power systems using real time digital simulation

Hussain

Iqbal

Zanero

et al. 2021

2021 IEEE Texas Power and Energy Conference (TPEC)

View full text Add to dashboard Cite

The traditional power systems are rapidly digitalized and automated for increased monitoring and control. This automation of power system communication has made it possible to monitor and control operations remotely in a plant. However, this also opens up an exploitation vector for attackers, after they gain access to the substation network. This scenario can only be investigated through an in-depth study of communication protocols and control authority concepts associated with power system. IEC 61850 has emerged as the most popular protocol for power system communication. In this paper, we investigate realtime simulation of power systems with IEC 61850 based communication, in order to devise a testbed that can be used to validate false data injection cyberattacks and evaluate their impact. Based on the results, we discuss possible countermeasures to such attacks and outline future research directions.

show abstract

Section: Discussion On Cybersecurity Solutionsmentioning

confidence: 99%

A novel methodology to validate cyberattacks and evaluate their impact on power systems using real time digital simulation

Hussain

Iqbal

Zanero

et al. 2021

2021 IEEE Texas Power and Energy Conference (TPEC)

View full text Add to dashboard Cite

show abstract

“…Many security solutions have been proposed and developed in the literature [16,23,48] to secure ICS. This section discusses some of them and explains why they are not suitable for addressing our security goals.…”

Section: Review Of Existing Security Solutionsmentioning

confidence: 99%

“…An intrusion detection system (IDS) is a system used to detect unauthorized intrusions into a system or network [32,40,48]. It is an important means of defense against cyber attacks in ICS.…”

Section: Intrusion Detection Systemmentioning

confidence: 99%

Position Paper: On Using Trusted Execution Environment to Secure COTS Devices for Accessing Industrial Control Systems

Ye¹,

Tan²,

Mashima³

et al. 2021

Preprint

Self Cite

View full text Add to dashboard Cite

Industrial Control Systems (ICS) are traditionally designed to operate in an "air-gapped" environment. With the advent of digital technologies, many ICS are adopting IT solutions to improve interoperability and operational efficiency. Thus, the air-gap assumption no longer holds in practice. Most ICS devices today are modernized with networking capabilities to facilitate system maintenance, upgrades, and troubleshooting. Since these devices are connected to the Internet, ICS networks face the same security threats as regular IT systems. In addition, ICS operators can connect commercial off-the-shelf (COTS) equipment to ICS networks to perform operational tasks. Those COTS devices are usually personal computers or even mobile devices, which can be infected with malware and become weapons against ICS. In this position paper, we examine the design challenges of establishing trust between COTS equipment and ICS. We also present some commonly used security solutions and discuss their deployment challenges due to issues caused by legacy systems. Finally, we introduce the Trusted Execution Environment (TEE), a technology commonly available on modern COTS devices, as a trust anchor for establishing secure communications with the ICS infrastructure. We discuss some research gaps related to the use of TEE and propose some recommendations to guide future research.

show abstract

“…For instance, in the power grid domain, IEC 62351 standards [1] have been proposed by International Electrotechnical Commission (IEC) to define security specification for communication protocols such as IEC 61850, IEC 60870-5-104, and so forth. Moreover, cybersecurity technologies are proposed for securing modernized power grid systems, starting from intrusion detection systems to remote attestation [2]. However, as illustrated by Tan [2], each technology has advantages and disadvantages, and no single solution is perfect.…”

Section: Introductionmentioning

confidence: 99%

“…Moreover, cybersecurity technologies are proposed for securing modernized power grid systems, starting from intrusion detection systems to remote attestation [2]. However, as illustrated by Tan [2], each technology has advantages and disadvantages, and no single solution is perfect. Thus, it is desired to combine multiple, heterogeneous cybersecurity solutions that are complementary to each other, realizing defense in depth.…”

Section: Introductionmentioning

confidence: 99%

MITRE ATT&CK Based Evaluation on In-Network Deception Technology for Modernized Electrical Substation Systems

Mashima

2022

Sustainability

Self Cite

View full text Add to dashboard Cite

In recent years, cyber attacks against critical infrastructure have been increasing and are becoming stealthy and persistent. Attackers or malware may be hiding in the system after penetration to collect system information. They would further make lateral and vertical movement to seek target devices under the radar of existing cybersecurity measures. In order to counter such emerging attack vectors, in-network deception technology is attracting attention. In-network deception technology utilizes an apparently real but dummy (often virtual) devices deployed throughout the infrastructure to capture the attackers’ reconnaissance activities. In this paper, we pick one concrete design and implementation of in-network deception technology for IEC 61850 standard compliant smart substation systems in smart grid, named DecIED, and discuss its effectiveness in countering high-profile attacks that were recently witnessed in the real world. The evaluation is conducted based on the MITRE ATT&CK Matrix for industrial control systems, which tabulates phases and tactics of cyberattack against industrial control systems.

show abstract

Tabulating Cybersecurity Solutions for Substations: Towards Pragmatic Design and Planning

Cited by 21 publications

References 31 publications

A novel methodology to validate cyberattacks and evaluate their impact on power systems using real time digital simulation

A novel methodology to validate cyberattacks and evaluate their impact on power systems using real time digital simulation

Position Paper: On Using Trusted Execution Environment to Secure COTS Devices for Accessing Industrial Control Systems

MITRE ATT&CK Based Evaluation on In-Network Deception Technology for Modernized Electrical Substation Systems

Contact Info

Product

Resources

About