Leszczyna Cybersecurity in the Electricity Sector

Managing Critical Infrastructure
1. Auflage 2019
ISBN: 978-3-030-19538-0
Verlag: Springer International Publishing
Format: PDF
Kopierschutz: 1 - PDF Watermark

E-Book, Englisch, 221 Seiten

This book offers a systematic explanation of cybersecurity protection of electricity supply facilities, including discussion of related costs, relevant standards, and recent solutions. The author explains the current state of cybersecurity in the electricity market, and cybersecurity standards that apply in that sector. He then offers a systematic approach to cybersecurity management, including new methods of cybersecurity assessment, cost evaluation and comprehensive defence. This monograph is suitable for practitioners, professionals, and researchers engaged in critical infrastructure protection.

Autoren/Hrsg.

Leszczyna, Rafal

Leszczyna, Rafa?

Inhaltsverzeichnis

1;Preface;5
2;Acknowledgements;6
3;Contents;7
4;Acronyms;12
5;Chapter 1 Introduction;14
5.1;1.1 Transformation;14
5.1.1;1.1.1 Smart Grid;16
5.1.2;1.1.2 Internet of Energy;19
5.1.3;1.1.3 Industrial CPS, Industrial Cloud, Industry 4.0 and Industrial Internet;20
5.2;1.2 Dependence on the ICT;21
5.3;1.3 Cybersecurity;22
5.4;1.4 Priority Critical Infrastructure;24
5.5;1.5 The Structure of This Book;25
5.6;References;26
6;Chapter 2 The Current State of Cybersecurity in the Electricity Sector;31
6.1;2.1 Introduction;31
6.2;2.2 Studies;32
6.2.1;2.2.1 ENISA Study on the Security of Smart Grids;32
6.2.1.1;2.2.1.1 Research methodology and scope;32
6.2.1.2;2.2.1.2 Results, key findings and recommendations;33
6.2.1.3;2.2.1.3 Impact;34
6.2.2;2.2.2 ENISA Study on the Security of IACS;35
6.2.3;2.2.3 Other Studies;37
6.3;2.3 Vulnerabilities;39
6.3.1;2.3.1 Vulnerabilities Brought in by IACS;39
6.3.1.1;2.3.1.1 Insecure communication protocols;40
6.3.1.2;2.3.1.2 Broad use of commodity software and devices;40
6.3.1.3;2.3.1.3 Increased utilisation of IP-based network connections, vast connectivity;41
6.3.1.4;2.3.1.4 Limited or ineffective network segmentation;41
6.3.1.5;2.3.1.5 Limited applicability of standard (ICT-oriented) cybersecurity solutions;42
6.3.1.6;2.3.1.6 Increased availability of technical specifications of IACS;42
6.3.2;2.3.2 Smart Meters as a Point of Exposure to Cyberattacks;43
6.3.3;2.3.3 Misconfigured Firewalls and Firewall Limitations;44
6.3.4;2.3.4 Insecure Communication Protocols and Devices;44
6.3.5;2.3.5 Use of TCP/IP-Based and Wireless Communication;45
6.3.6;2.3.6 Vast Use of Commodity Software and Devices;46
6.3.7;2.3.7 Physical Exposure;46
6.4;2.4 Threats;47
6.4.1;2.4.1 Data Injection Attacks Against State Estimation;48
6.4.2;2.4.2 DoS and DDoS;49
6.4.3;2.4.3 Targeted Attacks, Coordinated Attacks, Hybrid Attacks, Advanced Persistent Threats;51
6.5;2.5 Challenges;52
6.5.1;2.5.1 Specific Properties and Environmental Constraints of Power Systems;53
6.5.2;2.5.2 Complexity;54
6.5.3;2.5.3 Secure Integration of Legacy Systems and Proprietary Systems;54
6.5.4;2.5.4 Privacy;55
6.5.5;2.5.5 Limitations in the Application of Cryptography;56
6.5.6;2.5.6 Hindered Key Management;57
6.5.7;2.5.7 Lack of Awareness;58
6.5.8;2.5.8 Marginal Exchange of Information;58
6.5.9;2.5.9 Security in the Supply Chain;59
6.6;2.6 Initiatives;60
6.7;2.7 Future Directions;60
6.8;References;67
7;Chapter 3 Cybersecurity Standards Applicable to the Electricity Sector;71
7.1;3.1 Introduction;71
7.2;3.2 Literature Search;72
7.3;3.3 Literature Analysis;73
7.4;3.4 Standards’ Selection and Evaluation Criteria;73
7.5;3.5 Results;74
7.5.1;3.5.1 Standards with Security Controls;74
7.5.2;3.5.2 Standards Defining Cybersecurity Requirements;76
7.5.3;3.5.3 Standards Describing Cybersecurity Assessment Methods;78
7.5.4;3.5.4 Standards Addressing Privacy Issues;80
7.6;3.6 Most Relevant Standards;80
7.6.1;3.6.1 NISTIR 7628;81
7.6.2;3.6.2 ISO/IEC 27001 and ISO/IEC 27000 Series;82
7.6.3;3.6.3 IEC 62351;83
7.6.4;3.6.4 NERC CIP;84
7.6.5;3.6.5 IEEE 1686;85
7.6.6;3.6.6 ISA/IEC 62443 (ISA 99);85
7.7;3.7 Standards’ Limitations;88
7.8;3.8 Standards’ Implementation and Awareness;90
7.9;References;92
8;Chapter 4 A Systematic Approach to Cybersecurity Management;99
8.1;4.1 Introduction;99
8.2;4.2 Cybersecurity Management Approaches in Standards;100
8.2.1;4.2.1 NERC CIP;100
8.2.2;4.2.2 IEC 62443-2-1;102
8.2.3;4.2.3 NIST SP 800-82;110
8.2.4;4.2.4 NISTIR 7628;112
8.2.5;4.2.5 ISO/IEC 27001;114
8.2.6;4.2.6 ISO/IEC 27019;117
8.2.7;4.2.7 NIST SP 800-53;119
8.2.8;4.2.8 NRC RG 5.71;121
8.2.9;4.2.9 NIST SP 800-64;123
8.2.10;4.2.10 NIST SP 800-124;123
8.3;4.3 The Systematic Approach to Cyberseurity Management in the Electricity Sector;126
8.3.1;4.3.1 Cybersecurity Programme Establishment;126
8.3.1.1;4.3.1.1 Developing a business rationale for cybersecurity;126
8.3.1.2;4.3.1.2 Obtaining the management’s support and funding;127
8.3.1.3;4.3.1.3 Building a cybersecurity team;128
8.3.1.4;4.3.1.4 Defining the scope of cybersecurity management;128
8.3.1.5;4.3.1.5 Defining policies and procedures;129
8.3.1.6;4.3.1.6 Identifying assets;129
8.3.1.7;4.3.1.7 Categorising cyberassets;130
8.3.2;4.3.2 Risk Assessment;130
8.3.3;4.3.3 Risk Treatment;133
8.3.3.1;4.3.3.1 Risk modification;133
8.3.3.2;4.3.3.2 Risk sharing;133
8.3.3.3;4.3.3.3 Risk avoidance;134
8.3.3.4;4.3.3.4 Risk retention;134
8.3.4;4.3.4 Cybersecurity Assessment, Monitoring and Improvement;134
8.3.5;4.3.5 Communication and Consultation;135
8.4;References;136
9;Chapter 5 Cost of Cybersecurity Management;138
9.1;5.1 Introduction;138
9.2;5.2 Economic Studies;140
9.3;5.3 Organisation Management Studies;141
9.4;5.4 Cost-Benefit Analysis;143
9.4.1;5.4.1 I-CAMP and I-CAMP II;143
9.4.2;5.4.2 SAEM;144
9.4.3;5.4.3 SQUARE;145
9.5;5.5 Cost Calculators;145
9.6;5.6 Costing Metrics;145
9.6.1;5.6.1 NPV;146
9.6.2;5.6.2 RR;146
9.6.3;5.6.3 ROI;146
9.6.4;5.6.4 ALE;146
9.6.5;5.6.5 Cost of Vulnerability Mitigation;147
9.7;5.7 CAsPeA;147
9.7.1;5.7.1 Selected and Adapted Costing System;148
9.7.2;5.7.2 List of Activities;149
9.7.3;5.7.3 Cost Centres and Activity Cost Drivers;150
9.7.4;5.7.4 Input Data;152
9.7.5;5.7.5 Output Data;153
9.8;5.8 Chapter Summary;154
9.9;References;155
10;Chapter 6 Cybersecurity Assessment;159
10.1;6.1 Introduction;159
10.2;6.2 Security Assessment Methods for the Electricity Sector;161
10.3;6.3 Cybersecurity Testbeds for Power Systems;163
10.3.1;6.3.1 National SCADA Test Bed;163
10.3.2;6.3.2 DETERLab;163
10.3.3;6.3.3 PowerCyber Testbed and Other Academic, Hybrid Testbeds;164
10.3.4;6.3.4 ERNCIP Inventory of Laboratories;164
10.4;6.4 JRC Cybersecurity Assessment Method;165
10.4.1;6.4.1 Analysis of Networks, Systems and Assets;165
10.4.2;6.4.2 Reproduction of Networks, Systems and Cyberassets in a Cybersecurity Laboratory;166
10.4.3;6.4.3 Determination and Analysis of Usage Patterns;167
10.4.4;6.4.4 Design of Experiments;167
10.4.5;6.4.5 Performance of Experiments;168
10.4.6;6.4.6 Analysis of Results;168
10.5;6.5 Laboratory Infrastructure;169
10.5.1;6.5.1 Mirrored System;169
10.5.2;6.5.2 Threat and Attack Centre;170
10.5.3;6.5.3 Observer Terminal;172
10.5.4;6.5.4 Vulnerabilities and Countermeasures Repository;173
10.5.5;6.5.5 Testbed Master Administrator;174
10.5.6;6.5.6 Horizontal Services;175
10.6;6.6 MAlSim;176
10.6.1;6.6.1 Mobile Agents;177
10.6.2;6.6.2 JADE;178
10.6.3;6.6.3 MAlSim Architecture;179
10.6.4;6.6.4 Malware Templates;180
10.6.5;6.6.5 Experiments’ Life Cycle;186
10.7;References;186
11;Chapter 7 Cybersecurity Controls;190
11.1;7.1 Introduction;190
11.2;7.2 Standard Technical Solutions;193
11.2.1;7.2.1 Cryptographic Mechanisms;193
11.2.2;7.2.2 Key Management;195
11.2.3;7.2.3 Identification, Authentication and Authorisation;197
11.2.4;7.2.4 Access Control;198
11.2.5;7.2.5 Firewalls;199
11.2.6;7.2.6 Intrusion Detection and Prevention Systems;200
11.3;7.3 Information Sharing Platform on Cybersecurity Incidents for the Energy Sector;203
11.3.1;7.3.1 Anonymisation Mechanisms;204
11.3.2;7.3.2 Cybersecurity Requirements and Measures;204
11.3.3;7.3.3 Data Model;205
11.3.4;7.3.4 Data Sanitisation Rules;206
11.4;7.4 Situation Awareness Network;208
11.4.1;7.4.1 Architecture;209
11.4.2;7.4.2 Security Requirements for Sensors;210
11.4.3;7.4.3 Event Correlation Rules;211
11.4.4;7.4.4 Testing Metrics;212
11.5;References;213
12;Chapter 8 Conclusions;219
12.1;8.1 Challenges;219
12.2;8.2 Solutions;220
12.3;8.3 Systematic Cybersecurity Management;220