# Presentation: 346390

## EMS Cyber Security

- Dennis Holstein, OPUS PublishingJay Wack, TecSec

- 2006-08-19

## Good news – Bad News

- Standards have greatly improved interoperability and use of EMS data
- Insider cyber attack is getting easier
- Disable EMS system operation
- Steal EMS information
- DHS is aggressively sponsoring research to find solutions

- 2006-08-19

## Clear statement of need

- Asset owners want a comprehensive solution – not stove pipe or band aids
- Business case needs to address
- How to recover cost
- Liability exposure
- Technical wizardry doesn’t sell
- Foundational requirements are addressed

- 2006-08-19

## 7 foundational requirements

**AC: Access Control - “Control**_** **__**access to**_** selected devices, information or both to protect against unauthorized interrogation of the device or information.”**
**UC: Use Control –“Control **_**use of**_** selected devices, information or both to protect against unauthorized operation of the device or use of information.”**
**DI: Data Integrity- “Ensure the integrity of data on selected communication channels to protect against unauthorized changes.”**
**DC: Data Confidentiality – “Ensure the confidentiality of data on selected communication channels to protect against eavesdropping.”**
**RDF: Restrict Data Flow – “Restrict the flow of data on communication channels to protect against the publication of information to unauthorized sources.”**
**TRE: Timely Response to Event – “Respond to security violations by notifying the proper authority, reporting needed forensic evidence of the violation, and automatically taking timely corrective action in mission critical or safety critical situations.”**
**NRA: Network Resource Availability - “Ensure the availability of all network resources to protect against denial of service attacks.”**

- 2006-08-19

## The devil is in the details

- Solutions require cooperation between IT and Operations
- Security policies must be extensible to accommodate operational constraints
- Central control (IT) with distributed execution (OPS) is the preferred approach
- Timely response to Event involves everyone
- Access and Use control is extremely important
- The subject of this paper
- HSARPA initiative: TecSec, GE, OPUS & INL

- 2006-08-19

## ANSI X9.69 defines the core technology for RBAC

- X9.69 originally designed for the financial industry
- ANSI X9.73, X9.93 and X9.96 included
- Currently being adopted as an ISO standard (ISO 22895)
- Applied successfully to selected critical infrastructure sectors

- 2006-08-19

## Cryptographic-based schema

- Protect EMS/SCADA commands
- Protect data residing in any EMS repository
- Control requires legitimate privileges
- Access to data
- Use of data
- Minimal changes to EMS software and data repositories

- 2006-08-19

## Cool! How does this work?

- Control who has access to what using Role Based Access Control (RBAC) & Granular Encryption
- Provide physical & logical access control through Smart TokensTM and Cryptography
- Integrate the solution into existing business systems and processes

- 2006-08-19

## Encryption – logical view

**CKM****®**** Combiner**

**Random Value**

**Maintenance Value**

**Domain Value**

- Token

**Credential Pairs**

**Cred 1 Public**

**Cred 1 Private**

**Cred 2 Public**

**Cred 2 Private**

- 2006-08-19

## RBAC roles & credentials

- Roles are established by function/responsibility in Communities of Interest (COI)
- A Role is defined by a set of credentials
- Each credential represents an attribute
- Credentials may be further refined by access mode:
- Read
- Write
- Individuals who are assigned to more than one Role may be issued multiple credentials reflecting those information access needs
- Individuals assigned the same role, and thus having the same credentials, share the ability to access the same information

- 2006-08-19

## Example of who needs what

**@ = access to only that business entity’s own data**

- 2006-08-19

## A typical XA/21TM SCADA/EMS

- Substation RTU

**Control Center – XA/21TM SCADA/EMS**

- Substation RTU

- FEPs

- Substation RTU

- Other
- Control Center

- Local ES

- AP Nodes

- ICCP

- Remote ES

- Any network connection

- 2006-08-19

## SCADA/EMS Security Implementation

- 2006-08-19

## GE has verified security

- All XA/21 programs are digitally signed before being installed on the operational system
- XA/21 validates the digital signature prior to execution and will abort application if it has not been digitally signed
- Every application that directly issues a supervisory control request requires a CKM® token with **write** access to a Supervisory Control role
- Every system operator that will be performing supervisory control requires a personal CKM® token with **write** access to a Supervisory Control role
- Special logic present in SCS messages to transparently ‘pass’ (proxy) access control information from originating source
- SVC logic in the Front End Processors have a CKM® token that grants it **read** access to Supervisory Control ACL
- SVC checks all supervisory control requests – if they were not issued by authorized actor in the Supervisory Control ACL, it will log and reject the request.

- SVC: Supervisory ControlACL: Access Control Logic

- 2006-08-19

**Notes:**
SVC - Supervisory Control  ... application in the Data Acquisition (DAC) Front End Processor (FEP) that performs supervisory control requests.  EG:  Trip a breaker, Issue a jog point, set a setpoint value, etc.

SCS - System Communication Subsystem ... the fundamental message communication infrastructure of XA/21.  It provides an API that insulates any application from sending/receiving messages to other applications without needed to know "where" that application is executing.  Includes both point to point and multicast message capability.  Queuing via shared memory, comprehensive process scheduling, etc.

## The next steps

- Test security implementation in XA/21 at Idaho National Labs
- Commercialize as an option for future XA/21 release
-  Implement CKM-based security in other SCADA/EMS systems
- Current efforts are underway with Siemens
- Additional efforts to include this approach in the PJM Power Grid Architecture w/ NERC
- Continue field testing CKM-based security in utility operational environments

- 2006-08-19

**Notes:**
PJM Interconnection and Siemens Power Transmission & Distribution, Inc. have announced that they will work together to define and develop a secure architecture and open messaging platform for modern, large-scale energy management and market management systems. The project mission is to reduce the total cost of ownership by establishing standardization of technology.
The development of an open messaging architecture is consistent with recommendations from the Federal Energy Regulatory Commission, as published interfaces reduce the need to develop unique, individualized solutions, and create the opportunity for cost savings for large-scale electric power system operators such as regional transmission organizations and independent system operators as well as their customers.
PJM and Siemens will develop a scalable, service-oriented architecture (SOA) for large energy management/market management systems promoting interoperability that cannot be found in proprietary, legacy systems. The SOA-based system will provide a common approach for software applications and computer-based infrastructure to exchange data and information. The common approach will allow technology from other vendors to communicate and interoperate without special adaptation. The benefits for large grid operators are lower costs and greater flexibility to meet evolving customer needs.
"PJM has always been a leader in the area of energy management and market systems and this project endorses Siemens' technology and innovation along with the evolution of Energy Management Systems towards a component-based open architecture, and we see this project as a key step towards industry standardization," said Dave Pacyna, Siemens Power Transmission and Distribution Inc. president and chief executive officer. 
Initially, this architecture will be deployed at PJM's planned second control center and will elevate PJM's energy and market management systems to the next generation. This technology also is intended to be available to other regional grid operators and industry stakeholders.
PJM oversees the world's largest centrally dispatched electric grid and wholesale electric energy marketplace. Under PJM's control center program, PJM plans to have two control centers. Normal operations would be split between the two locations. As planned, either center will be prepared to run all electric system and market operations to provide business continuity. The two-control-center configuration is more effective and efficient than a simple backup control room.
"Standards-based, open systems will lower the costs to acquire, operate and maintain energy management and markets systems that support safe, secure and reliable operations and promote efficient marketplaces," said Karl V. Pfirrmann, PJM senior vice president.
Transmission grid operators also will be able to install these applications in a modular fashion. The new architecture services will permit providers of energy management and market applications to achieve operational efficiencies and will stimulate innovation and competition in development of related applications.

## Thank you for your attention

- Dennis Holstein
- _[holsteindk@adelphia.net](mailto:holsteindk@adelphia.net)_
- 562-716-4174
- Jay Wack
- _[jayw@tecsec.com](mailto:jayw@tecsec.com)_
- 703-744-8447

- 2006-08-19