NISTIR 7916

Proceedings of the Cybersecurity in CyberPhysical Systems Workshop,

April 23 – 24, 2012

Editor:

Tanya Brewer

http://dx.doi.org/10.6028/NIST.IR.7916
NISTIR 7916

Proceedings of the Cybersecurity in CyberPhysical Systems Workshop,

April 23 – 24, 2012

Editor:

Tanya Brewer

Computer Security Division

Information Technology Laboratory

http://dx.doi.org/10.6028/NIST.IR.7916

February 2013

U.S. Department of Commerce

Rebecca M. Blank, Acting Secretary of Commerce and Deputy Secretary of Commerce

National Institute of Standards and Technology

Patrick D. Gallagher, Under Secretary of Commerce for Standards and Technology and Director
NISTIR 7916

Reports on Computer Systems Technology 

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology 

(NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation’s 

measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL’s responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in Federal information systems.

Authority

This publication has been developed by NIST to further its statutory responsibilities under the Federal 

Information Security Management Act (FISMA), Public Law (P.L.) 107-347. NIST is responsible for developing information security standards and guidelines, including minimum requirements for Federal information systems, but such standards and guidelines shall not apply to national security systems without 

the express approval of appropriate Federal officials exercising policy authority over such systems. This 

guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular 

A-130, Section 8b(3), Securing Agency Information Systems, as analyzed in Circular A-130, Appendix 

IV: Analysis of Key Sections. Supplemental information is provided in Circular A-130, Appendix III, Security of Federal Automated Information Resources.

Nothing in this publication should be taken to contradict the standards and guidelines made mandatory 

and binding on Federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other Federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution 

would, however, be appreciated by NIST. 

National Institute of Standards and Technology Interagency Report 7916

276 pages (February 2013)

 

Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply 

recommendation or endorsement by NIST, nor is it intended to imply that the entities, materials, or 

equipment are necessarily the best available for the purpose.

There may be references in this publication to other publications currently under development by NIST 

in accordance with its assigned statutory responsibilities. The information in this publication, including 

concepts and methodologies, may be used by Federal agencies even before the completion of such 

companion publications. Thus, until each publication is completed, current requirements, guidelines, 

and procedures, where they exist, remain operative. For planning and transition purposes, Federal 

agencies may wish to closely follow the development of these new publications by NIST.

Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. All NIST publications, other than the ones noted above, are available at 

http://csrc.nist.gov/publications.
NISTIR 7916

Abstract

Proceedings of the Cybersecurity in Cyber-Physical Workshop, April 23 – 24, 2012, complete with abstracts and slides from presenters. Some of the cyber-physical systems covered during the first day of the 

workshop included networked automotive vehicles, networked medical devices, semi-conductor manufacturing, and cyber-physical testbeds. Day two of the workshop covered the electric smart grid. Dr. Farnham Jahanian, NSF, was the keynote speaker on day one.

Keywords

CPS; cyber-physical systems; cybersecurity; networked automotive vehicles; networked medical devices; 

semi-conductor manufacturing

Acknowledgements

The editor would like to thank Suzanne Lightman, Kevin Stine (both NIST), and Mark Enstrom (Neustar) 

for being reviewers for this document.
NISTIR 7916

Table of Contents

1. Introduction ..............................................................................................................................1

2. Opening Remarks.....................................................................................................................2

3. Implantable Medical Devices – Cyber Risks and Mitigation Approaches...............................9

4. Safety-Critical Automotive and Industrial Data Security......................................................25

5. Keynote Speaker: Dr. Farnham Jahanian ...............................................................................45

6. Security Challenges and Requirements for Control Systems in the 

Semiconductor Manufacturing Sector....................................................................................72

7. Keynote Speaker: Tom Dion .................................................................................................94

8. Application of Dynamic System Models and State Estimation 

Technology to the Cyber Security of Physical Systems.........................................................96

9. Challenges of Cybersecurity Research in a Multi-user Cyber-Physical 

Testbed .................................................................................................................................119

10. Security of power grids: a European perspective .................................................................135

11. Understanding the Role of Automated Response Actions to Improve AMI 

Resiliency .............................................................................................................................157

12. Cyber-Physical Systems Security for the Smart Grid ..........................................................189

13. State Estimation and Contingency Analysis of the Power Grid in a CyberAdversarial Environment .....................................................................................................215

14. False Data Injection Attacks in Smart Grid: Challenges and Solutions...............................241

15. Conclusion............................................................................................................................269
NISTIR 7916

[This page left intentionally blank.]
NISTIR 7916

1

1. Introduction

Cyber-Physical Systems (CPS) are hybrid networked cyber and engineered physical elements codesigned to create adaptive and predictive systems for enhanced performance.

1, 2 These smart 

systems present a key opportunity to create a competitive advantage for U.S. industrial innovation and to improve the performance and reliability of new and existing systems. From smart 

manufacturing and the electric smart grid, to smart structures and transportation systems, CPS 

will pervasively impact the economy and society. 

Cybersecurity is a critical cross-cutting discipline that provides confidence that cyber-physical 

systems, their information, and supporting communications and information infrastructures are 

adequately safeguarded. CPS are increasingly being utilized in critical infrastructures and other 

settings. However, CPS have many unique characteristics, including the need for real-time 

response and extremely high availability, predictability, and reliability, which impacts cybersecurity decisions. 

NIST is currently working in several CPS areas, including the electric smart grid, smart 

manufacturing, smart buildings, and networked automobiles. This work is being led by the 

Engineering Laboratory (EL), but also includes the Physical Measurement Laboratory (PML) 

and the Information Technology Laboratory (ITL). ITL has a number of key areas of expertise 

that are important to the evolution of CPS−interoperability, usability, reliability, and security. 

Since 2009, NIST has been very active in the area of the smart grid. ITL has been very active, 

providing leadership and expertise in a number of relevant areas, including communication 

networks, timing, and cybersecurity. ITL’s Computer Security Division (CSD) has provided 

leadership and expertise to the Smart Grid Interoperability Panel’s Cyber Security Working 

Group. Leveraging our broad expertise in relevant areas, we are now looking at the broader 

landscape of cyber-physical systems, and how cybersecurity fits into that landscape.

CSD hosted a two-day workshop to explore CPS cybersecurity needs, with a focus on research 

results and real-world deployment experiences. On the first day, speakers addressed CPS across 

multiple sectors of industry (e.g., automotive, healthcare, semi-conductor manufacturing). The 

second day focused on cyber security needs of CPS in the electric smart grid. 

This document provides abstracts and corresponding slides from the plenary presentations at the 

workshop.

3

 1 For more information on this definition, please see George Arnold’s slides from the workshop. 2 Performance metrics include safety and security, reliability, agility and stability, efficiency and sustainability. 3 The website for the event is at http://www.nist.gov/itl/csd/cyberphysical-workshop.cfm, and the agenda is available 

at http://csrc.nist.gov/news_events/cps-workshop/cps-workshop-agenda_04-03-2012.pdf. The agenda document 

has links to electronic copies of the abstracts and slides.
NISTIR 7916

2

2. Opening Remarks

George W. Arnold, DESc

National Coordinator, Smart Grid Interoperability

Director, Cyber-Physical Systems

Engineering Laboratory

NIST

Dr. Arnold joined the National Institute of Standards and Technology (NIST) in September 2006 

as Deputy Director, Technology Services, after a 33-year career in the telecommunications and 

information technology industry. He was appointed National Coordinator for Smart Grid Interoperability at in April 2009. He has been responsible for leading the development of standards 

underpinning the nation’s Smart Grid. In October 2011, Dr. Arnold added an additional role as 

Director of Cyber Physical Systems within NIST’s Engineering Laboratory (EL). Anticipating 

and meeting the measurement science and standards needs for technology-intensive manufacturing construction, and cyber-physical systems in ways that enhance economic prosperity and improve the quality of life , EL promotes U.S. innovation and industrial competitiveness in areas of 

critical national priority.

Dr. Arnold served as Chairman of the Board of the American National Standards Institute (ANSI), a private, non-profit organization that coordinates the U.S. voluntary standardization and 

conformity assessment system, from 2003 to 2005. He served as President of the IEEE Standards 

Association in 2007-2008 and as Vice President-Policy for the International Organization for 

Standardization (ISO) from 2006-2009 where he was responsible for guiding ISO’s strategic 

plan.

Dr. Arnold previously served as a Vice-President at Lucent Technologies Bell Laboratories 

where he directed the company’s global standards efforts. His organization played a leading role 

in the development of international standards for Intelligent Networks and IP-based Next Generation Networks. In previous assignments at AT&T Bell Laboratories he had responsibilities in 

network planning, systems engineering, and application of information technology to automate 

operations and maintenance of the nationwide telecommunications network.

Dr. Arnold received a Doctor of Engineering Science degree in Electrical Engineering and Computer Science from Columbia University in 1978. He is a Fellow of the IEEE.
NISTIR 7916

3
NISTIR 7916

4
NISTIR 7916

5
NISTIR 7916

6
NISTIR 7916

7
NISTIR 7916

8
NISTIR 7916

9

3. Implantable Medical Devices – Cyber Risks and 

Mitigation Approaches

Sarbari Gupta

Electrosoft Services

Reston, Virginia USA

sarbari@electrosoft-inc.com

Abstract—Over the past decade, there has been an explosion in 

the deployment of implantable medical devices (IMDs) to facilitate the management and treatment of a wide variety of human 

health conditions. While functionality and patient safety requirements have driven new generation IMDs to be increasingly 

accessible through wireless communication channels, these 

changes cause significant concern in terms of increased risk from 

cyber threats whether malicious or unintentional. This paper 

investigates the risks associated with such devices from the cyber 

environment and proposes approaches to support decisions regarding the integration of adequate security and privacy 

measures to mitigate these risks. 

Keywords-medical devices; security, privacy, cyber, risks

I. Introduction

Deployment rates for implantable medical devices (IMDs) 

have skyrocketed over the past decade. Devices such as pacemakers, cardiac defibrillators, heart monitors, cochlear implants, insulin pumps, infusion pumps and other similar devices 

are routinely used to monitor and treat a plethora of medical 

conditions. These IMDs have been increasingly accessible 

through wireless channels to support functions such as emergency extraction of patient health history, remote monitoring of 

health status, firmware updates and local as well as remote 

therapy reprogramming. As with all things connected to the 

cyber world, there are known and unknown threats lurking that 

threaten the reliability and safety of these devices as well the 

privacy of patients who depends on them. 

II.Regulation of Implantable Medical Devices 

Within the United States, the Food and Drug Administration (FDA) regulates the manufacturers, importers and resellers 

of these devices through the Center for Devices and Radiological Health (CDRH). A review of a sampling of FDA testing 

guidance (e.g. for implantable cardiac pacemakers) reveals that 

the “tests are designed to reasonably assure safe and effective 

functioning of the pacemaker in the patient, according to written specifications of performance, and its survival under expected environmental conditions in the body and during storage, shipping and handling” [1]. FDA testing guidelines do not 

appear to address the resistance and resilience of these devices 

in the face of cyber attacks. 

III. Review of Recent Research

Halperin et al have shown that a recent (2003) model of 

implantable cardioverter defibrillator (ICD), designed to communicate wirelessly with an external programmer in the 175 

kHz frequency range, is vulnerable to several radio-based attacks that threaten patient safety and privacy [2]. Several other 

research papers have pointed out similar vulnerabilities to 

cyber threats and possible mitigation mechanisms [3, 4, 5, 6]. 

IV. Security Analysis of IMDs

IMDs are tiny computing platforms that run firmware in extremely power constrained environments. They offer data storage for static data (such as device information), relatively static 

data (such as patient identification, medical condition, therapy 

configuration) and dynamic data (such as recent patient readings and audit logs). IMDs offer wireless access for read and 

write operations to the data on the IMD (including the firmware) to a variety of stakeholders and roles. 

A. Threats, Vulnerabilities and Risks

Some of the threats to wireless IMDs include device reprogramming, data extraction, data tampering, repeated access 

attempts and data flooding. Vulnerabilities include unsecured 

communication channels, inadequate authentication and access 

control, weak audit mechanisms and meager storage. The resulting risks include patient safety compromise resulting from 

firmware malfunction or therapy misconfiguration, device unavailability due to battery power depletion, patient privacy loss 

due to data leakage to unauthorized parties, and inappropriate 

medical follow-up due to tampering of patient readings. While 

some cyber threats may be unintentional, various motivations 

exist for deliberate cyber attacks, such as patient information 

gathering, negative impact to patient health status, ego satisfaction of the attacker, as well as gaining competitive advantage 

over another vendor through negative press. 

B. Impact of Security Compromise

Identification of the various data types within an IMD is an 

essential step in analyzing the security and privacy risks of 

such devices. Possible data types include firmware (though 

technically not “data”), device identification data, patient identification and health condition data, therapy configuration data, 

patient readings, audit log data, and other data. 

Following identification of the different data types within 

the IMD, it is useful to conduct a security categorization using 

the approach described in FIPS 199 [7]. For each data type, the 

security analyst asks the question: “What is the impact (High, 

Moderate or Low) of a compromise to the confidentiality, in-
NISTIR 7916

10

tegrity and availability of this type of data?” It is useful to collect the results of this analysis in a table format. 

C. Authentication and Access Control Mechanisms

For each type of data identified, the authentication and access control mechanisms applicable for extracting or updating 

the data type need to be reviewed to determine adequacy of the 

protection mechanisms while balancing the needs of patient 

safety in emergency situations and the utility of the IMD within 

a patient’s environment. This is a non-trivial exercise since the 

security and privacy requirements for IMDs frequently conflict 

with the requirements stemming from emergency access to 

patient data and device utility in hospital and home settings. 

Creative approaches may be devised to decouple data essential 

for patient safety in emergency conditions from patient personally identifiable information/data to allow different authentication and access control mechanisms to apply to each group of 

data. Alternately, identifying different modes of operation 

(such as home health setting versus open environment versus 

emergency situation) to allow the IMD to apply different authentication and access control mechanisms in different modes. 

D. Cryptographic Techniques

Cryptographic techniques are potentially very useful to improve the security and privacy properties of IMDs through 

stronger authentication protocols and (confidentiality and integrity) protected communications over wireless channels. However, since IMDs operate in very constrained environments 

(such as device size, cost, and power availability,) traditional 

cryptographic techniques and protocols may be inappropriate. 

More compatible cryptographic suites and protocols need to be 

devised for use on IMDs and applied in a very selective manner 

to optimize the security protection from these power intensive 

operations. The body of research conducted for cryptography 

for sensor networks are directly applicable [8] to applying 

cryptographic techniques to IMDs. 

E. Audit Mechanisms

Audit logs are essential for tracking patient history and 

IMD behavior over a period of time. The audit records provide 

information needed for adequate patient care as well as updates 

to patient therapy delivered through the IMD. Given the limited 

storage capabilities of IMDs, it is possible to overflow the audit 

logs through certain types of attacks on the IMD. Creative 

techniques for selective overwriting of audit records based on 

significance of each type of audit record may be useful. Alert 

mechanisms when audit log storage space nears depletion may 

also be useful for alerting the patient or the remote monitoring 

facility so that appropriate steps can be taken in a timely manner prior to audit space exhaustion. 

V.Summary and Next Steps

Implantable medical devices pose a number of security and 

privacy risks even while providing essential medical support 

functions such as patient monitoring and treatment delivery. 

With the proliferation of IMDs of various types, it is essential 

to understand the risks from cyber threats, and integrate sufficient protections and controls to balance patient safety and device utility with security and privacy risks. 

Some of the possible next steps in this area include (i) applying risk assessment methods to better understand the threat 

model and risks applicable to each type of IMD, (ii) performing 

security categorization analyses to various data types to guide 

optimal grouping of data to better protect each data group and 

apply appropriate cryptographic techniques when appropriate, 

(iii) development of guidelines for development, delivery, configuration, and monitoring of IMDs, and (iv) targeted regulation of IMDs by the FDA CDRH (in the United States) to improve protection against cyber risks. . 

References

[1] “Implantable Pacemaker Testing Guidance,” found at 

http://www.fda.gov/downloads/MedicalDevices/DeviceRegulationandG

uidance/GuidanceDocuments/UCM081382.pdf.

[2] D. Halperin, et al, “Pacemakers and Implantable Cardiac Defibrillators: 

Software Radio Attacks and Zero-Power Defenses,” Proceedings of the 

2008 IEEE Symposium on Security and Privacy, Oakland, CA, 2008.

[3] D. Halperin et al, “Security and Privacy for Implantable Medical 

Devices,” in Pervasive Computing, Vol. 7, No. 1, January–March 2008.

[4] S. Capkun, “On Secure Access to Medical Implants,” Workshop on 

Security and Privacy in Implantable Medical Devices, Lausanne, 

Switzerland, April, 2011.

[5] S. Cherukuri, K. Venkatasubramanian, and S. Gupta, “BioSec: A 

Biometric Based Approach for Securing Communication in Wireless 

Networks of Biosensors Implanted in the Human Body,” Proc. Int’l 

Conf. Parallel Processing (ICPP)Workshops, IEEE CS Press, 2003, pp. 

432–439.

[6] T. Denning, et al “Patients, pacemakers, and implantable defibrillators: 

human values and security for wireless implantable medical devices,” 

Proceedings of the 28th international conference on Human factors in 

computing systems, ACM New York, NY, USA, 2010, pp 917-926.

[7] National Institute of Standards and Technology “FIPS Pub 199: 

Standards for Security Categorization of Federal Information and 

Information Systems,” FEDERAL INFORMATION PROCESSING 

STANDARDS PUBLICATION, February 2004.

[8] S. Fischer and M. Zitterbart, “Security in Sensor Networks,” Information 

Technology: Vol. 52, No. 6, 2010, pp. 311-312.
NISTIR 7916

11
NISTIR 7916

12
NISTIR 7916

13
NISTIR 7916

14
NISTIR 7916

15
NISTIR 7916

16
NISTIR 7916

17
NISTIR 7916

18
NISTIR 7916

19
NISTIR 7916

20
NISTIR 7916

21
NISTIR 7916

22
NISTIR 7916

23
NISTIR 7916

24
NISTIR 7916

25

4. Safety-Critical Automotive and Industrial 

Data Security

André Weimerskirch

ESCRYPT Inc.

Ann Arbor, MI, USA

andre.weimerskirch@escrypt.com

I. Introduction

Automotive and industrial data security is researched for 

almost a decade now and the author started doing research and 

working in this area in 2003. Recent attacks impressively 

demonstrated weaknesses that were anticipated for a while 

now. In the area of automotive data security, a research team of 

the University of Washington and University of California, San 

Diego, was able to hack into a modern vehicle and control the 

vehicle [2][4]. The team mounted attacks via external interfaces, such as Bluetooth and cellular connection, and internal interfaces, such as USB flash drive and CD. The research team 

was then able to replace the firmware of safety critical components and was thus potentially able to crash the vehicle. Bailey 

presented an attack at the Black Hat congress to undermine the 

remote unlock and remote start mechanism of a car via smartphone [1]. Similar threads also exist in less researched areas, 

such as automatic mining, industry production robots, and construction site machines. Even in very remote areas similar concerns arise. For instance, advanced fire alarm systems (e.g. for 

an office building) are controlled by an embedded computing 

system and the compromise of such a system might be fatal. 

Data security and privacy is well understood for regular Internet systems, consisting of PCs, servers, network equipment, 

etc. However, even there no proper security strategies are in 

place for the majority of systems, as shown by the daily news 

about compromised financial institutions, government organizations, and critical infrastructure components. The situation is 

very different in automotive and industrial security systems. 

Unfortunately, this difference is not well understood and very 

often leads to poor security design and security weaknesses in 

the first place. Fortunately, no actual attack was ever reported 

to automotive and industrial systems. However, we believe it is 

only a matter of time until the knowledge becomes widespread 

and attacks will be mounted. We believe that security in the 

automotive area is most researched and understood, and that 

the results can be applied to further industrial security systems 

such as machines, industry robots, fire alarm control systems, 

etc. Therefore the remainder of this article will often make references to automotive security systems. 

II.Background

The threat model for safety-critical automotive and industrial systems is quite different to traditional network systems. 

Comfort and remote maintenance features are connected to 

safety critical systems. For instance, in a passenger vehicle 

there is a physical network connection, typically via CAN bus, 

between the infotainment system (that in turn might be connected to Bluetooth, Wi-Fi, and cellular data connection) and 

the safety critical powertrain components. Especially during the 

last few years, there is an increased desire to provide communication features due to raised consumer expectations. Consumers expect a vehicle with infotainment systems that resembles modern smart-phone comfort features and that provide 

Internet connections. Industry robot and machine owners expect remote control and maintenance features. At the same 

time, cost pressure does not allow implementing failure-safe 

security mechanisms (e.g. by using two physically separated 

communication bus systems within a vehicle, with redundant 

components that are connected to both bus systems). The threat 

model for safety-critical automotive and industrial systems is 

summarized in the following: 

• Assumptions and limitations: automotive and industrial systems often provide physical access to the devices. However, these systems do not provide a permanent Internet connection and it is often not possible to 

regularly update software, as we are used to from the 

PC world. In fact, for today’s passenger vehicles software updates are only performed upon customer’s demand or in case of noticeable malfunction. 

• Attacker motivation: as of today, there are no known 

attacks, mainly due to the significant effort required to 

mount attacks and due to the missing motivation. In 

particular, there is no financial motivation. The more 

business models are introduced, e.g. subscription services for the infotainment platform, and the more motivation there is for attackers to undermine the system. 

Attackers might then extend their attacks due to curiosity, or they might accidentally uncover safety critical 

attacks. Another potential group of attacker belongs to 

the curious hacker on the hunt for spectacular hacks. 

• Attack targets: potential targets are the safety critical 

components, the remote maintenance feature, and undermining financial business models. Attackers might 

target competitors to deactivate machines in a construction site, and attackers might offer their services 

as an illegal business to interested parties. A further attack target is the extraction of information, e.g. from 

the devices of a competitor, in order to gain confidential and privacy-sensitive information. 
NISTIR 7916

26

• Likelihood of attack: today the effort to mount an attack in terms of knowledge and financial resources is 

significant, and there are easier and less costly ways to 

harm vehicle passengers. However, once the 

knowledge becomes widespread, and once attacks can 

be mounted very easily, the likelihood of attacks will 

increase. 

• Impact and risk of attack: the impact of attacks is 

significant, thus leading to a high risk level. A successful attack can potentially harm people. 

III. Countermeasures

Currently there are no legal requirements or guidelines 

available to the manufacturers of such systems. There is also no 

security standardization available. However, there are several 

research projects that will provide approaches to counter the 

described attacks. We believe that security in such systems 

needs to be approached by considering the following layers: 

1. Applications and operating system: applications shall 

be implemented using current state-of-the-art 

knowledge and proper processes. For instance, there 

shall be no software modules included that is not actually needed (often used when legacy systems or open 

source software is used). 

2. Virtualization, hyper threading & microkernel: We 

believe that it is impossible to implement applications 

and a full-blown operating system without security 

weaknesses that will be discovered over the life-span 

of the device. Therefore we suggest the use of virtualization and microkernel technology. The microkernel is 

a relatively small kernel (around 10,000 lines of code) 

that only provides the essential kernel features. Since 

the kernel is fairly small in terms of source code, it can 

be assumed that there are no significant security weaknesses in the microkernel. The actual operating system 

and applications visible to the user are executed in a 

compartment. If a compartment is hacked, the attack is 

limited to the confinement of the compartment. The 

European Union funded OVERSEE project [5]. 

3. Secure hardware: attacks can potentially endanger 

safety of life and therefore we suggest introducing a final security barrier at the hardware layer. Such a solution must be cost efficient due to the cost pressure. The 

European Union funded EVITA project [3] considers 

secure computing platforms for automotive systems. 

Furthermore, the equivalent of firewalls or gateways 

can be introduced to control traffic between the comfort and maintenance components, and the safety critical components. 

IV. Outlook

The full presentation will provide an overview of today’s 

attacks and will detail the attacker model. Special consideration 

will be given to available countermeasures and the most interesting research projects will be described. Finally, suggestions 

for improvements will be made. These might include security 

certifications for safety critical systems, such as Common Criteria and FIPS 140-2 security certifications, and it might be 

wise to setup a CERT for safety critical automotive and industrial systems. 

References

[1] Don Bailey, “War Texting: Identifying and Interacting with Devices on 

the Telephone Network”, Blackhat USA, 2011.

[2] Stephen Checkoway, Damon McCoy, Brian Kantor, Danny Anderson, 

Hovav Shacham, Stefan Savage, Karl Koscher, Alexei Czeskis, 

Franziska Roesner, Tadayoshi Kohno, “Comprehensive Experimental 

Analysis of Automotive Attack Surfaces”. USENIX Security, August 

10–12, 2011.

[3] EVITA, “E-safety vehicle intrusion protected applications”, 

http://www.evita-project.org

[4] Karl Koscher, Alexei Czeskis, Franziska Roesner, Shwetak Patel, 

Tadayoshi Kohno, Stephen Checkoway, Damon McCoy, Brian Kantor, 

Danny Anderson, Hovav Shacham, Stefan Savage, “Experimental 

Security Analysis of a Modern Automobile”, IEEE Symposium on 

Security and Privacy, Oakland, CA, May 16–19, 2010.

[5] OVERSEE, “Open Vehicular Secure Platform”, https://www.overseeproject.com.
NISTIR 7916

27
NISTIR 7916

28
NISTIR 7916

29
NISTIR 7916

30
NISTIR 7916

31
NISTIR 7916

32
NISTIR 7916

33
NISTIR 7916

34
NISTIR 7916

35
NISTIR 7916

36
NISTIR 7916

37
NISTIR 7916

38
NISTIR 7916

39
NISTIR 7916

40
NISTIR 7916

41
NISTIR 7916

42
NISTIR 7916

43
NISTIR 7916

44
NISTIR 7916

45

5. Keynote Speaker: Dr. Farnham Jahanian

Dr. Farnham Jahanian

Assistant Director for CISE

National Science Foundation

Farnam Jahanian serves as the National Science Foundation Assistant Director for the Computer and Information Science and Engineering (CISE) Directorate. He guides CISE, with a 

budget of over $650 million, in its mission to uphold the nation’s leadership in computer and information science and engineering through support of fundamental and transformative advances 

that are a key driver of economic competitiveness and that are crucial to achieving national priorities. Dr. Jahanian is also co-chair of the Networking and Information Technology Research and 

Development (NITRD) Subcommittee of the National Science and Technology Council Committee on Technology, providing overall coordination for the activities of 15 government agencies. 

Dr. Jahanian is on leave from the University of Michigan, where he holds the Edward S. Davidson Collegiate Professorship and served as Chair for Computer Science and Engineering from 

2007 – 2011 and as Director of the Software Systems Laboratory from 1997 – 2000. His research on Internet infrastructure security formed the basis for the Internet security company Arbor Networks, which he co-founded in 2001. He served as Chairman of Arbor Networks until its 

acquisition by Tektronix Communication in 2010. Dr. Jahanian holds a master's degree and a 

Ph.D. in Computer Science from the University of Texas at Austin. He is a Fellow of the Association for Computing Machinery (ACM), the Institute of Electrical and Electronic Engineers 

(IEEE), and the American Association for the Advancement of Science (AAAS).
NISTIR 7916

46
NISTIR 7916

47
NISTIR 7916

48
NISTIR 7916

49
NISTIR 7916

50
NISTIR 7916

51
NISTIR 7916

52
NISTIR 7916

53
NISTIR 7916

54
NISTIR 7916

55
NISTIR 7916

56
NISTIR 7916

57
NISTIR 7916

58
NISTIR 7916

59
NISTIR 7916

60
NISTIR 7916

61
NISTIR 7916

62
NISTIR 7916

63
NISTIR 7916

64
NISTIR 7916

65
NISTIR 7916

66
NISTIR 7916

67
NISTIR 7916

68
NISTIR 7916

69
NISTIR 7916

70
NISTIR 7916

71
NISTIR 7916

72

6. Security Challenges and Requirements for Control Systems in the Semiconductor Manufacturing Sector

Malek Ben Salem

CyberSecurity Lab

Accenture Technology Labs

Reston, Virginia 20190

Email: malek.ben.salem@accenture.com

I. INTRODUCTION

Moore’s Law and the market requirements for higher performance chips are driving the production of increasingly 

smaller transistors, and therefore, are forcing more stringent 

controls on semiconductor manufacturing processes and 

equipment, with a very small room for error.

The second trend in the semiconductor industry is the adoption of the e-Manufacturing paradigm [1]. With the rise of 

fully-automated factories and the new technology size requirements for chips, new security challenges arise as the control systems are becoming increasingly more complicated. 

The need for high manufacturing yields using these systems is 

driving more Advanced Process Controls (APC). Control systems, already ubiquitous in the industry, are becoming more 

and more sophisticated. And complexity, as is widely

acknowledged, is the enemy of security.

The last trend in the industry is the tendency for manufacturers to form joint production ventures. The highly cyclic

demand for various consumer electronic products is causing

cyclical fluctuation in the manufacturing load of semiconductor factories. The high costs of development and production

facilities for different technology node sizes is driving semiconductor companies to form join manufacturing partnerships

instead of building new factories. Production of parts may be 

distributed among manufacturing partner facilities if the manufacturing load in one factory is too high, and part delivery

deadlines cannot be met. This new manufacturing model is

known the Manufacturing Grid. The goal is to utilize all the

manufacturing resources that are distributed between different

manufacturing partners and factories different chip parts.

This paper presents threats to controls systems in the semiconductor manufacturing sector that are driven by the above

trends in Section II. In Section III, we review recent research

work related to the most important threat faced by these control systems. Section IV presents the research priorities and

security requirements needed to mitigate these threats. Finally,

Section V concludes the paper by summarizing its main 

points.

II.THREATS AND SECURITY CHALLENGES TO 

CONTROL SYSTEMS IN THE SEMICONDUCTOR 

MANUFACTURING SECTOR

We distinguish between targeted attacks to control systems

such as Stuxnet [2], and non-targeted attacks. We also distinguish between two types of threats: threats to equipment sensors and controllers, and threats to the IT systems and networks that support these sensors and controllers. For completeness, we cover the major threats of both types in this Section.

A. Equipment Control and Recipe Integrity

Recipes are specifications of equipment processing used to

control manufacturing equipment, including processing tool

chamber temperature, pressure, and cooling/heating rates. A

critical security (and potentially safety) challenge is trusted

recipe content, which guarantees that the recipe on the equipment is exactly the one that the factory approved and selected.

Another challenge is the traceability of recipe items and parameter usage. A third challenge is preventing DoS attacks,

where the adversary prevents the tool controller from receiving recipe parameters and values or sensor measurements by

blocking the communication channels between them.

B. Process Data Integrity

The industry applies feed-forward and feedback control, as

well as automated fault detection to equipment and to the automated factory, in order to improve process performance and 

factory yield. These techniques, known as APC rely on the 

integrity of the data measured by equipment sensors.

Accurate alarm reporting also relies on the accuracy of sensor readings. Alarm reporting is critical to the safety of the 

equipment, the product, and the factory in general. Alarm reports must be accurate and timely.

One type of targeted attacks against the sensors is the False

Data Injection Attack where a malicious third party compromises the integrity of the control systems by controlling the 

readings of one or more sensors, such as the sensors measuring the ambient temperature inside a chamber on an ion implantation tool.

C. Privilege Over-Entitlement

With the establishment of the Manufacturing Grid, distributed teams are being formed from different companies to collaborate on the development and production of various prod-
NISTIR 7916

73

ucts. This along with the high job rotation rates among process 

engineers through various product wafer processing steps, is 

increasingly complicating the access controls management

process. Many engineers quickly accumulate privileges that 

they do not need to perform their current job functions.

Although this security problem is not strictly related to

cyber-physical devices, highly-privileged access to equipment

sensors and controllers is a serious threat, knowing that the

control systems are increasingly becoming remotely accessible

and linked to the corporate networks or to other factories

through the Manufacturing Grid. The threat is exacerbated by

the open specifications used for process equipment design.

This make it easy for malicious users, potentially from a business/manufacturing partner, to launch their attacks and compromise equipment sensors or controllers.

D. Sample Attack

An attacker may develop Stuxnet-like malware [2], featuring zero-day exploits, rootkits, anti-virus evasion techniques, 

and process injection and hooking code, to target a specific 

process step within the entire chip manufacturing process.

One of the critical steps in chip manufacturing is the lithography step, where lithography masks or reticles are used to 

print the pattern of transistors and wires on a microchip. An

attacker may substitute a mask with another and use it to print

additional transistors and wires on a microchip. Printing as 

few as a 1000 additional transistors (to the millions of transistors on a chip) may introduce a kill switch or a backdoor to the

chip [3]. A kill switch on a chip allows the attacker to stop the

chip at any time when he or she sends a specific sequence of

bits. All chips on wafers processed using this tool will carry

the backdoor or kill switch. The damage may be catastrophic

if the chip is installed on a plane for instance. A backdoor may

allow the attacker to disable any cryptographic functions that

the chip may be running for example. Hardware backdoors

create a significant security vulnerability, since hardware is

the root of trust, which software builds on.

This is an example of a targeted and very sophisticated attack enabled by the next-generation factory model, where all 

manufacturing operations are automated and controllers are

reachable remotely. The attacker may be able to compromise

the controllers of the equipment and have the lithography process tool load the wrong mask. He or she may also compromise the sensors of the tool and/or the software running on the 

tool so that the wrong process data is reported, thus preventing 

the detection of the attack through log analysis. The resulting 

“compromised” chips are hard to detect even during the chip 

testing phase. Chip makers are not able to test every unspecified function of the device in order to find potential backdoors 

[3], nor are they able to test all possible sequences of data that 

might trigger, and therefore discover, a kill switch during testing.

III. RELATED RESEARCH

One of the major attacks against control systems, including

process tools used for chip manufacturing, is the False Data

Injection Attack. Process tools in this sector are perhaps more

vulnerable to these attacks, due to the highly stringent process

requirements that have to be met as transistors and technology

nodes get smaller. Any false data injected into the control data

may drive the process tool “out of control” or irreversibly

damage the product.

Mo and Sinopoli studied this type of attack targeting control

systems in general. They defined the required and sufficient

conditions under which an adversary is able to destabilize a 

control system that is used to monitor a Linear Time Invariant 

(LTI) Gaussian system. Linear dynamical systems are one of 

the most common models for physical systems. The researchers assumed that the control system is equipped with a Kalman 

filter used to estimate the state of the system from different 

sensor observations, a LGQ controller used to stabilize the 

system, and a failure detector [4]. They formulated the action 

of the attacker as a constrained control problem and showed 

that, if the attacker knew the variables of the controlled systems and controlled a subset of the sensors, then the attack is 

feasible. As a defense mechanism, they proposed adding redundant sensors to measure all unstable modes in order to improve the resilience of the control system.

C ́ardenas et al. reviewed different types of false data injection attacks against control systems, such as bias attacks, surge

attacks, and geometric attacks. They experimentally tested

these types of attacks against a chemical reactor process. They 

concluded that it was more important to protect against integrity attacks than DoS attacks. They also found that the proposed data injection attacks could be detected thanks to the

slow dynamics of the process. This, probably, does not hold

true for semiconductor manufacturing processes.

IV. RESEARCH PRIORITIES AND SECURITY

REQUIREMENTS

As we have pointed out, some of the threats targeting control systems are CPS-specific, while others apply to all IT systems. Below, we highlight the security research priorities for 

control system security in the semiconductor manufacturing 

sector.

A. Detecting False Data Injection Attacks and Sensor Compromise

The adversary can launch these attacks by obtaining the secret key or by compromising some sensors or controllers. Preventing or at least detecting these attacks is critical. Collecting

accurate data is one of the most important conditions for the 

secure manufacturing of chips. Engineers rely on quality data 

to make critical decisions related to the availability of manufacturing tools, to the integrity of the specifications of the the 

manufactured product, and to the reliability and repeatability 

of the manufacturing process [5].

As the industry embraces the e-Manufacturing model, data

integrity becomes even more critical. This requires the protection of the sensor readings and sensor software, eliminating

message and data latency and ensuring accurate timestamps.

For example, at the equipment controller level, it is important

to have accurate readings of the process speed and cooling 
NISTIR 7916

74

response rates, the process chamber status, as well as calibration data, and sensor settings. Similarly accurate process data 

are critical to equipment setup, qualification, process control, 

and process monitoring.

Data must also be made available in a timely manner to 

support process control. False data may be an incorrect measurement, an incorrect sender id, or an incorrect timestamp sent 

with the measurement. Semiconductor processing has stringent timing controls. Distributed factory environments also 

rely on accurate time in order to coordinate manufacturing

processes. So, the time synchronization system used should be

fault-tolerant using diverse time sources, so that if one source

fails or is inaccessible, others may be reached.

B. Trusted Recipe Management and Fine-Grained Access

Control Management

Trusted recipe are a critical security requirement [6]. The

management of equipment configuration is of vital importance

because configuration changes can cause differences in process capability and outcomes. Trusted recipe management is 

not a research priority, as much as a security requirement. Security measures that can be used to enforce trusted recipe 

management are available but cannot easily implemented. 

Existing access control mechanisms, as previously underlined, 

do not easily meet the requirements of the industry. New finegrained access control models to equipment and product recipes are needed in order to help reduce the privilege overentitlement problem, while allowing design, process, equipment, industrial and integration engineers to solve problems 

together, especially in cases of manufacturing line emergencies.

C. Dynamic Patching

Control systems are not typically suitable for frequent software patching and updates due to their high availability requirements. Software patches and updates are usually deployed on a fixed, calendar-based schedule, although there is a 

call to move to condition-based and predictive preventive

maintenance [7]. While this may not be the top research priority, we believe that there needs to be more work on dynamic 

patching for software running on control systems with high 

uptime requirements.

V.CONCLUSION

In this extended abstract, we gave an overview of the security challenges driven by three trends in the semiconductor

manufacturing sector: e-Manufacturing, Moore’s Law, and the 

Manufacturing Grid. We briefly reviewed recent research related to one of the most serious attacks against control systems 

used by chip makers, namely false data injection attacks. 

Then, we highlighted the security-related research priorities 

for the industry.

Control systems are subject to non-targeted attacks and targeted attacks, such as Stuxnet [2]. Attacks against control systems may be directed at the sensors of the control systems,

their actuators or controllers, or the IT systems and networks

supporting the information processing and communication.

Techniques for detecting tampering, and validating the inputs

provided by the sensors are of paramount importance.

Besides their unique security requirements, control systems

share many of the security requirements with traditional IT

systems. However, if we are to achieve secure control systems

in this sector, we need to model the security implications of

the physical interactions in semiconductor processing tools.

Design of the equipment, including hardware components and

the software that it runs, as well as the factory automation platform, should consider security as part of system architecture

and software development. Information flow and control paths 

have to be identified during the design phase, so that the operational security requirements of the system may be met.

REFERENCES

[1] T. Walker and D. Stark, “Next-generation factory publications by the 

semiconductor manufacturing consortium (sematech).” [Online]. Available: http://sematech.org/docubase/wrappers/33s.htm

[2] N. Falliere, L. O. Murch, and E. Chien, “W32.stuxnet dossier version

1.4,” New York, NY, USA, February 2011.

[3] S. Adee, “The hunt for the kill switch,” Spectrum, IEEE, vol. 45, no. 5,

pp. 34 –39, may 2008.

[4] Y. Mo and B. Sinopoli, “False data injection attacks in control systems,” 

in Proceedings of the First Workshop on Secure Control Systems, ser. 

SCS ’10. Team for Research in Ubiquitous Secure Technology 

(TRUST), April 2010. [Online]. Available: http://www.cse.psu.edu/ 

smclaugh/cse598e-f11/papers/mo.pdf

[5] G. Crispieri, “Data quality guidelines: Version 1,” July 2008. [Online].

Available: http://sematech.org/docubase/document/4843ceng.pdf

[6] L. Rist, “Recipe management system: Common requirements and 

benchmark 2007,” May 2008. [Online]. Available:

http://sematech.org/docubase/document/4930atr.pdf

[7] T. Walker and D. Stark, “Ismi predictive preventive maintenance implementation guideline,” October 2010. [Online]. Available:

http://sematech.org/docubase/document/5119atr.pdf

Malek Ben Salem, PhD, CISSP Dr. Ben Salem has an extensive background

in process controls. She has worked for 9 years as an IT systems developer

and integrator and as a Controls engineer at IBM’s East Fishkill chip

manufacturing factory. Dr. Ben Salem earned a PhD degree in Computer

Science from Columbia University in 2012. Her research interests include

intrusion detection, network security, and secure dependable systems.
NISTIR 7916

75
NISTIR 7916

76
NISTIR 7916

77
NISTIR 7916

78
NISTIR 7916

79
NISTIR 7916

80
NISTIR 7916

81
NISTIR 7916

82
NISTIR 7916

83
NISTIR 7916

84
NISTIR 7916

85
NISTIR 7916

86
NISTIR 7916

87
NISTIR 7916

88
NISTIR 7916

89
NISTIR 7916

90
NISTIR 7916

91
NISTIR 7916

92
NISTIR 7916

93
NISTIR 7916

94

7. Keynote Speaker: Tom Dion

Tom Dion

Vendor Assessment Lead

Control Systems Security Program

Department of Homeland Security

Control Systems Security Program (CSSP)

The goal of the DHS National Cyber Security Division's CSSP is to reduce industrial control system risks within and across all critical infrastructure and key resource sectors by coordinating 

efforts among federal, state, local, and tribal governments, as well as industrial control systems 

owners, operators and vendors. The CSSP coordinates activities to reduce the likelihood of success and severity of impact of a cyber attack against critical infrastructure control systems 

through risk-mitigation activities.

Cyber Security Evaluation Tool

Critical infrastructures are dependent on information technology systems and computer networks 

for essential operations. Particular emphasis is placed on the reliability and resiliency of the systems that comprise and interconnect these infrastructures. NCSD collaborates with partners from 

across public, private, and international communities to advance this goal by developing and implementing coordinated security measures to protect against cyber threats. 

The Cyber Security Evaluation Tool (CSETTM) is a Department of Homeland Security (DHS) 

product that assists organizations in protecting their key national cyber assets. It was developed 

under the direction of the DHS National Cyber Security Division (NCSD) by cybersecurity experts and with assistance from the National Institute of Standards and Technology. This tool provides users with a systematic and repeatable approach for assessing the security posture of their 

cyber systems and networks. It includes both high-level and detailed questions related to all industrial control and IT systems. 

CSET is a desktop software tool that guides users through a step-by-step process to assess their 

control system and information technology network security practices against recognized industry standards. The output from CSET is a prioritized list of recommendations for improving the 

cybersecurity posture of the organization's enterprise and industrial control cyber systems. The 

tool derives the recommendations from a database of cybersecurity standards, guidelines, and 

practices. Each recommendation is linked to a set of actions that can be applied to enhance 

cybersecurity controls.

CSET has been designed for easy installation and use on a stand-alone laptop or workstation. It 

incorporates a variety of available standards from organizations such as National Institute of 

Standards and Technology (NIST), North American Electric Reliability Corporation (NERC), 

International Organization for Standardization (ISO), U.S. Department of Defense (DoD), and 
NISTIR 7916

95

others. When the tool user selects one or more of the standards, CSET will open a set of questions to be answered. The answers to these questions will be compared against a selected security 

assurance level, and a detailed report will be generated to show areas for potential improvement. 

CSET provides an excellent means to perform a self-assessment of the security posture of your 

control system environment.

For more information about the DHS Control Systems Security Program, please visit:

http://www.us-cert.gov/control_systems/

For more information about the CSET, please visit:

http://www.us-cert.gov/control_systems/satool.html
NISTIR 7916

96

8. Application of Dynamic System Models and 

State Estimation Technology to the Cyber Security of Physical Systems 

Barry Horowitz, Kate Pierce

Systems and Information Engineering 

University of Virginia Charlottesville, VA, USA 

Email: bh8e@virginia.edu, kmp7ef@virginia.edu

As advances in technology permit automatic control of 

more and more of the functions of physical systems, the opportunity for cyber attacks that include exploitation of such 

automation capabilities becomes a greater risk. For example, 

in the 2010 Stuxnet attack an embedded infection in control 

systems was used to successfully damage a large number of 

nuclear power related centrifuges in Iran. While the application of perimeter security technologies have been applied to 

help manage the likelihood of SCADA-based cyber attackers 

exploiting highly automated physical systems, successful attacks have occurred, and furthermore, perimeter solutions do 

not address important classes of insider and supply chain initiated attacks. As a result, it has been recognized that perimeter 

security needs to be augmented by other approaches for addressing potential cyber attacks [1]. 

Frequently, as a means for added operational assurance, 

highly automated physical systems include the presentation of 

system status information that permits human operators to take 

controlling actions when the automated system appears to be 

operating in an out-of-normal manner. For example, the operation of a turbine may be automatically controlled, but operators can observe critical information regarding the turbines 

operation, such as vibration levels, temperature, and rotation 

rate. If the operator observes measurements that are outside 

the designated region of proper operation, specific manual 

actions can be required of the operator in order to avoid undesirable consequences [2]. However, as was the case in the 

Stuxnet attacks, the cyber attacker can not only manipulate a 

physical systems performance through infections in its control 

system, but can also manipulate data presented to operators; 

data that can, when utilized within standard operating procedures, either stimulate inappropriate control actions or prevent 

needed control actions on an operators part. In the case of the 

turbine example, a successful cyber attack can result in indications to operators that would imply that all is well when it is 

not, or indications that would call for disruptive operator action when, in reality, none is required (e.g., unnecessarily shutting down the turbine). Note that it is quite typical for operator 

displays to be designed for simplicity, so that critical manual 

actions will not be delayed by human limitations related to 

viewing and interpreting too much information. As a result, 

physical systems typically include measurement and collection 

of information that could conceivably be used, but is not, for 

automation override decision making. For example, driving an 

automobile involves a driver monitoring a few of the many 

available engine state measurements that could be made available for viewing, but could confuse the driver while offering 

little, if any, benefit. 

This paper presents an approach for addressing cyber attacks 

on physical systems that include purposeful manipulation of 

operator displays. The presented approach involves embedding security functions within the physical system being protected; functions that can be the basis for detection of inconsistent system dynamics data derived from measurements 

within the system that is being protected. In particular, the use 

of dynamic mathematical models of physical systems in combination with state estimation techniques is suggested as the 

basis for system architectures that can be employed to detect 

situations where information displays for system operators are 

being manipulated as part of a cyber attack. One can divide the 

states of a physical system into 3 classes: 1) those that are presented to operators for control purposes, but are considered as 

least trusted from a cyber security viewpoint; 2) those that can 

be measured and analyzed in segregated equipment from the 

equipment being used for measuring, analyzing and displaying 

of least trusted states, but are not used for operator assistance 

and are considered as more trusted; and 3) those that are not 

measured. The paper draws on dynamic state estimation techniques to develop, when feasible, estimates of the least trusted 

states values, and the variances of these estimates, from measurements of more trusted states. Systems that satisfy control 

system conditions for being observable satisfy the sufficient 

conditions for this cyber security solution. The paper shows 

how these estimates can provide the basis for detecting attacks 

on automatic control systems that include manipulation of data 

presented to operators, and how this approach can be used to 

manage system restoration. Theoretical results are presented 

for a range of physical system models, and a specific system 

model for an electrical generator is used to illustrate the performance one can achieve in an actual application, including 

calibration of expected performance in terms of missed detections, false detections and delay time for detections of cyber 

attacks.
NISTIR 7916

97

This material is based upon work supported in part by the

U.S. Department of Defense through the Systems Engineering

Research Center (SERC) under Contract H98230-08-D-0171.

SERC is a federally funded University Affiliated Research

Center managed by Stevens Institute of Technology.

REFERENCES

[1] W. A. Wulf and A. K. Jones, “Reflections on cyber security,” Science 

Magazine, vol. 326, pp. 943–944, 2009. 

[2] R. A. Jones, T. V. Nguyen, and B. M. Horowitz, “System-aware security 

for nuclear power systems,” in 2011 IEEE International Conference on

Technologies for Homeland Security, November 2011. 
NISTIR 7916

98
NISTIR 7916

99
NISTIR 7916

100
NISTIR 7916

101
NISTIR 7916

102
NISTIR 7916

103
NISTIR 7916

104
NISTIR 7916

105
NISTIR 7916

106
NISTIR 7916

107
NISTIR 7916

108
NISTIR 7916

109
NISTIR 7916

110
NISTIR 7916

111
NISTIR 7916

112
NISTIR 7916

113
NISTIR 7916

114
NISTIR 7916

115
NISTIR 7916

116
NISTIR 7916

117
NISTIR 7916

118
NISTIR 7916

119

9. Challenges of Cybersecurity Research in a 

Multi-user Cyber-Physical Testbed 

Thomas Edgar Tom Carroll David Manz 

Pacific Northwest National Laboratory Pacific Northwest National Laboratory Pacific Northwest National Laboratory 

Richland, Washington 99354 Richland, Washington 99354 Richland, Washington 99354 

Email: thomas.edgar@pnnl.gov Email: thomas.carroll@pnnl.gov Email: david@pnnl.gov 

I. INTRODUCTION 

Deployed Cyber-Physical Systems (CPSs)[5] are often 

large, complex, and expensive environments that utilize specialized equipment. The equipment is difficult to configure, 

deploy, and maintain and requires much expertise to correctly 

instantiate the components into a connected, functional system 

[3]. The number of individuals with the necessary skill sets is 

small, and they are expensive due to the high demand. These 

combined factors have traditionally limited researchers’ access 

and their ability to conduct studies. A multi-user remotelyaccessible testbed[6] significantly lowers the barrier of entry 

by providing researchers with ready access to CPS environments, without them individually needing to invest in the 

equipment, resources, and expertise to deploy them. Most importantly, users are freed to focus on research and not ancillary 

system duties. 

A multi-user testbed is a shared resource whose equipment 

acquisitions benefit all users. CPSs are in essence a “system of 

systems;” a diverse, broad range of equipment is required to 

research the many faucets of CPSs. Equipment diversity enables modeling realistic environments in multiple domains. 

Multi-vendor equipment supports interoperability studies and 

vulnerability assessments. Finally, equipment diversity assists 

investigators in generalizing results. 

Robust scientific experimentation demands repeatable results [4]. When conducted on a testbed, the description of the 

system under test is the testbed configuration and normally 

includes the equipment, initial configuration, the relationship 

between devices, and the communication links. Another researcher can then independently verify the results on the 

testbed. 

A multi-user CPS testbed provides significant benefits to 

cybersecurity research. However, there are notable challenges 

to creating such a testbed. These challenges are assessed in 

this paper. The next section summarizes the challenges. The 

following section discusses avenues for solving these challenges in the context of the power networking, equipment, and 

technology (powerNET) testbed. Finally, a conclusion section 

discusses a path forward for the future. 

II. CHALLENGES FOR CYBER-PHYSICAL SECURITY RESEARCH USING TESTBEDS 

The unique characteristics of cyber-physical systems and a 

multi-user experimental testbed result in unique challenges for 

cybersecurity experimentation. Cyber-physical systems have 

similar issues to general enterprise cybersecurity experimentation such as data sensitivities, experimental separation, and 

testbed fidelity but cyber-physical systems have additional 

unique issues. For example, cyber-physical systems add challenges like system scale, physical process simulation, and diversity design. The cybersecurity challenges that have been 

encountered during the process of designing and implementing 

a multi-user experimental cyber-physical testbed will be discussed in this section. 

Operational IT systems often have data security requirements that require protection. This encompasses Personally 

Identifiable Information (PII) and Intellectual Property (IP). 

Cyber-physical systems can also include these issues, but also 

add problems such as the proprietary nature of the module or 

architecture of the system and the operational state of their 

systems. For example, the state estimation models used by 

control room operators of the electrical grid as well as the data 

that provides a status of the system can be proprietary. These 

models and data could provide competitors or threat actors 

with system weaknesses that could be leveraged for financial 

gain or exploitation. Due to the data security requirement, a 

multi-user experimental cyber-physical testbed has the challenge of providing adequate security mechanisms to ensure 

that only the appropriate users can access data as well as no 

data leakage of how an experiment may be architected. 

Data is not the only protection challenge that must be addressed in a multi-user experimental testbed. Resources must 

be protected to ensure that one experiment does not impact the 

results of another. Multiple experiments could be running on 

the testbed at any time. The effects of one must not impact the 

others or at a minimum, quantification of the effects of the 

testbed on an experiment need to be documented for the other 

experimenters. This must be a part of every testbed used and is 

necessary for rigorous experimental design. For example, if 

one experiment is testing the effects of a DoS attack on a system and another experiment is performing a vulnerability assessment of a product it would be incorrect if the second experimenter believed a loss of connectivity to a device was 
NISTIR 7916

120

significant to their actions when in reality it was due to the 

DoS experiment impacting the shared networking resources 

[2]. Since cybersecurity experimentation often tests abnormal 

operational cases it is a challenge to protect experiments from 

impacting others. Also, it is a challenge to quantify impacts 

when they do occur. This last step is crucial for all assumptions and qualifications made in a testbed. 

Cyber-physical systems run the gamut of scale; from small 

self-contained systems like automobiles up to highly complex 

systems-of-systems like electrical grids. Providing the 

capa¬bility to scale a testbed to meet the needs of a broad 

range of applications is a challenge. The equipment involved 

in cyber-physical systems are often expensive to buy and 

configure. The equipment is often hardened for harsh environmental conditions and requires compliance with many safety and reliability standards. Also, the expertise needed to 

configure and maintain these systems is highly specialized and 

expensive to acquire. 

On top of the scalability challenge is the heterogeneous nature across and within cyber-physical industries. Systems designed for cyber-physical systems are derived from the requirements of the physical processes for which they are monitoring and/or controlling. Therefore, a system in the manufacturing industry is significantly different than one in the transportation industry. This can include different equip¬ment, 

network architecture, and operational performance and security requirements. However, this challenge goes deeper, and 

there can be extensive differences even within industries. For 

example, due to geography constraints an electric utility in a 

plains state can look significantly different than one that operates over mountainous terrain. 

Another issue that can occur due to scaling of experiments is 

fidelity of the system. Depending on the experimental design, 

simulated equipment may not reach the fidelity requirements 

to evaluate the security characteristics of a device. On the other end, an experiment to evaluate the impact of an event on the 

electrical grid does not require the fidelity of having the actual 

equipment for the grid. Ensuring a multi-user experimental 

testbed has the ability to meet the fidelity needs of a broad 

range of experimentation is a challenge. 

Integration of the physical process into the testbed is a 

closely related challenge intertwined with fidelity. CPS requires a data substrate which is the physical processes they 

monitor and control. This substrate interplays with the CPS, 

providing input and reacting to output. It is often difficult if 

not impossible to replicate these physical processes in a laboratory environment. Therefore, a simulation capability is necessary to provide the physical aspect of CPS. Creating a simulation capability with high enough fidelity to model the real 

world is challenging.

III. POWERNET: DRIVING SOLUTIONS FORWARD 

The power networking, equipment, and technology (powerNET) testbed [1] is an implementation of a multi-user experimental CPS testbed. In this section, powerNET will be introduced and the envisioned path to solve the challenges defined 

in the previous section. PowerNET is an effort to build a 

testbed capability that is multi-user, remotely and dynamically 

configurable, and user friendly. 

In order to provide the necessary data and network separation between users and experiments, powerNET uses a variety of technologies. Each user and project are provided with 

networked shared directories via NFSv4. To provide authentication and authorization services, Kerberos is utilized. Scripts 

built into the testbed OS images, on startup, retrieve user and 

project keys to mount the shares and provide access. Virtual 

LANs are utilized to provide separation between experiment 

network traffic. Additionally, overprovisioning of shared resources will alleviate cross experimental impacts. 

powerNET provides a unique capability to provide scalability and different levels of fidelity. powerNET combines 

simulation, virtualization, emulation, and real cyber-physical 

equipment in one testbed. This combination enables high fidelity small scale experimentation with bare metal equipment. 

However, it can also scale up to medium scale and slightly less 

fidelity with virtualization and emulation. Lastly, simulations 

can be run to enable experimentation at large scales. The combination of all three enable a flexible environment that can 

change based on the needs of the experimenters. 

Similarly, powerNET was designed modularly and for dynamic configuration to enable a broad spectrum of research. 

CPS includes a diverse selection of industries and equipment. 

While powerNET currently has a focus on a subset of power 

transmission and distribution applications, its modular design 

enables expansion into other applications within the power 

industry and even into other cyber-physical domains (i.e. oil/ 

natural gas, water/ waste water, transportation, etc.). And due 

to the heterogeneous architecture of the industries, powerNET 

is dynamically configurable so as to enable the modeling of a 

wide range of realistic architectures. 

There are multiple avenues to integrate simulation of physical processes into a multi-user testbed. The simplest but least 

accurate option is to perform complete simulation of the process and equipment. With a higher fidelity, process simulators 

can be leveraged to generate data files that represent the instrumentation of the physical world. These data files can then 

be used to generate digital and analog I/O that can be fed into 

the CPS equipment. However, this method does not create a 

reactive experiment. The highest fidelity would be to dynamically integrate physical processes into a testbed. This can be 

done be via a real-time running simulator that can inject digital 

and analog I/O while also be able to respond to communication from the CPS equipment. The Real Time Digital 

Simulator, used in the power industry, is an example of such a 

capability. All three have their uses and are viable options 

depending on the experimental setup. During experimental 

design, researchers must be aware of the level of fidelity offered by testbeds with differing configurations and choose the 

appropriate setup based on experimental requirements. This 

needs to be an explicit part of experimental setup and design 

and not an implicit, or perhaps overlooked afterthought. 
NISTIR 7916

121

IV. CONCLUSION 

While a multi-user (CPS) testbed has many benefits, some operational challenges must be addressed. The set of challenges 

defined in this paper are by no means a complete enumeration. 

The challenges listed are the most pressing that have been analyzed in the development of the powerNET testbed. Some of the 

challenges discussed are significant and may require research 

efforts of their own. 

In addition to these challenges, there exists a more fundamental 

generalization issue or external validity problem for all of 

cybersecurity science. The field still lacks good protocol to quantify how well the demonstration of a security solution in one context would apply to the broader community. Also, the cyber domain is quickly evolving and cybersecurity science still lacks a 

method to apply research results into predictive quantification of 

how a solution will stand up to threat evolution. 

The powerNET approaches discussed in this paper provide 

a good starting point in tackling the challenges listed. However, in most cases they do not provide a complete solution to 

the challenge. It is necessary that further work is performed to 

enable the full capabilities that are desirable in a multi-user 

CPS testbed. 

ACKNOWLEDGMENT 

This research is funded by US Department of Energy and 

US Department of Homeland Security under contract DEAC05-76R1-1830. powerNET is a part of the Pacific Northwest National Laboratory Future Power Grid Initiative

GridOptics capabilities. 

REFERENCES 

[1] TW. Edgar, DO. Manz AD. McKinnion, TW. Carroll, BA. Akyol, PM. Skare, 

CW. Tews, and JC. Fuller, Power Networking, Equipment, and Technology 

Experimentation: Designing a Testbed for Cyber-Physical Security Research, 

In 7th Annual Cyber Security and Information Intelligence Research Workshop. Association for Computing Machinery, New York, NY, 2012. 

[2] Roman Chertov and Sonia Fahmy and Ness B. Shroff, ACM Trans. Model. Comput. Simul., Fidelity of Network Simulation and Emulation: A 

Case Study of TCP-Targeted Denial of Service Attacks, Num.1, Vol. 19, 

2008. 

[3] E. A. Lee, Cyber physical systems: Design challenges, Eletrical Engineering and Computer Sciences, University of California at Berkley, Tech. 

Rep. UCB/EECS-2008-8, Jan. 23, 2008, accessed on Apr. 22, 2011 

[4] E. Eide, Toward replayable research in networking and systems, in Proc. 

of the NSF Workshop on Archiving Experiments to Raise Scientific 

Standards (Archive 10), 2010. 

[5] National Science Foundation, Cyber-physical systems program solicitation, 2011, accessed on Apr. 25, 2011. 

[6] J. Kurose et al., Report of NSF Workshop on Network Research Testbeds, 

Nov. 2002. 
NISTIR 7916

122
NISTIR 7916

123
NISTIR 7916

124
NISTIR 7916

125
NISTIR 7916

126
NISTIR 7916

127
NISTIR 7916

128
NISTIR 7916

129
NISTIR 7916

130
NISTIR 7916

131
NISTIR 7916

132
NISTIR 7916

133
NISTIR 7916

134
NISTIR 7916

135

10. Security of power grids: a European 

perspective 

Corrado Leita, Marc Dacier 

Symantec Research Labs 

Email: {corrado leita,marc dacier}@symantec.com 

Industrial control systems (ICS) are rapidly becoming a new 

major target of cyber-criminals. This was pointed out in multiple occasions by security experts [1], [2] and was confirmed 

by a recent survey carried out by Symantec [3]. In this survey, 

53% of the 1580 critical infrastructure companies that were 

interviewed admitted to having been targeted by cyber attacks. 

On average, the surveyed companies admitted to having been 

attacked 10 times in the last 5 years, with each of these attacks 

having an average cost of 850k USD. The survey provides a 

basis for a quantitative estimate of the extent of the problem 

and implies that the incidents reported by the press over the 

last several years are nothing but the tip of a considerably 

larger problem: the vast majority of incidents have never been 

disclosed. Still, the details of the publicly disclosed incidents 

give us a better understanding of the underlying issues we 

face. For instance, a recently discovered malware variant 

called Stuxnet which has been analyzed at length by Symantec 

[4] was shown to be part of a highly sophisticated targeted 

attack aiming at tampering with devices involved in the control of high speed engines, and compromise the associated 

industrial process [5]. The infection was only uncovered accidentally when an operational anomaly was discovered —

Stuxnet has probably been operating undetected since June of 

2009 [6]. Stuxnet, and other related threats discovered recently 

[7], show that industrial control systems are evolving, bringing 

powerful capabilities into the critical infrastructure environment along with new and yet undiscovered threats. 

The power grid infrastructure is a clear example of this evolution. As in other critical infrastructure environments, the 

idea of interconnecting industrial control systems with other 

networked computing systems came up only in the last decade, 

beginning as a method for lowering costs while increasing 

system efficiency [8]. This convergence is now moving beyond industrial control systems, and the Smart Grid is now 

being promoted globally as a way to solve problems with energy production, distribution and consumption, to enable energy independence and to combat climate change. Smart Meters, 

or more generally, the Advanced Metering Infrastructure 

(AMI), have been aggressively adopted by many European 

countries. For example ENEL, the Italian utility company, has 

already deployed over 30 million meters. Similar trends are 

being followed by other European countries such as France 

and Netherlands, in which a pilot deployment of 250,000 units 

will be enriched in the future years to cover 80% of the national installations. 

1. Power grid infrastructure and IT security 

The convergence between ICS environments and standard IT 

practices and technologies has important security implications 

[9], implications which have only been marginally explored by 

security researchers. 

On the one hand, the increasing use of COTS (commercial, 

off-the-shelf) operating systems (Windows, Linux, etc...) has 

exposed these environments to attacks, incidents and intrusion 

techniques characteristic of traditional IT environments. 

On the other hand, the employment of standard IT technologies can be seen as an opportunity to access the extensive array of standard IT security techniques (intrusion detection 

systems, file scanning, standard hardening techniques) and to 

apply it on these networks. Security techniques honed over 

many years of practical application can now be used to bear on 

security issues new to the critical infrastructures. 

We claim the trade-off between benefits and associated 

challenges to be currently imalanced: standard IT security 

technologies, however robust, cannot protect critical infrastructure as effectively as it is possible in standard enterprise 

IT environments, given the greater amount of variation in existing control systems and communication protocols as well as 

the prevalence of older technologies in operation concurrently 

with newer systems. Moreover, no concrete solutions have 

been proposed so far for addressing the security concerns associated with new technologies such as AMI infrastructures, 

where the introduction of basic security primitives (e.g. encryption and authentication in network communications) does 

not tackle the serious concerns associated to their large scale 

deployment [10], [11], [12]. 

1.1. Specific challenges 

In order to understand the reasons at the root of the ineffectiveness of standard IT security techniques, we need to look 

more in detail at the characteristics of the threat model and of 

the environment being pro¬tected. Many of the incidents 

which have been publicly disclosed in the last years have in 

fact underlying important facts. 

The complexity of the environments is often very difficult 

to handle. For instance, a nuclear plant in Georgia was shutdown for 48 hours as a consequence of a software update in-
NISTIR 7916

136

stalled on a workstation operating in its business network. 

Nobody was aware of the connection between the workstation 

in the business netowkr and the control system on the SCADA 

network, and of the effects caused by this connection. 

Additionally, incidents witnessed in the recent years have 

underlined an unprecedented level of sophistication in the 

threats targeting ICS environments. A prime example of this 

sophistication is the Stuxnet infection, which used four distinct 

and previously unknown zero-day exploits, and leveraged multiple stolen certificates for the injection of its rootkit: when the 

certificate used for the installation of the rootkit was reported 

stolen, and consequently revoked by the Symantec (Verisign) 

Certification Authority, the malware was immediately patched 

remotely to utilize a second stolen certificate. Stuxnet was not 

an isolated incident: in 2011, a threat sharing similar characteristics to Stuxnet was discovered and was shown to have 

been generated by the same authors, or those who have access 

to the Stuxnet source code [7]. 

These examples highlight specific challenges of protecting 

critical infrastructure environments, challenges which can be 

traced back to how critical infrastructure environments differ 

from typical enterprise environments. 

Critical infrastructure environments are very heterogeneous. They include a mix of traditional desktop computers, 

large mainframes, and field devices. These devices are profoundly different in terms of computational power, communication protocols and even in their ability to be managed and 

provisioned (i.e. install new software or upgrades). The manner in which these devices are interconnected can vary 

significantly from company to company (even in the same 

business branch, such as energy) and automated management 

controls are frequently non-existent. Because of this heterogeneity in hardware, software and network topology, the security 

assessment of these environments is particularly challenging. 

Preliminary studies performed on some of these devices have 

shown that the security of those systems has been neglected 

and that a motivated attacker could easily penetrate those systems. 

Many communication protocols are vendor-specific.

While standards exist for many communications protocols 

[13], vendors have added specific extensions to provide additional functionalities. The lack of publicly available information on these extensions and their interactions negatively 

impacts standard security mechanisms, including most Intrusion Detection Systems, which generally rely on signatures for 

the detection of threats, as well as standard vulnerability discovery tools which require knowledge of the protocol 

specifications in order to properly assess the robustness of 

protocol implementations. 

Critical infrastructure environments are very valuable 

targets. Because of their strategic importance, critical infrastructure environments are likely to be targeted by highly motivated and resourceful attackers. The motivation and resources available to individuals interested in compromising 

these systems can be considerably greater than those attacking 

more typical IT environments. Many security practices that 

aim at preventing intrusion by raising their cost (e.g. requiring 

valid signatures to load kernel drivers) may be ineffective 

when dealing with these highly resourceful attackers. 

2. The CRISALIS project 

The CRISALIS project (Critical Infrastructure Security Analysis), is a Research Project funded by the European Commission in the context of the FP7 research framework that aims at 

revisiting the convergence between standard IT systems and 

industrial control systems typically used in the context of the 

power grid from a security standpoint. The project will involve 

in a three-year effort a set of key actors in European academic 

research (EURECOM, Chalmers University, University of 

Twente), in the manufacture of devices (Siemens), in the development of security solutions (Symantec) as well as in the 

deployment and maintenance of national infrastructures 

(ENEL, the Italian energy provider, and Alliander, key actor in 

the deployment of Smart Meters in the Netherlands).

The project is articulated over a set of coherent and pragmatic guidelines: 

• Focus the attention on real-world, targeted attacks 

carried out by resourceful attackers against critical infrastructures. 

• Address two specific, yet interlinked, environ¬ments, 

namely the SCADA systems employed in power generation and distribution as well as the AMI infrastructure employed in in the distribution of electricity to 

consumers. 

• Develop practical solutions and tools, and test these 

tools on real systems.

The project research effort spans over three main themes: (i) 

securing the systems, by means of novel automated analysis 

of CI environments and discovery of new threat vectors; (ii) 

detecting the intrusions, by developing new technologies 

aiming at coping with the heterogeneity of protocols, interactions and devices typical of these systems; (iii) analyzing successful intrusions, by devising techniques to facilitate the 

“post-mortem” analysis of the environments and of specific 

devices. These three research themes are meant to complement 

each other in order to address their respective limitations. Not 

all the security problems can be easily discovered and fixed, 

therefore the need to improve our capability of detecting 

anomalous interactions in these environments. Similarly, not 

all the intrusions can be detected with certainty, therefore the 

need to develop tools to inspect specific devices and detect 

tampering. Key to the uniqueness of the project is a specific 

focus on two main challenges that characterize these environments: 

System complexity. An important transversal research 

theme consists in the development of tools and techniques for 

the automated discovery of the structure and the interactions in 

these environments. This will include protocol learning techniques to address the proliferation of vendor-specific protocol 
NISTIR 7916

137

dialects in these networks, as well as new device fingerprinting 

approaches able to deal with the diversity in the involved devices. 

Validation. In order to guarantee the practicality and the 

general applicability of the developed tools and techniques, 

the CRISALIS project will setup a set of real-world environments for their validation and evaluation thanks to the involvement of critical infrastructure maintainers such as ENEL 

and Alliander. 

The project, set to start on the 1st of March 2012, will ultimately contribute to addressing the current imbalance between 

challenges and opportunities associated to the convergence of 

IT technologies with Industrial Control Systems. If accepted, 

the presentation will present more in depth the research content, the planned methodology and early results of the project. 

References 

[1] J. Weiss, “Control systems cyber security—the current status of cyber 

security of critical infrastructures.” Testimony before the Committee on 

Commerce, Science, and Transportation U.S. Senate, March 2009. 

[2] H. Luiijf, “SCADA good practices for the dutch drinking water sector,” 

TNO DV 2008 C096, March 2008. 

[3] Symantec, “2010 critical infrastructure protection study,” October 2010. 

[Online]. Available: http: //bit.ly/bka8UF 

[4] ——, “The Stuxnet worm.” [Online]. Available: 

http://go.symantec.com/stuxnet 

[5] ——, “Stuxnet: a breakthrough.” [Online]. Available: 

http://www.symantec.com/connect/blogs/ stuxnet-breakthrough 

[6] ——, “W32.Stuxnet variants.” [Online]. Available: 

http://www.symantec.com/connect/blogs/ w32stuxnet-variants 

[7] ——, “W32.Duqu, the precursor to the next Stuxnet.” [Online]. Available: http://go.symantec.com/duqu 

[8] J. Weiss, “Control Systems Cyber Security -The Current Status of Cyber 

Security of Critical Infrastructures,” Testimony before the Committee on 

Commerce, Science, and Transportation U.S. Senate, March 2009. 

[9] F. Cohen, “The smarter grid,” in Proceedings of IEEE Symposium on 

Security and Privacy, vol. 8, 2010, pp. 60–63. 

[10] The FORWARD FP7 project, “Forward whitebook,” January 2010. 

[Online]. Available: http://www.ict-forward.eu/media/publications/ forward-whitebook.pdf 

[11] M. Davis, “Recoverable advanced metering infrastructure,” Blackhat 

USA, 2009. 

[12] R. Anderson and S. Fuloria, “Who controls the off switch?” in IEEE 

International Conference on Smart Grid Communications, October 

2010. 

[13] “Opc foundation.” [Online]. Available: http://www. opcfoundation.org/ 
NISTIR 7916

138
NISTIR 7916

139
NISTIR 7916

140
NISTIR 7916

141
NISTIR 7916

142
NISTIR 7916

143
NISTIR 7916

144
NISTIR 7916

145
NISTIR 7916

146
NISTIR 7916

147
NISTIR 7916

148
NISTIR 7916

149
NISTIR 7916

150
NISTIR 7916

151
NISTIR 7916

152
NISTIR 7916

153
NISTIR 7916

154
NISTIR 7916

155
NISTIR 7916

156
NISTIR 7916

157

11. Understanding the Role of Automated Response Actions to Improve AMI Resiliency

Ahmed Fawaz, Robin Berthier, William H. Sanders Partha Pal

Information Trust Institute and Department of Electrical BBN Technologies

& Computer Engineering Boston, MA, USA

University of Illinois at Urbana-Champaign ppal@bbn.com

Urbana, IL, USA

{afawaz2, rgb, whs}@illinois.edu

Abstract—The smart grid promises better services and higher

reliability but is exposed to new security threats. In particular,

deployment of advanced metering infrastructure (AMI) will vastly increase the attack surface because of the smart meters installed in customer homes. Managing the security of AMI cannot 

be done manually because of its size and complexity. Thus, we 

propose a three-step plan to bring automated responses to AMI. 

Considering the challenges of automated responses, we will develop a taxonomy of response actions in AMI. Then, we will model the response actions in terms of their impact and cost for the 

different actors in the system: customers, administrators, and 

attackers. Finally, we will discuss implementation and evaluation 

requirements for a practical automated response engine for AMI.

Keywords: AMI, CPS, Response action, Cyber security

The adoption and deployment of the smart grid promise customers faster and more reliable service. The smart grid enables 

those improvements through its capabilities for remote control, 

instant detection of blackouts, and accurate state estimation of 

the power grid using phasor measurement units (PMU). Additionally, the smart grid accommodates more customer services, such as real-time pricing, and includes provisions for 

future electrical vehicles. A core component of the smart grid 

is the advanced metering infrastructure (AMI). An AMI is the 

communication solution for smart meters that transmit realtime meter readings to the administrative network and receive 

commands to control service remotely. An AMI enables finegrained detection of blackouts and will thus enable faster customer service.

A typical AMI will allow remote control of every smart meter,

including the ability to turn service off, and in some scenarios

will allow utility companies to control specific appliances in

individual homes as part of environmental programs that offer

reduced prices at certain hours of the day. Moreover, utility

companies will no longer need to have human meter readers

drive around and obtain monthly readings, because readings

will be sent to the utility company frequently from the meters

through the AMI network. Finally, the introduction of smart

appliances that can communicate with smart meters to get 

realtime pricing information means that owners will be able to

control those appliances remotely via the Internet.

AMI presents more security threats than regular cyberphysical systems (CPS) do, as its architecture and services 

allow for a larger attack surface. The attack surface includes 1) 

the corporate network, 2) the wireless mesh network, 3) the 

home area network, and 4) meters that are within the reach of

customers. Possible threats can be classified according to attack scale, ranging from relatively small-scale targeting of 

specific houses (in order to turn off service or specific appliances, such as alarm systems) or stealing of energy (through 

alteration of meter readings or duplication of meters), up to 

large organized crimes that target large geographical regions. 

Moreover, attacks could target the control commands sent by a 

utility to its AMI. Additional security issues also rise from the 

use of the wireless technology for smart meter communication. Additional attacks will be facilitated by the wireless mesh 

network that will be used to connect meters; such networks are 

prone to single points of failure, availability problems, jamming, eavesdropping, man-in-the-middle attacks, and wormhole and black hole attacks [1,3,5].

Compared to traditional IT systems, AMI has stringent requirements in terms of quality of service and security guarantees. Those requirements include:

1. Availability: Utility companies should be able to get the

latest meter readings and send out control commands

within specific time constraints. Moreover, customers

expect the latest pricing to be available.

2. Resilience: AMI provides a critical service to customers. It must be able to work under extreme conditions 

and provide the core service of measuring energy consumption even under attack.

3. Fast recovery: In the event of an attack, a compromise,

equipment faults, or even blackouts, an AMI should allow fast recovery and restoration of service.

4. Size: In the future, a typical AMI could be larger than

any conventional CPS ever built , with millions of 

nodes in cities; this massive size imposes scalability issues for traditional security solutions.

5. Privacy: There are also privacy concerns specific to

AMI, since the readings and commands sent between 

the meter and the utility company reveal private information about customers.

Important efforts (by researchers and by organizations such as 

NERC and NIST) have been made to promote security solu-
NISTIR 7916

158

tions for AMI networks, such as VPNs, encryption [4], and

remote attestation [8]. Such efforts are important, but cannot

completely secure systems, mainly because vulnerabilities can

always be found in the implementations of protocols and applications, or in the human operators who can provide access

to restricted resources unintentionally. Moreover, since meters

are left without real physical protection, tampering with devices may leak secret keys stored in internal memory and thus 

cause security breaches in the network. Consequently, traditional attack prevention solutions have to be supplemented

with detection and mitigation approaches. Our present work

focuses on studying the possibility of a framework that can

automatically respond to cyber intrusions given the requirements of an AMI.

The importance of intrusion detection for AMI is still critical, 

and several approaches have been proposed [2,11]. However, 

intrusion detection is prone to inaccuracies, and monitoring 

such a large number of nodes will rapidly lead to an unmanageable volume of alerts and demands for decisions. The combination of potentially weak detection capabilities and stringent CPS requirements means that to offer strong resiliency 

against cyber-attacks, security solutions have to be proactive. 

For example, the uncertain identification of a suspicious behavior has to trigger the automated deployment of additional 

monitoring capabilities to translate inaccurate reports into actionable information. A variety of automated response solutions have been studied over the past decade [13], but none

have been tailored for the specific requirements of complex

cyber-physical systems such as AMI. Moreover, the practicality of existing solutions is limited, and for multiple reasons, the 

industry has been reluctant to implement sophisticated automated response actions. First, implemented actions are often 

all-or-nothing, meaning that they lack the flexibility to adapt 

to various situations and can lead to dramatic consequences in 

the case of false positives. Second, there is a poor understanding of the impact of response actions in large and complex 

CPS. Third, that lack of understanding can result in vulnerabilities in the response action itself, which could enable attackers 

to game the system and cause automation to do more harm 

than good.

We gained a better understanding of the limitations of current 

automated response solutions by reviewing related work from 

the perspective of practicality for the specific requirements of 

AMI. As a result, we plan to present the following approach to 

bringing efficient and secure automated response to AMI.

The first step, which is in progress, involves development of a 

taxonomy of response actions that suits AMI requirements,

such as always preserving the mission of delivering energy 

and accurately measuring consumption. The taxonomy will 

allow us to construct a set of possible response actions by emphasizing the concept of flexibility. Flexible actions can be

tuned to meet a wide variety of requirements and situations.

This will then guide the development of a practical case study

to design flexible actions for an AMI. The taxonomy has two

high-level categories: 1) learning actions, and 2) modifying

actions. Learning actions are either passive or active and are

designed to gather additional information about security incidents. Learning actions include enabling of additional IDS

sensors with a higher granularity, logging of traffic, or active

sending of probe packets to locate compromised nodes. Modifying actions work to respond to and recover from an attack. 

Modifying actions have two subcategories: recovery actions 

and limiting actions. Limiting actions reduce privileges of a 

given entity, thus reducing its ability to propagate an attack. 

Limiting actions include addition of firewall rules to block a 

meter’s traffic, changes to access privileges to certain resources within a meter, and changes to routes within the mesh 

network to avoid a compromised meter. Recovery actions will 

work to stop attacks and return to a previous working state in 

the system; such responses include application of update

patches, flashing of a clean OS version, and even sending of

field technicians to change a meter.

The second step after building the taxonomy will be to model 

the response actions’ impact and cost. The first task in modeling response actions will be to identify the different actors in 

our system. Usually, security researchers consider the main 

actors to be the attacker and the administrator. However, we 

propose to include customers as well, since they can also be

affected by the attacker’s actions and the administrator’s reactions. An action’s impact can be described as good or malicious, where good actions are those that benefit legitimate

entities (administrators and customers) and negatively impact

illegitimate entities (i.e., attackers) by making it harder for

them to achieve their malicious goals. In order to quantify the

impact of an action, it is necessary to define the cost of the

action. Several researchers have proposed methods to compute

the cost of actions [6,7,10]; some use the difference in the value of a security metric based on dependency graphs between

the system states before and after an action was done. Others

decompose the cost based on the number of unavailable resources, impact on the system, and operation cost. Most research uses a weight matrix for the different confidentiality,

integrity, and availability (CIA) metrics to describe the importance of each security property. Most previous work does

not look into practical ways to compute the cost of an action to

the customer, or consider the time needed to recover as part of

the cost. Moreover, the use of a static matrix to specify the

importance of each security property is highly subjective and

does not provide a method to compute those values based on

the policies of the corporation, or even provide a sense of how

to tweak the values to change the reactions of the system. Additionally, cost assessment in the context of a CPS requires a 

detailed understanding of the interfaces between the cyber and

the physical mechanisms. Because of those limitations, we 

will propose a cost computation method that allows us to consider the cost for customers. It will also allow for flexible cost 

for actions with varying intensity (e.g., rate limiting with a 

variable threshold rate). Moreover, we will propose clear 

methods to generate and tweak the weight coefficients needed 

to compute the cost of an action, as well as include the impact 

on physical systems in the calculation.
NISTIR 7916

159

The next step in this project will be to explore solutions for

automatic selection of response actions at runtime during an

attack. We plan to study the game-theoretic response and recovery engine (RRE) proposed by Zonouz et al. [12]. RRE

models the system as a Stackelberg game [9] between the attacker and the administrator. RRE uses an attack-response tree 

to represent the possible attacker moves and tags each move 

with a set of possible responses. Upon an attacker’s move, 

RRE then computes an optimal strategy for the current security state of the system that maximizes the benefit for the administrator while reducing the benefit for the attacker. Several 

challenges must be addressed before that type of online automated decision-makers become “AMI-ready.” First of all, because of the large size of an AMI, the attack-response tree

representing the system will get much larger than those of

traditional networks, making it difficult for RRE to compute

the optimization. Thus, we need an abstraction to reduce the

search space of RRE for the AMI. The main idea behind the

abstraction is to use the hierarchy within AMI, so we 

willdivide the attack goals into several interim goals that can 

be solved independently within a neighborhood. Then, we will

form another tree that combines several neighborhoods and

decides on high-level actions (e.g., isolating a complete neighborhood). Moreover, RRE does not have provisions for customer costs, and changes are needed to include those costs as 

part of computing the optimal response strategy.

The final contribution of this project will be to discuss how to 

evaluate the framework in a realistic environment. We will

present a set of experiments that we plan to implement in the

TCIPG/Itron testbed. This testbed emulates hundreds of virtualized meters combined with hardware meters, all clustered 

into several neighborhoods (reflecting a realistic AMI). Each 

cluster has a collector that sends the readings back to the head 

end or sends commands from the head end to the meters.

This paper presents a rigorous research plan to study automated response within the unique requirements of an AMI. The 

proposed solution will help utilities improve on services, operation costs, and reliability. Automated responses in AMI will 

reduce the maintenance cost for utilities, as it improves the

ability to troubleshoot the distribution network by providing

situational awareness. Moreover, automated response has the

potential to significantly reduce the load on human operators

by automatically managing low-level alarms generated by

sensors in the network.

REFERENCES

[1] M. Al-Shurman, S. M. Yoo, and S. Park, “Black hole attack in mobile ad

hoc networks,” in Proceedings of the 42nd Annual Southeast Regional

Conference, 2004, pp. 96-97.

[2] R. Berthier, W. H. Sanders, and H. Khurana, “Intrusion detection for

advanced metering infrastructures: Requirements and architectural directions,” in Proc. First IEEE International Conference on Smart Grid

Communications (SmartGridComm), 2010, pp. 350-355.

[3] L. Buttyan and J.-P. Hubaux, Security and Cooperation in Wireless

Networks. Cambridge University Press, 2007.

[4] A. Hahn and M. Govindarasu, “Cyber attack exposure evaluation

framework for the smart grid,” IEEE Transactions on Smart Grid, vol. 2,

pp. 835-843, 2011.

[5] Y. C. Hu, A. Perrig, and D. B. Johnson, “Wormhole attacks in wireless

networks,” IEEE Journal on Selected Areas in Communications, vol. 24,

pp. 370-380, 2006.

[6] W. Kanoun, N. Cuppens-Boulahia, F. Cuppens, S. Dubus, and A. Martin, “Success likelihood of ongoing attacks for intrusion detection and 

response systems,” in Proc. International Conference on Computational 

Science and Engineering (CSE’09), ,2009, pp. 83-91.

[7] N. Kheir, H. Debar, N. Cuppens-Boulahia, F. Cuppens, and J. 

Viinikka,“Cost evaluation for intrusion response using dependency 

graphs,” in Proc. International Conference on Network and Service Security, (N2S’09), 2009, pp. 1-6.

[8] M. LeMay and C. Gunter, “Cumulative attestation kernels for embedded

systems,” in Proceedings of the 14th European conference on Research

in computer security (ESORICS 2009), pp. 655-670, 2009.

[9] P. Paruchuri, J. P. Pearce, J. Marecki, M. Tambe, F. Ordonez, and S.

Kraus, “Playing games for security: An efficient exact algorithm for

solving Bayesian Stackelberg games,” in Proceedings of the 7th International Joint Conference on Autonomous Agents and Multiagent Systems, 

vol. 2, 2008, pp. 895-902.

[10] C. Strasburg, N. Stakhanova, S. Basu, and J. Wong, The Methodology

for Evaluating Response Cost for Intrusion Response Systems, Technical Report 08-12, Iowa State University, 2008.

[11] Y. Zhang, L. Wang, W. Sun, R. C. Green, and M. Alam, “Distributed

intrusion detection system in a multi-layer network architecture of smart

grids,” IEEE Transactions on Smart Grid, vol. 2(4), pp. 796-808, 2011.

[12] S. A. Zonouz, H. Khurana, W. H. Sanders, and T. M. Yardley, “RRE: A

game-theoretic intrusion response and recovery engine,” in Proc.

IEEE/IFIP International Conference on Dependable Systems & Networks (DSN’09), 2009, pp. 439-448.

[13] C. A. Carver, Intrusion Response Systems: A Survey, Department of

Computer Science, Texas A & M University, College Station, TX, 2000.
NISTIR 7916

160
NISTIR 7916

161
NISTIR 7916

162
NISTIR 7916

163
NISTIR 7916

164
NISTIR 7916

165
NISTIR 7916

166
NISTIR 7916

167
NISTIR 7916

168
NISTIR 7916

169
NISTIR 7916

170
NISTIR 7916

171
NISTIR 7916

172
NISTIR 7916

173
NISTIR 7916

174
NISTIR 7916

175
NISTIR 7916

176
NISTIR 7916

177
NISTIR 7916

178
NISTIR 7916

179
NISTIR 7916

180
NISTIR 7916

181
NISTIR 7916

182
NISTIR 7916

183
NISTIR 7916

184
NISTIR 7916

185
NISTIR 7916

186
NISTIR 7916

187
NISTIR 7916

188
NISTIR 7916

189

12. Cyber-Physical Systems Security for the Smart 

Grid
NISTIR 7916

190
NISTIR 7916

191
NISTIR 7916

192
NISTIR 7916

193
NISTIR 7916

194
NISTIR 7916

195
NISTIR 7916

196
NISTIR 7916

197
NISTIR 7916

198
NISTIR 7916

199
NISTIR 7916

200
NISTIR 7916

201
NISTIR 7916

202
NISTIR 7916

203
NISTIR 7916

204
NISTIR 7916

205
NISTIR 7916

206
NISTIR 7916

207
NISTIR 7916

208
NISTIR 7916

209
NISTIR 7916

210
NISTIR 7916

211
NISTIR 7916

212
NISTIR 7916

213
NISTIR 7916

214
NISTIR 7916

215

13. State Estimation and Contingency Analysis of 

the Power Grid in a Cyber-Adversarial Environment
NISTIR 7916

216
NISTIR 7916

217
NISTIR 7916

218
NISTIR 7916

219
NISTIR 7916

220
NISTIR 7916

221
NISTIR 7916

222
NISTIR 7916

223
NISTIR 7916

224
NISTIR 7916

225
NISTIR 7916

226
NISTIR 7916

227
NISTIR 7916

228
NISTIR 7916

229
NISTIR 7916

230
NISTIR 7916

231
NISTIR 7916

232
NISTIR 7916

233
NISTIR 7916

234
NISTIR 7916

235
NISTIR 7916

236
NISTIR 7916

237
NISTIR 7916

238
NISTIR 7916

239
NISTIR 7916

240
NISTIR 7916

241

14. False Data Injection Attacks in Smart Grid: 

Challenges and Solutions
NISTIR 7916

242
NISTIR 7916

243
NISTIR 7916

244
NISTIR 7916

245
NISTIR 7916

246
NISTIR 7916

247
NISTIR 7916

248
NISTIR 7916

249
NISTIR 7916

250
NISTIR 7916

251
NISTIR 7916

252
NISTIR 7916

253
NISTIR 7916

254
NISTIR 7916

255
NISTIR 7916

256
NISTIR 7916

257
NISTIR 7916

258
NISTIR 7916

259
NISTIR 7916

260
NISTIR 7916

261
NISTIR 7916

262
NISTIR 7916

263
NISTIR 7916

264
NISTIR 7916

265
NISTIR 7916

266
NISTIR 7916

267
NISTIR 7916

268
NISTIR 7916

269

15. Conclusion

The goals of the workshop were to look at recent (2 – 3 years) research results and deployment 

experiences that have occurred in cyber-physical areas across multiple industries. (e.g., 

healthcare, manufacturing, automotive, electric smart grid), and to determine if there are security 

requirements that are unique to CPS as opposed to strictly cyber or physical systems. Through 

these presentations on recent CPS cybersecurity research ideas and themes emerged. While 

some of these ideas are more critical from a security and safety technical standpoint, those that 

are policy and business oriented are equally crucial to implementing adequate security within 

CPS.

Attendees heard about the difficulty of detecting attacks on CPS. First, being able to tell the difference between an attack and a system failure can be difficult. Detecting an attack by analyzing 

massive amounts of data is both time consuming and difficult, as well as costly. In addition to 

attacks from outsiders, there are threats from inside sources. Finding malicious code inserted by 

an insider in over 100 million lines of code can be virtually impossible. All of these things make

detecting cyber attacks challenging in CPS.

Many presenters stressed the need for improved resiliency. While attacks to CPS will happen, a

greater question is how will a system perform during and after an attack? Will the CPS continue 

to function at all? What will the consequences be? Without knowing the answers to these questions, building in layers of security and improving resiliency are critical to the continuing operations of CPS, especially when lives are dependent upon this continued operation. While a need 

for improved resiliency is not unique to CPS, the consequences of a system failure can be greater 

(potential loss of life) than in strictly cyber systems.

Enabling robust cryptography in CPS remains a large challenge according to several presenters. 

The distribution, updating, and revocation of cryptographic keys presents a particular challenge 

as many CPS utilize hardware with certain constraints—such as amount of power, bandwidth, 

and processing capabilities—that cyber-only systems do not have. 

Likewise, usability needs to be more widely considered and improved in CPS. Without good 

usability, security measures may be bypassed or users may become inattentive to systems that 

may need immediate attention. While good usability is an important trait in cyber-only systems, 

it becomes critical to systems where poor usability can lead to inattention or accidental misuse in 

a system with physical impacts.

Virtual models are essential to the design and construction/assembly of reliable CPS, which are 

often so complex that testing of prototypes is either prohibitively expensive or impractical. Key 

characteristics of the models that are needed are robustness, with accurate representation of the 

full suite of properties of a CPS and the complicated environments in which they must operate, 

potential for use in verification and validation, and interoperability, allowing the combined use 

of multiple models or component modules. One of the unique impacts of not having usable, robust virtual models of CPS is that many systems rarely get patched as there is no acceptable way 

to foretell what the results of a patch may be to the system, and the possibility of the system be-
NISTIR 7916

270

ing unavailable for some time has financial and safety/health risks that outweigh the risk of not 

patching.

Failures of data integrity in CPS can result in tangible, real-world consequences not commonly 

seen in cyber-only systems. For example, in the military, loss of CPS data integrity can result in 

inaccurate or erroneous resource deployment, weapons targeting, etc. Likewise, a loss of integrity of data in networked medical devices can cause significant harm to a patient. The possible 

physical impacts present a significant, often unique challenge when designing cybersecurity for 

CPS.

Finally, some of the most difficult challenges are those that are not only technical in nature, but 

include business and policy aspects. For instance, producing a persuasive business case for increased cybersecurity efforts can be difficult. Sometimes the likelihood of an incident can seem 

small so small that the cost of the appropriate countermeasures seem too expensive. This points 

to the need for research and development of both better measures for verifiable assurance in 

components and systems and also cyber-economic tools to help assess the costs associated with 

the range of potential cybersecurity incidents. 

In addition to the unique cybersecurity requirements for most CPS for cryptography and modeling, there is also a requirement to keep systems available despite ongoing security incidents. For 

example, turning parts of the Smart Grid off in order to thwart an attack is not possible. In some 

CPS, there is a need to be able to detect small amounts of malicious code within a very large 

overall amount of code. In the semi-conductor example presented, there was a need to find 

1,000 – 2,000 lines of malicious code in 1 to 2 million lines of code, and disposing of “suspect” 

semi-conductors would have had an enormous financial impact for the company.

There is also a need with CPS to consider potential impacts of cybersecurity incidents slightly 

differently. In every CPS, there is a physical action or reaction that is controlled by a cyber system. In many cases, there are many possible physical actions (e.g., modern airplanes have many 

physical actions/reactions controlled by cyber systems). This means that virtually every CPS has 

a health, safety, and environmental (HSE) impact. This makes potential impacts of cybersecurity 

incidents relatively high compared to traditional cyber-only systems. And since many of these 

systems have a high availability need, the choices for possible mitigations can be limited. These 

HSE impacts can also create a need for additional requirements often not needed for cyber-only 

systems, such as the requirement to coordinate with local emergency responders in case of incidents. HSE impacts need to be considered very carefully when identifying cybersecurity requirements for CPS.

The Computer Security Division plans to use the results of this workshop to inform future research, publications, and outreach activities in the area of CPS cybersecurity.

The agenda for the workshop, complete with links to abstracts and slide presentations, may be 

found at http://csrc.nist.gov/news_events/cps-workshop/cps-workshop-agenda_04-03-2012.pdf.