Protection from unseen threats
As the power grid and other systems become smarter and more interconnected with other it infrastructure — such as home appliances, cars, the internet, and, not too far into the future, electric roads, augmented reality glasses and driverless cars — security is crucial.
Passing the lonely hours during a night shift in the national power utility’s control centre, a network transmission operator connects his workstation to the internet and chats with friends over a popular social network. Accustomed to accepting friend requests from strangers, the operator blithely accepts yet another — this time with devastating consequences. He has opened up the network to a hacker who unleashes a national blackout.
This hypothetical cyber-attack scenario was simulated as part of the eu-financed viking project, an investigation of vulnerabilities in supervisory, control and data acquisition (SCADA) systems for critical infrastructure, such as power, water and transport. Mathias Ekstedt, an associate professor from KTH EE’s Industrial Information and Control Systems department, says that a unique dimension to the viking project was its final module, which analysed the cost of cyber-attacks to society. Ekstedt was one of three researchers from different disciplines at KTH EE who collaborated on the Framework 7 Collaborative strep Project, in partnership with eth in Switzerland, ABB ag and EON in Germany, Astron Informatics in Hungary and MML Analys & Strategi in Sweden.
the call for the study stems from the fact that many SCADA systems were not built to connect with general business IT systems or the internet and without a thought given to why anyone would want to penetrate them, Ekstedt says. But, like the fences and walls that have always protected critical infrastructure, IT systems represent a “new surface” for intruders to breach.
“there’s a new way in,” Ekstedt says. “These systems were not built with security in mind, so new competence is needed. The complication is that IT security is very difficult to assess.”
Viking, which underwent its final review in early 2012, provides utilities with models for assessing their risk level and making risk-management calculations. For example, Ekstedt says, a power company using these models could more accurately determine how it should distribute its security resources. “Parts of the it structure can vary in their resiliency and at the same time, the consequences of damage vary according to which part of the infrastructure is attacked,” he says.
To understand the full scope of the problem and to present findings in a context that industry can use, Ekstedt collaborated with the ACCESS Linnaeus Centre senior researchers György Dán, Assistant Professor with the department for Communication Networks, and Henrik Sandberg, associate professor with the Automatic Control department.
Together, they developed models for a SCADA system, for the power grid processes, and for the society that is dependent on the electricity supply. The team then proposed actions to decrease risks. Ekstedt says that although the SCADA model was based on a power grid, such control systems have enough in common with those used in other utilities that several of the models they defined can apply to other kinds of public infrastructure.
Finally, the project results were evaluated on a testbed that simulated the critical infrastructure of a power network and a range of attacks. “We looked at what happens if some attacker goes here and manipulates some part of the system,” Ekstedt says. “We could observe the consequences in the power system and, by using a monetary index that we developed, we could calculate the loss in gross national product.”
The testbed referenced a hypothetical “viking country,” with a power grid and some fictional cities, that could be parameterised to mimic any country in the eu, to some extent, Ekstedt says. “The scenarios were a way of connecting all of the traditional academic models. Taken separately, excellent work was done in each academic domain, but we needed to connect our work for it to meet the needs of industry. The scenarios provided a way of putting the research into context.”
That context is valuable to public utilities, which Ekstedt says require better risk-analysis tools. “Understanding your risks requires better understanding of how vulnerable your system is and what parts need better protection,” he says. “Then you have to understand the connection and impact of the IT asset on the physical world.
“There’s no silver bullet or single method for utilities to follow, but by having better information, they will make us all safer.”
For more information, contact Mathias Ekstedt, email@example.com
Text David Callahan | Photo Istock photo