Cybersecurity in Power Grids: Challenges and Opportunities

Abstract

Increasing volatilities within power transmission and distribution force power grid operators to amplify their use of communication infrastructure to monitor and control their grid. The resulting increase in communication creates a larger attack surface for malicious actors. Indeed, cyber attacks on power grids have already succeeded in causing temporary, large-scale blackouts in the recent past. In this paper, we analyze the communication infrastructure of power grids to derive resulting fundamental challenges of power grids with respect to cybersecurity. Based on these challenges, we identify a broad set of resulting attack vectors and attack scenarios that threaten the security of power grids. To address these challenges, we propose to rely on a defense-in-depth strategy, which encompasses measures for (i) device and application security, (ii) network security, and (iii) physical security, as well as (iv) policies, procedures, and awareness. For each of these categories, we distill and discuss a comprehensive set of state-of-the art approaches, as well as identify further opportunities to strengthen cybersecurity in interconnected power grids.

Research Needs for Realization of Zero-Carbon Power Grids with Selected Case Studies

“…It was reported in [73,74] that various types of cyberattacks successfully occurred in essential parts of the power grid. This implies that cyber security should be recognized as a critical issue, as comprehensively discussed in [75,76], when moving toward power grid decarbonization.…”

PowerDuck: A GOOSE Data Set of Cyberattacks in Substations

“…Since an integral part of the PowerDuck data set consists of traffic recordings, we use the switch's SPAN port to capture all GOOSE packets passing through the switch. Moreover, as a realistic attack vector in power grids [4], we assume that an attacker controls a device (i.e., a PC) connected to that switch. For the considered measurement scenarios, we connected a voltage measurement of the public power grid to the three IEDs and implemented a circuit breaker emulation.…”

“…based on conventional energy sources to a more decentralized production using renewable energies [4]. However, this evolution also amplifies the risks of cyberattacks since initially air-gapped systems become connected to one another and, in some cases, even to the Internet without implementing sufficient security measures [10].…”

A method for assessing the impact of cyber attacks manipulating distributed energy resources on stable power system operation

“…For the communication between the central control system and the assets standardized protocols such as IEC 60870-5-104 or DNP3 are used. The communication is usually transmitted via exclusive communication channels but neither of these protocols support security mechanisms such as authentication or integrity protection [18]. Also, encryption is not used by a majority of SCADA system operators [19].…”

“…Also, encryption is not used by a majority of SCADA system operators [19]. Although newer standards (e.g., IEC 62351) provide additional requirements for cyber security measures for each protocol, these are usually not implemented [18]. Therefore, the communication links are susceptible to cyber attacks.…”