ICT and Powers Systems: An Integrated Approach

Abstract

In last years, an increasing incorporation of Information and Communication Technologies (ICT) into the power systems has been evidenced. ICT have enabled improving the control of the power grid and by consequence the reliability and the flexibility of these systems. Presently, ICT are a key aspect in the smart grids development. Today’s power systems depend on ICT. However, these technologies can fail and are also exposed to threats that can affect their functioning and the operation of the power system. Therefore, it is very important to consider both interconnected infrastructures (electrical power grid and its information and communication system (ICS)) in the modeling, design and security analysis of electrical power systems. In this chapter, some approaches on the interdependencies modeling between these infrastructures are presented. In addition, some methods based in risk and criticality assessment with regards cyber attacks and ICT failures are proposed.

5.1 Appendix 1: ICT Failures and Cyber Attacks

In the following, some cyber-incidents that have interfered power systems’ communications security during the last few years are mentioned

• Tom Donahue, a CIA analyst, in January 2008 warned the electric power sector that cyber attackers had hacked into the computer systems of utility companies outside the United States and made demands, in at least one case causing a power outage that affected multiple cities. He said “We do not know who executed these attacks or why, but all involved intrusions through the Internet”.

• January 2003, an incident occurred when the worm “Slammer” of the Internet infected the monitoring network of the nuclear plant Davis-Besse of First Energy Corporation in Ohio, the reactor happened to be offline. The worm entered the plant network via a contractor’s infected computer connected through a T1 line (telephone dial-up) directly to the plant network, thus bypassing the firewall [82]. The electric utility company lost control of their EMS/SCADA for system nearly 5 h. A later report made by North American Electric Reliability Council (NERC) reached the conclusion that while nothing serious happened as a result, the EMS/SCADA system was not able to communicate with substations and plants, forcing the company operations staff to resort to manual operation of their transmission and generation assets until control could be restored.

• In September 2001, the Nimda worm was circulated widely throughout the world. The NERC know of an electric utility whose EMS/SCADA network was compromised by the Nimda worm. The worm then propagated itself and spread to the internal project network of a major EMS/SCADA vendor via the vendors’ support communications circuit, devastating the EMS vendors’ internal network and launching further attacks against the EMS/SCADA networks of all other customers of the vendor with support communications circuits [83].

• In August 2001, the Code Red II worm successfully compromised the internal network of a company that provides services to NERC and numerous electric utility companies. This worm then attacked customers connected to this company, successfully compromising an exposed web server at one of the utility control centers. It is important to note that the compromised server was presumed to be protected, as it was not exposed to the Internet. This attack was propagated via the private frame relay network connecting the service company, the impacted utility, and the other connected utility companies [83].

• For 17 days, between April 25 and May 11 of 2001, hackers managed to remain undetected after they breached the network of the Folsom, based California Independent System Operator. However, the attacks were limited to a “practice network” and so they posed no threat to the real power grid or the primary power distribution network that handles the Western USA. Although no damage was reported, officials traced the intrusion back to a system in China [84].

• In December 2000 the National Infrastructure Protection Center (NIPC), said that “A regional entity in the electric power industry has recently experienced computer intrusions through anonymous FTP (File Transfer Protocol) login exploitation and the intruders used the hacked FTP site to store and play interactive games that consumed 95% of the organization’s Internet bandwidth”. NIPC added that “the compromised bandwidth threatened the regional entity’s ability to conduct bulk power transactions [85].

A document prepared for the CIGRE Joint Working Group-Security for Information Systems and Intranets in Electrical Power Systems- entitled “Cyber security considerations in power system Operations” said that a significant number of cyber incidents have taken place but only some have been admitted to or described [86]. A sample of incidents showed in this document is given as follows:

• Large Generating Plant Output Reduced to Zero: The control system of a large generating plant operating at a number of 100 MW was infected by a virus and its output was reduced to virtually zero in a few seconds. The infection came from a connected corporate IT network. The solution was to rigorously separate the real-time and corporate networks [86].

• Distribution SCADA System Partly Disabled: A virus infected a lap-top which was used by a maintenance technician to modify a telecoms router. The virus affected all telecom nodes, including some used by a SCADA system. The SCADA system was rendered partially inoperable for a number of days. A partial solution required better management of virus protection on lap-tops [86].

• Unauthorised Access to EMS Applications: A utility gave remote access rights to an EMS supplier. It was observed that application patches had been applied without agreement. No problems arose, but the situation revealed that continuous, non-verified access had remained open to an external [86].

Other Important Facts

• Idaho National Laboratory in USA performed an experiment for the Department of Homeland Security (DHS) in March 2007 in order to evaluate the potential damage resulting from cyberattacks. The laboratory successfully destroyed a generator while conducting an experimental cyberattack. The attack involved the controlled hack of a replicated control system commonly found throughout the American power systems. Members of the House Committee on Homeland Security are concerned that malicious actors could use the same attack vector against large generators and other critical rotating equipment that could cause widespread and long-term damage to the electric infrastructure of the United States.

The following failures or disoperation of ICT functions, which threatened the security of the power system, were cited by the GRID consortium [6, 74].

• Tripping of six 400 kV systems in Vallée du Rhône, France, due to time delay in communication

• Substation outages initiated by transfer trip in Froncle and Pont la Ville, France, due to replayed information by the communication grid operator

• Cyber-security problems in China, two events: loss of measurements from a large number of digital recorders, uncontrolled ramp-up and ramp-down of several hundred megawatts at a hydro power plant

• Loss of dual server at control center due to software changeover

• Loss of communications due to third party lines becoming faulty