Mariana Hentea - Building an Effective Security Program for Distributed Energy Resources and Systems

1 Cover

2 Title Page

3 Copyright Page

4 Dedication Page

5 Foreword

6 Preface Volume 1

7 Acknowledgments

8 Part I: Understanding Security and Privacy Problem 1 Security1.1 Introduction 1.2 Smart Grid 1.3 Distributed Energy Resources 1.4 Scope of Security and Privacy 1.5 Computing and Information Systems for Business and Industrial Applications 1.6 Integrated Systems in a Smart Grid 1.7 Critical Smart Grid Systems 1.8 Standards, Guidelines, and Recommendations 2 Advancing Security2.1 Emerging Technologies 2.2 Cybersecurity 2.3 Advancing Cybersecurity 2.4 Smart Grid Cybersecurity: A Perspective on Comprehensive Characterization 2.5 Security as a Personal, Organizational, National, and Global Priority 2.6 Cybersecurity for Electrical Sector as a National Priority 2.7 The Need for Security and Privacy Programs 2.8 Standards, Guidelines, and Recommendations References Part 1

9 Part II: Applying Security Principles to Smart Grid 3 Principles of Cybersecurity3.1 Introduction 3.2 Information Security 3.3 Security‐Related Concepts 3.4 Characteristics of Information 3.5 Information System Characteristics 3.6 Critical Information Systems 3.7 Information Security Models 3.8 Standards, Guidelines, and Recommendations 4 Applying Security Principles to Smart Grid4.1 Smart Grid Security Goals 4.2 DERInformation Security Characteristics 4.3 Infrastructure 4.4 Smart Grid Infrastructure 4.5 Building an Information Infrastructure for Smart Grid 4.6 IT Systems Versus Industrial Control System Infrastructure 4.7 Convergence Trends 4.8 Standards, Guidelines, and Recommendations 5 Planning Security Protection5.1 Threats and Vulnerabilities 5.2 Attacks 5.3 Energy Sector: Threats, Vulnerabilities, and Attacks Overview 5.4 Security Controls 5.5 Security Training and Skills 5.6 Planning for Security and Privacy 5.7 Legal and Ethical Issues 5.8 Standards, Guidelines, and Recommendations References Part 2

10 Part III: Security of Critical Infrastructure 6 Critical Infrastructure6.1 Introduction 6.2 Associated Industries with Critical Infrastructure 6.3 Critical Infrastructure Components 6.4 Energy Sector 6.5 Critical Infrastructure Interdependencies 6.6 Electrical Power System 6.7 Recent Threats and Vulnerabilities 6.8 Standards, Guidelines, and Recommendations 7 Critical Infrastructure Protection7.1 Critical Infrastructure Attacks and Challenges 7.2 The Internet as a Critical Infrastructure 7.3 Critical Infrastructure Protection 7.4 Information Security Frameworks 7.5 NIST Privacy Framework 7.6 Addressing Security of Control Systems 7.7 Emerging Technologies and Impacts 7.8 Standards, Guidelines, and Recommendations References Part 3

11 Part IV: The Characteristics of Smart Grid and DER Systems 8 Smart Power Grid8.1 Electric Power Grid 8.2 Smart Grid: What Is It? 8.3 Smart Grid Characteristics 8.4 Smart Grid Conceptual Models 8.5 Power and Smart Devices 8.6 Examples of Key Technologies and Solutions 8.7 Networking Challenges 8.8 Standards, Guidelines, and Recommendations 9 Power System Characteristics9.1 Analysis of Power Systems 9.2 Analysis of Impacts 9.3 Reliability 9.4 Resiliency 9.5 Addressing Various Issues 9.6 Power System Interoperability 9.7 Smart Grid Interoperability Challenges 9.8 Standards, Guidelines, and Recommendations 10 Distributed Energy Systems10.1 Introduction 10.2 Integrating Distributed Energy Resources 10.3 DER Applications and Security 10.4 Smart Grid Security Goals 10.5 Security Governance in Energy Industry 10.6 What Kind of Threats and Vulnerabilities? 10.7 Examples of Smart Grid Applications 10.8 Standards, Guidelines, and Recommendations References Part 4

12 Part V: Security Program Management 11 Security Management11.1 Security Managements Overview 11.2 Security Program 11.3 Asset Management 11.4 Physical Security and Safety 11.5 Human and Technology Relationship 11.6 Information Security Management 11.7 Models and Frameworks for Information Security Management 11.8 Standards, Guidelines, and Recommendations 12 Security Management for Smart Grid Systems12.1 Strategic, Tactical, and Operational Security Management 12.2 Security as Business Issue 12.3 Systemic Security Management 12.4 Security Model for Electrical Sector 12.5 Achieving Security Governance 12.6 Ensuring Information Assurance 12.7 Certification and Accreditation 12.8 Standards, Guidelines, and Recommendations References Part 5

13 A Cybersecurity Concepts References

14 B Power Grid Concepts B.1 Basic Terms B.2 US Electric Power Industry OverviewB.3 Examples of Power Grid Glossaries References

15 C Critical Infrastructures Concepts C.1 Critical Infrastructures: Plans, Regulations, Frameworks, Programs References

16 D Smart Grid Concepts D.1 US Smart Grid Policy D.2 Smart Grid Definitions and Vision D.3 Examples of Smart Grid Technologies D.4 A Smart Grid Diagram: Past, Present, and Future D.5 Smart Grid Conceptual Model References

17 J Acronyms

18 Index

19 End User License Agreement

1 Chapter 1 Table 1.1 Domains and actors in the Smart Grid conceptual model. Table 1.2 Actor descriptions for the logical reference model. Table 1.3 Electricity sector challenges and potential ICT applications. Table 1.4 Comparison of key attributes of current and future systems.

2 Chapter 2 Table 2.1 CPS characteristics.

3 Chapter 3 Table 3.1 Examples of data characteristics. Table 3.2 System development – quality attributes.Table 3.3 Information security goals.Table 3.4 RMIS model security goals.Table 3.5 List of organizations developing relevant standards for Smart Grid.

4 Chapter 4Table 4.1 Examples of outsourced services.Table 4.2 Detailed architecture services and prioritization.Table 4.3 ICS infrastructure versus IT infrastructure.

5 Chapter 5Table 5.1 Categories of evolving threats to information security.Table 5.2 An example of annual change in threats ranking.Table 5.3 Examples of threats to energy sector and electrical utilities.Table 5.4 Common SCADA vulnerabilities.Table 5.5 AMI security domain description.Table 5.6 Control families.

6 Chapter 6Table 6.1 Examples of critical infrastructure definitions.

7 Chapter 7Table 7.1 Current lead agency assignments.

8 Chapter 8Table 8.1 Comparison of features for the current utility and future utility.Table 8.2 Legacy and Smart Grid functionality comparison.Table 8.3 Today's grid comparison with Smart Grid.

9 Chapter 9Table 9.1 Stability study time frames.Table 9.2 Robustness vs. resilience in power systems.

10 Chapter 10Table 10.1 Entities including and interfacing DERs.

11 Chapter 11Table 11.1 Security program functions.

12 Chapter 12Table 12.1 Capability maturity model (CMM) scale.

13 ATable A.1 Comparison of security terms defined in different glossaries or sta...Table A.2 Recommended definitions of most common security terms.Table A.3 Examples of cybersecurity glossaries provided by different organiza...

14 BTable B.1 Multiscale time hierarchy of power systems.Table B.2 Power grid glossaries.

15 DTable D.1 Examples of smart grid glossaries.

1 Chapter 1 Figure 1.1 Traditional electricity delivery system. Figure 1.2 Functions of the electricity sector. Figure 1.3 Evolution of the electric power grid. Figure 1.4 SmartGrids concept. Figure 1.5 Future network vision. Figure 1.6 General layout of electricity networks. Figure 1.7 Common Smart Grid components. Figure 1.8 NIST conceptual reference model.Public Domain. Figure 1.9 View of the actors within domains of NIST conceptual reference mo... Figure 1.10 Legacy application types within NIST conceptual domains.Publ... Figure 1.11 Smart Grid communication infrastructure. Figure 1.12 Relationships on secure energy infrastructure. Figure 1.13 DER locations scenario.Public Domain. Figure 1.14 Alternative microgrid configurations. Figure 1.15 VPP schematic view. Figure 1.16 Illustration of connected virtual power plants. Figure 1.17 Information systems classification. Figure 1.18 Smart Grid characteristics vs. traditional power system. Figure 1.19 Stylized electricity sector value chain. Figure 1.20 ICT application domains in the Smart Grid. Figure 1.21 OT and IT integration. ERP, Enterprise Resources Planning; EAM, ... Figure 1.22 SCADA general diagram.Public Domain.