Threat Assessment Ranks Cyber Related Vulnerabilities

challenge is to improve the access controls to the SCADA networks. A solution will make it harder for an attacker to

One of the Department of Homeland Security’s (DHS) most important missions is protecting critical infrastructure. Assessing CI vulnerabilities is critical to strengthening their capabilities and ensuring resiliency. Since most of them are privately owned, the Department partners with the private sector in conducting voluntary, non-regulatory vulnerability assessments (“Critical Infrastructure”, 2015). According to Homeland Security (2015), vulnerability assessments are the foundation National Infrastructure Protection Plan (NIPP) which outlines how the government and the private sector work together to manage risks to achieve security and resiliency goals (“Critical Infrastructure”, 2015). Protecting America’s electrical power grid is especially complicated because all of the other CIs depend on the energy sector’s

Accordingly, this document has been developed to provide information regarding DTL Power and the measures that have been developed and implemented to safeguard its information and information systems from a cyber threat. This document is broken down into several sections that will provide an analysis of DTL Power and the energy sector; as well as the effectiveness of cybersecurity technology/policies in the energy sector, the team’s cyber strategy, and budget.

On March 31, 2016, the U.S. Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI) started a nationwide campaign to warn against the dangers faced by the U.S. utilities against the cyberattacks. According to DHS, there were an estimated 331 hacks or physical attacks against the U.S. power grid from 2011 to 2014. As of February 2016, they are occurring at a rate of once every 4 days. “A major cyberattack on the U.S. electric grid could cause over $1 trillion in economic damage, estimates ThreatTrackSecurity.com.” (MacDonald, 2016, pg. 2).

Sophisticated hackers have expanded their threat matrix to include cyber-attacks on the computer systems used to operate the world’s pipelines. Supervisory Control and Data Acquisition (“SCADA”) systems are increasingly subject to targeted attacks. Cyber-attacks can be perpetrated over the Internet from anywhere in the world and are capable of disrupting safe pipeline operation causing spills, explosions, or fires. The 2008 explosion on the Baku-Tbilisi-Ceyhan oil pipeline in Turkey was reportedly caused by a cyber-attack.

DHS was given the goal to strengthen the cybersecurity of critical infrastructure by increasing the volume and timeliness, as well as improve the quality of, cyber threat information shared between the Federal Government and private sectors. The “sharing of information”

Besides physical security, computer or cyber security is also a potential method of security exploitation, as a variety of information related to data and network infrastructure or SCADA networks are available online. Boyd (2015) wrote in his article, Energy awards $35M to protect power grid from cyber-attacks, that the Department of Energy awarded two research grants totaling $34.7 million to develop cyber security tools and standards to protect the nation 's electricity infrastructure. A team of

The United States is under attack. To be exact, the nation’s power grid is under attack in the form of cyber warfare. On May 21st, 2013 Congressmen Edward J. Markey and Henry A Waxman published a report that provided the findings from information that they had requested from over 150 utility companies (of which 60% responded). More than a dozen utilities reported “daily, constant, or frequent attempted cyber-attacks” (Markey & Waxman) with one utility reporting that they have about 10,000 attempted attacks per month!

Electricity is one of the most productive forces known but it can also be dangerous and detrimental to infrastructure and security of assets across the Nation if it is lost or compromised. Physical and cybersecurity could be described under the steps to ensure the homeland security role is met, however the AEP’s dependence on technology in order to succeed cannot be understated. Every year the cybersecurity realm grows and the support for securing and managing cyber seems to fall further behind. Several high profile attacks affecting financial, healthcare, retail and entertainment industries demonstrate the potential impact of the threats” (AEP 2015, 2). These events do prepare the AEP in assessing our own cybersecurity procedures and resources to determine where we may need to strengthen the defense of our company but also increases our awareness of how real the threat is (AEP 2015, 2).

The explosion of these new technologies, especially an Internet-like communications network, may introduce some new threats to the security of the smart grid. In the smart grid network there are three crucial aspects of security that may be threatened due to the CIA-triad. The CIA-triad comprises on three basic principles of security issues: Confidentiality, Integrity, and Availability [8]. These principles are illustrated in a triangle secure system in Figure 2. The three aspects of the CIA-triad are defined as follows.

Supervisory Control and Data Acquisition System Network systems (SCADA), Distributed Control System (DCS) and Industrial Control Systems (ICS) are examples of controlling their Critical Infrastructure. Because once the hackers are able to gain access to the SCADA Network system and sabotage the system, then the Critical Infrastructure would lead to cyberwar and chaos.

Ozturk and Aubin (2011) mention there are several security vulnerabilities associated with SCADA such as the networking of control systems where breaches in enterprise security can arise if appropriate security controls are not put in place for both networks. Insecure remote connections,

Cyber threats to the energy infrastructure are pervasive. Reports have indicated numerous attempts to enter the nation’s information technology architectures are credible. Is has become common today that threats come from many origins. Some threats are traced from intentional or accidental incidents. Likewise, some threats toward the energy infrastructures come from a disgruntled employee or points of origin traced from foreign nations, seeking opportunities to exploit or cripple the nation’s infrastructures. Additionally, there are threats that attempt to manipulate the power grid profit margins, particularity the electricity sector through deceitful practices by employees. “By changing the reading during this period, they were able

One of common threat agent to industrial control system now days is foreign intelligence agency. These are government agencies and government sponsored groups which are well trained and equipped with the tools to gather information and perform attacks against industrial control systems. These groups use all of the same tactics as cyber criminals such as social engineering, spam, malware, spyware, and other malicious software and tactics to commit espionage and intelligence gathering for their government or

The old generation of electrical power grid has taken care of our needs in the past. However, as our world progress technologically, so do the expectations from different infrastructures around us. Smart grid is an initiative to completely restructure the electrical power grid to meet the current and future requirements of its clients. Upgrading our electrical power grid could bring novel security vulnerabilities into the system. Thus, security is one of the key parts in smart grid technology. Smart grid technology also puts more reliability demands on WAN (wide area network) infrastructures. [1]