Cyberattacks are carried out with malicious intent, and have the potential to compromise the power supply system and render the grid insecure. They can result in equipment maloperation and damage, and may even have a cascading effect leading to a grid blackout. Cyberattacks are staged using the tactics and techniques of initial access, execution, persistence, privilege escalation, defence evasion, command and control, and exfiltration. Once access is gained through privilege escalation, control of information technology (IT) networks and operations of operational technology (OT) systems are hacked into in order to gain access to sensitive operational data, which can be used for malicious purposes.
Identifying risks
In order to mitigate cyberattacks, it is necessary to identify system vulnerabilities and formulate a risk assessment methodology that can help identify all possible entry points for cybersecurity breaches. Multiple testing schemes should be incorporated to check for vulnerabilities. Moreover, using the numerous test bed systems available in the market, a comprehensive analysis of the possible impact of cyberattacks can be done. These test beds use real-time simulation models and intentionally create pseudo cyberattacks to observe the repercussions.
All segments of the power sector are at equal risk of cyberattacks. In the generation segment, a cyberattack poses the risk of compromising valve and plant control, trip protection systems, and fuel stock management. Similarly, the transmission segment is exposed to the risks of supervisory control and data acquisition (SCADA) systems being hacked into, as well as cross-site requests forgery attacks. The distribution segment is vulnerable to situations wherein an attacker switches off millions of smart meters simultaneously from a remote location, risking security misconfiguration and sensitive data exposure, and compromising function-level access control.
An often-ignored aspect of the power sector, which is also vulnerable to cyberattacks, is the telemetry infrastructure, which comprises telemetry systems that connect with the control systems and SCADA architecture of various components in a smart grid. Power system telemetry is highly susceptible to malicious network attacks. Once attacked, the master system is hacked. The slave devices can then be forced to erase critical data.
Based on the analysis of probable threats, utilities need to devise alleviation strategies. Proper security measures and attack-resistant smart grid infrastructure need to be developed and tested. In order to frame resistant and resilient cyber infrastructure, risk evaluation is a crucial process.
Upcoming technologies for grid security
Broadly, there are two major aspects of cybersecurity for all segments of the power sector – data security and network security. With the advent of internet of things (IoT) in power, both of these have been exposed to greater risks of unauthorised access and theft. Newer technologies can come be helpful in handling this vulnerability.
Data loss prevention technologies can be used to prevent sensitive data exfiltration across the cloud and the web using software-as-a-service platforms. These can be coupled with extensive predefined policy libraries for emergencies; and cloud access security broker software, which can perform shadow IT reporting and blocking, conduct in-line inspection, and application programming interface inspection. Such technologies can be used to protect a broad range of devices that use IoT from data theft and unauthorised access.
Network security is highly dependent on firewalls, and these are vulnerable to cyberattacks. New-generation firewalls that use internet protocol (IP) packet fragmentation or transmission control protocol segmentation offer better security against cyberattacks. Further, firewalls that are capable of control for false-positive testing, and web filtering for Quick User Datagram Protocol Internet Connections based on HTTP/3, can improve reliability and stability. Software-defined wide area networks, zero-trust network access application connectors, or generic routing encapsulation and IPsec can be used for site connectivity and access authenticity, providing a secure network.
Conclusion
With the increasing digitalisation of the power system, utilities need to significantly strengthen their cybersecurity frameworks to maintain safe operations. For this, it is crucial for utilities to opt for strong and secure password-protected systems, secure firewalls, intrusion detection and intrusion prevention systems, regular backups of data, vulnerability assessment and penetration testing. A robust cybersecurity policy, manpower training and regular review meetings to check for system vulnerabilities are also paramount.
