Cyber Attack Task Force - Final Report - NERC

Defensive Capabilities / Deterrence
phishing email header information, captured network traffic, or other detailed activity. Such
IOCs will be detected by the industry and must be shared with its various partners such as the
ES-ISAC to ‘connect the dots’. The correlation of related indicators of compromise reported
from independent industry members will create an industry view of attacks and will lead to
informed preventative and detective measures which reduce overall risk to the BPS.
Post-Event Analysis (Lessons Learned)
In order to properly prepare for the next security incident it is critical to capture lessons learned
from prior incidents such as Stuxnet, Aurora, Night Dragon, Shady Rat and even events such as
major hurricanes or tornados that resulted in disruptions. The lessons learned process should
strive to identify how to prevent future attacks, prevent or limit disruption if they do occur, and
create early visibility of such attacks through enhanced awareness and security monitoring.
Additionally, analysis of publicly disclosed attacks may provide a level of learning which may be
incorporated into incident response plans, protective measures, resilience activity and
preparedness. The FBI is working with the Pacific Northwest National Laboratory to evaluate
and trend cases related to the electricity sector. The results of this analysis will be an important
reference.
The NERC enterprise-wide event analysis program is based on the recognition that bulk power
system events that occur, or have the potential to occur, have varying levels of significance.
The manner in which registered entities, regional entities, and NERC evaluate and process these
events is intended to reflect the significance of the event and/or specific system conditions
germane to the reliability of the bulk power system and the circumstances involved.
The key ingredients of an effective post-event analysis program are to:
• Identify what transpired – sequence of events;
• Understand the causes of events;
• Understand the vulnerabilities that were exploited;
• Identify and ensure timely implementation of corrective actions;
• Develop and disseminate recommendations and valuable lessons learned to the industry to
enhance operational performance and avoid repeat events;
• Develop the capability for integrating risk analysis into the event analysis process; and
• Feed forward key results to facilitate enhancements in and support of the various NERC
programs and initiatives (e.g., performance metrics, standards, compliance monitoring and
enforcement, training and education, etc.) 26
While the full or partial loss of a single EMS or SCADA system may not result in the blackout
depicted in the task force scenario, analysis of the causes of such a loss could be helpful in
correcting conditions on the utility’s EMS or SCADA system and possibly lead to the
identification of useful lessons learned for the industry. However, in the case of a coordinated
26 NERC Event Analysis Program
Cyber Attack Task Force Report 25