Cyber Attack Task Force - Final Report - NERC

Responses to Attack
staff to locations to determine status and relay information to operators in control centers
would be challenging for an extended period of time.
Once integrity has been verified on end devices and communication paths, connectivity can be
re-established. However, monitoring should be continued to ensure a re-occurrence of the
disruption does not happen nor develop without operator recognition.
Restoration
Restoration from a coordinated cyber attack could introduce conditions that are not normally
encountered during restoration from hurricanes or other
types of probabilistic events.
During a cyber attack and the following aftermath,
responders may be lulled into the false sense of security
that there is only one wave of assault. As with a storm,
once the storm passes, everyone pitches in to begin the
restoration process with a clear and understood recovery
plan. If the attack vector(s) and techniques/tools for the
attack are not fully understood and mitigated, the
attacker could launch subsequent attacks to disrupt
recovery efforts or respond to mitigation efforts. These
later attack waves may hold devastating impact potential
if not understood and expected.
Restoration from a
coordinated cyber attack
could introduce conditions
that are not normally
encountered during
restoration from hurricanes
or other types of
probabilistic events
To ensure the attack vector(s) and methods have curtailed and can’t be restarted, entities may
need to restore application files and operating systems to a safe or trusted release. This can
introduce problems or delay recovery due to any entity installed modifications. In addition,
certain types of attacks can render hardware or other equipment inoperable. Consequently,
new equipment may have to be acquired and installed. Manufacturer assistance may need to
be obtained.
Restoration of situational awareness may have to be manually implemented with staff
physically stationed at key locations until communication with monitoring equipment and
associated telemetry is restored. Restoration may also involve repair or replacement of parts
suffering physical damage from a cyber event. Some of these may require long lead times for
replacement due to supply chain or skilled installation workforce availability issues.
Safety plays an even more important role during recovery than before. Because systems and
equipment may behave unpredictably during restoration, extra caution should be
communicated to staff to make them aware of this issue.
Forensics
Determining the actual cause of an attack is difficult at best even with logs and other
monitoring and intrusion detection capabilities found on business system networks. On the
operational side of the Bulk Power System, equipment and software are not always capable of
capturing information necessary to do a proper forensic analysis. Nonstandard protocols,
Cyber Attack Task Force Report 29