Raytheon Technology Today 2011 Issue 1

Model – The assessment serves dual purposes.
First, it drives the development of a
comprehensive approach to improving the
overall security posture of the environment
by applying physical safeguards and process-based
mitigation techniques. Second,
it is used to drive a comprehensive model of
the microgrid or the legacy energy system.
The model generates three products:
• The Baseline Report validates the actual
person-based assessment performed
upon the initial engagement of a customer
and the threats against existing safeguards
to establish a baseline residual risk.
• The Mitigation Report allows customers
to determine where to best apply resources
and capital to achieve the highest
return on investment when attempting to
improve the security posture.
• The What If Report allows the security
analyst to evaluate various scenarios that
are driven by possible new threats identified
through open sources, or based on
how a new safeguard may or may not
help improve the overall residual risk of
the environment.
Protect – Raytheon’s protection capability
relies upon the concepts inherent within
traditional command and control systems.
Every asset is monitored for changes from
its established baseline. Any perturbation
results in execution of predefined courses
Perception
Network Topology
Current State
of Environment
Comprehension of
Current State
Human in the
loop process Event
of action (COA) that have been prioritized
based on the type of threat they are
responding to. The results from the application
of COAs are used to refine the
modeling capability, which in turn is used
to refine the COAs.
Raytheon Cybersecurity Tool Suite for
Monitoring and Protection
This effort has driven the evolution and development
of a suite of cybersecurity tools
to identify security-related vulnerabilities
within existing energy systems and mitigate
them before consumers experience any loss
of service. Two key components of the approach
are CIPview and CIPtrol. Through a
wide range of adapters, they can seamlessly
integrate with a customer’s power, HVAC
and IT systems infrastructure.
CIPview, shown in Figure 2, provides
a cyber-oriented situational awareness
view of the energy system’s current security
posture. It integrates eIQnetworks’
SecureVue ® situational awareness platform
and ComplianceVue , its add-on for North
American Electric Reliability Corporation
compliance monitoring, with Raytheondeveloped
fusion and visualization engines.
This provides analysts with an unprecedented
understanding of the current state
of the energy system. Raytheon’s technologies
allow a cyberanalyst to gain insight
into a system’s current threat vectors, their
Feedback
Projection
of Future
CIPview COA Workflow
Figure 2. CIPview and CIPtrol – Integrated situation awareness and command and
control for CIP
Performance
of Action
Decision
Feature
susceptibility to attack, the impact of
possible ongoing attacks, and potential
mitigation actions that may be taken.
Through the fusion and analytical interpretation
of data collected both manually and
from in-line sensors, a visual representation
of the energy system is overlaid with key
data, allowing analysts to quickly and accurately
assess how best to proceed to protect
the system.
CIPtrol facilitates system protection actions
by bringing together Raytheon’s proven
legacy in command and control (C2) with
newly developed capabilities in dynamically
formulating COAs that may be taken either
through manual execution or automatically
by CIPtrol’s protect and launch features. The
key enabler within CIPtrol is PRAETOR.
PRAETOR is Raytheon’s most recent C2
system and is capable of detecting and defending
against cyberattacks or unplanned
system outages in real time. PRAETOR is
an end-to-end C2 solution that improves
enterprise defense and ensures mission effectiveness
in the face of a cyberattack or
other enterprise disruption. PRAETOR employs
a service-oriented architecture design
to ensure easy deployment and integration
with customers’ existing tool sets.
CIPtrol includes a self-learning feature that
fuses the results of actions implemented by
a COA with modeling results to develop
refinements to existing COAs or to support
the dynamic generation of new COAs.
Through this self-feeding loop, CIPtrol’s
ability to respond to attacks and disruptions
continuously improves to minimize the effects
of false positives and maximize energy surety.
Summary
Cybersecurity in all its aspects is becoming
increasingly important to safeguard the
nation's, and the world’s, energy supply and
infrastructure. Raytheon is providing solutions,
by leveraging capabilities developed
to meet the needs of the DoD and other
agencies, for assessing and mitigating
network vulnerabilities and countering
cyberattacks. •
Dan Teijido and Vincent Fogle
RAYTHEON TECHNOLOGY TODAY 2011 ISSUE 1 33