Introduction to Cyber-Warfare - Proiect SEMPER FIDELIS

TAKING THE POWER GRID OFFLINE WITH MINIMAL EFFORT: ATTACKS LEVERAGING217an Aurora-style attack. This can be implemented in hardware to avoid a manual attack.Clearly, it would be preferable to also implement time delays for commands sent through acomputer network as well.• Command monitoring on the protective relay: With this technique, the administrator isnotified of certain patterns of open/close commands and can even set policies to providewarnings, prevent breaker closures, enforce time delays, etc.• Implement a second relay: This countermeasure adds a redundant relay to the setup,providing defense in-depth to the generator. The second relay could be operating on adifferent network, utilize different authentication, etc., than the first.• Local generator island detection logic: Here, the rate of change of the frequency ismonitored. When this rate falls outside acceptable ranges (an “island condition”), thegenerator is disconnected.In practice, it will take a combination of measures such as the ones listed above—in additionto solid security practices as described earlier. There are also trade-offs, as an Aurorastyleattack is a high-impact, low-frequency event, any mitigation device must not interferewith normal power operations. For instance, relay-based Hardware Mitigation Devices(HMDs)—which employ protection similar to the methods listed above—are thought to haveexasperated the massive European power failure in November 2006. 16Albeit an experimental test, the Aurora Test successfully demonstrated to the world thata cyber attack could have severe repercussions in the physical world. Further, this test ledto important research on how to better mitigate cyber attacks against the power grid. Likeother attack methods described in earlier chapters of this part of the book, the Aurora Testis a cyber attack directed at a specific piece of industrial equipment. In the next section, we discusshow attacks on key systems in a power grid can lead to more serious failures. These attacksrely on leveraging the topology of the power-grid network to magnify their effects.TAKING THE POWER GRID OFFLINE WITH MINIMAL EFFORT:ATTACKS LEVERAGING NETWORK TOPOLOGYIn the introduction to this chapter, we mentioned how a 2009 paper by Chinese researchersJian-Wei Wang and Li-Li Rong led to comments by the chairman of the U.S.-China EconomicSecurity and Review Commission in 2010 where he stated that the researchers “published apaper on how to attack a small power grid sub-network in a way that would cause cascadingfailure to the entire U.S. west-coast power grid.” 17 A later report in the New York Timesdiscussed the comments and downplayed the significance of the research. 18 Upon a close readof the paper, it becomes apparent that the work of these Chinese researchers is simply a newaddition to an up-and-coming area of academic research where academic researchers studywhere infrastructure topologies are vulnerable to attacks and explore potential mitigationstrategies. It is likely that Chinese researchers studied the power grid of the western UnitedStates because the data was available rather than for purposes of ill will.However this is not to say that attacks leveraging power-grid network topology areunimportant—or not possible. For example, in the summer of 2003, much of the easternUnited States experienced blackouts resulting from a cascading failure that originated in