Critical Infrastructure Protection
Securing Electric Grid Control Systems and Assets
NRECA TechAdvantage
March 6, 2014
VIASAT PROPRIETARY
The bright, shiny, clean future awaits
Renewable
Intelligent
Reliable
Efficient
Integrated
Smart Grid
Resilient
Secure
Customer-centric
Distributed
VIASAT PROPRIETARY
2
©2013 ViaSat Inc.
Smart Grid Value Realization
The value of the Smart Grid is realized by merging data from these islands
of automation to achieve a total end-to-end systems view by integrating
information technology and operational technology
IT Enabled Integration
SCADA and Phasor
Measurements
Substation Automation
Distribution Automation
Smart Metering, Demand Response,
Energy Conservation and Distributed
Resources
VIASAT PROPRIETARY
3
©2013 ViaSat Inc.
Smart Grid Systems of Systems Characteristics
» An increasingly smarter
electric grid is characterized
by increasingly complex
systems that are networkcentric, real-time, cyberphysical-social systems
› Thousands of platforms,
operators, users supporting
millions of sensors, decision
nodes, actuators and customers
› Connected through
heterogeneous wired and
wireless networks
› Operating in a dynamic and
evolving threat environment
Adapted from: SEI Ultra-Large Systems Study
VIASAT PROPRIETARY
4
Webearth from www.ibiblio.org/.../de2007/webearth.jpg
©2013 ViaSat Inc. Used with Permission from Southern California Edison
Smart Grid Layered Architecture:
Common Cybersecurity is Mission Critical
» Operational capabilities are
supported by applications and
common services
» Services are available to devices
at the edge of the network and
are event driven
» Communications design allows
for connectivity across multiple
network domains
» Security is end-to-end and
enables systems integration
» Architecture is supported by
common semantic models and
standards
VIASAT PROPRIETARY
5
©2013 ViaSat, Inc.
Smart Grid Control Ecosystem: Increased Attack Surface and Vulnerability
Increasingly Complex and Interconnected across Multiple Domains (ISO to End User)
VIASAT PROPRIETARY
6
ViaSat Communications and Networking
Consumer
Internet Service
Provider
High Capacity
Satellite
Founded in 1986
$1.2B Revenue
Government and
Enterprise
Mobile SATCOM
and Services
2800 Employees
Communications
Technologies
VIASAT PROPRIETARY
7
Information
Assurance and
Cyber Security
©2013 ViaSat, Inc.
Information Assurance Heritage
High Grade
Secure
Modules
DoD/NIST
Certification
SOC
Services and
Technology
VIASAT PROPRIETARY
8
Secure
Networking
Products
Secure
Architecture
Mission Assurance Capability
Using military grade cybersecurity to enhance resiliency
Networked Battlefield
Networked Utility Operations
CIP owners/operators facing transition that DoD started 10+ years ago
VIASAT PROPRIETARY
9
©2013 ViaSat, Inc.
Smart Grid System of Systems (SoS) Communications
Evolution of Smart Grid SoS Architectures
Silos
ESB
Current-state
VIASAT PROPRIETARY
Typical SI Approach
10
Adapter-based
DoD-style
approach
©2013 ViaSat Inc. Used with Permission from Southern California Edison
Common
Standards –based
Internet-style
Case Study
Southern California Edison
The Irvine Smart Grid Demonstration Project
VIASAT PROPRIETARY
Southern California Edison (SCE) is committed to safely
providing reliable and affordable electricity to its customers
On an average day SCE provides power to:
» Nearly 14 million people
» 180 cities in 50,000 square miles
of service area, encompassing 11
counties in central, coastal and
Southern California
» Commercial industrial and
nonprofit customers, including:
VIASAT PROPRIETARY
12
›
5,000 large businesses
›
280,000 small businesses
©2013 ViaSat Inc. Used with Permission from Southern California Edison
California Climate & Energy Policies
Multi-faceted External Forces Impacting Smart Grid Architecture and Deployment
VIASAT PROPRIETARY
13
©2013 ViaSat Inc. Used with Permission from Southern California Edison
SCE Smart grid design goals
» More – increased capabilities
› More capabilities at the edge and enterprise, pervasive automation
» Better – faster, more reliable & secure
› The electric grid is more resilient
› Dynamic control of all security elements allows the system to
adapt to evolving threats
» Easier – usability (convergence, unified control,
visualization, information on demand)
› Tens of Millions of nodes are manageable
› Situational awareness
› Common Services allow for easier integration of new capabilities
and technologies
VIASAT PROPRIETARY
14
SCE Architecture challenges
» How to ensure investments in SG
technologies and systems today are able
to participate in the SG architecture of tomorrow?
» How do legacy systems participate in the SG architecture?
» How do they manage the complexity of the system over
time?
» How to represent an architecture trajectory that decision makers
(policy makers, regulators etc.) can understand?
» How do they represent an architecture that is actionable?
» How do they relate the architecture to the emerging SG market
and standards development efforts?
VIASAT PROPRIETARY
15
Irvine Smart Grid Overview
SCE will demonstrate an integrated, scalable end-to-end smart grid
system (Irvine Smart Grid Demonstration)
VIASAT PROPRIETARY
16
©2013 ViaSat Inc. Used with Permission from Southern California Edison
Define Infrastructure Required for Smart Grid Functions
and Strategy for Organizing Deployment
SCE’s Smart Grid
SG Functions
Management & Control Systems
Cyber Security
DER Integration
Wide Area
Awareness&Control
C-RAS Central
Controller
Wide-Area Control
System
Wide-Area Situational
Awareness System
Energy Management
System
Geographical
Information Systems
Outage Management
System
Distribution
Management System
Advanced Load
Control System
Energy Service
Provider Interface
Customer Information
Systems
AMI Back Office
Systems
SCE.com
Load Control
Cybersecurity is the overarching capability that
enables all domains to
function and interact
Dynamic Pricing
Cust. Information
Provision
Communications Networks
PEV Readiness
Cyber Security
Advanced Vot/VAR
Control
Inter-Utility Network
Automated
Customer Service
High-Speed Backbone
Substation LAN
Premise-Area
Networks
Field Area Network
Adv. Transmission
Protection
High Speed Protection
Communications
AMI Network
Field Devices
Cyber Security
Dynamic Asset
Management
FACTS Devices
Bulk Renewable
Integration
Advanced Outage
Management
Dynamic Asset
Optimization
VIASAT PROPRIETARY
SCE’s Smart Grid consists of
both functions and
infrastructure required to
deliver functions
17
Advanced Robotics
Energy Storage
Phasor Measurement Units
Smart Inverters
Online Transformer Monitors
Advanced Relays
Workforce Computing Devices
Advanced Switching Devices
Smart Distribution Transformers
Advanced Volt/VAR Devices
Customer Premise Devices
PEV Metrology
Smart Meters
Strategy section describes
required infrastructure for
each function and
guidelines for deployment
©2013 ViaSat Inc. Used with Permission from Southern California Edison
Example: Wide Area Situational Awareness & Control
Energy Policies
AB 32
33% RPS
SG Functions
Definition:
DER Integration
Real-time monitoring and automated control of
transmission system conditions, including voltage,
current, frequency, and phase angle through use of
visualization and intelligent alarming tools.
Once-Thru Cooling
Wide Area
Awareness&Control
DG Incentives
Load Control
PEV Adoption
Dynamic Pricing
500 MW Solar Prog.
Cust. Information
Provision
DR Goals
ZNE Buildings
PEV Readiness
SG OIR Information
Advanced Vot/VAR
Control
SB 17
Automated
Customer Service
Self-Healing
Adv. Transmission
Protection
Resist Attack
DG & Storage
Efficiency
Dynamic Asset
Management
Empower
Customers
Bulk Renewable
Integration
Power Quality &
Reduced Outages
Advanced Outage
Management
Enable Markets
Dynamic Asset
Optimization
Enable Intermittency
VIASAT PROPRIETARY
18
Policy Drivers:
AB 32, 20% RPS by 2010, 33% RPS by 2020
Once Through Cooling
Implementation Challenges:
Interconnection of renewables across western grid and
retirement of coastal plants creates need for enhanced
real-time information about transmission system
conditions
Intermittent renewable generation creates sub-second
fluctuations in transmission system power, voltage, and
frequency
SB 17 Characteristics Achieved:
Power quality/reduced outages
Enable intermittency
©2013 ViaSat Inc. Used with Permission from Southern California Edison
Example: Wide Area Situational Awareness & Control
SG Functions
Management & Control Systems
DER Integration
Cyber Security
Wide Area
Awareness&Control
Load Control
Dynamic Pricing
Cust. Information
Provision
C-RAS Central
Controller
Wide-Area Control
System
Wide-Area Situational
Awareness System
Energy Management
System
Geographical
Information Systems
Outage Management
System
•
Distribution
Management System
Advanced Load
Control System
Energy Service
Provider Interface
•
Customer Information
Systems
AMI Back Office
Systems
SCE.com
•
PEV Readiness
Communications Networks
Advanced Vot/VAR
Control
Substation LAN
PMUs
High Speed Backbone
Communications
Back office systems to process
>30 data points/second
Cyber Security
Inter-Utility Network
Premise-Area
Networks
Field Area Network
Automated
Customer Service
High-Speed Backbone
Adv. Transmission
Protection
High Speed Protection
Communications
AMI Network
Field Devices
Dynamic Asset
Management
Possible Future Deployments:
Cyber Security
Bulk Renewable
Integration
Advanced Outage
Management
Dynamic Asset
Optimization
Market Integration
VIASAT PROPRIETARY
Deployment-Ready Infrastructure:
19
FACTS Devices
Advanced Robotics
Energy Storage
Phasor Measurement Units
Smart Inverters
Online Transformer Monitors
Advanced Relays
Workforce Computing Devices
Advanced Switching Devices
Smart Distribution Transformers
Advanced Volt/VAR Devices
Customer Premise Devices
PEV Metrology
Smart Meters
•
Automated Control Systems
©2013 ViaSat Inc. Used with Permission from Southern California Edison
What is CCS?
» CCS is a real-time cyber-security monitoring, detection and response
platform that provides complete network visualisation.
By using sensors and traffic flow analysis it can identify and respond to
suspicious and anomalous behaviour on operational control systems.
VIASAT PROPRIETARY
20
Cybersecurity System Capabilities
Authentication
Authorization
•Role and Group Based Access Control (RBAC)
Accounting
•Security Information and Event Management (SIEM)
•Authenticated communication
•Defense in Depth
Peer to Peer
Quality-of-Trust
Dynamic Scalable
GUI
21
•Continuous device to device trust monitoring
•Cyber & Physical alerts, device health, operator actions
•Trusted Boot, Trusted Network Connect
•Device Bill-of-Health
Integrity
VIASAT PROPRIETARY
•Integrated Operational Public Key Infrastructure (PKI), Identity Management
•Central operations security visualization GUI accessed via web browser
•Multi-Tier Security Operations Capability
•Large scale System Planning and Test Capabilities
Dissemination restricted as described on cover page.
21
TRUST
IS
EVERYTHING
Without TRUST you cannot achieve your operational and
business objectives
QUALITY OF TRUST gives you a metric to determine the
health of your operational networks and systems and be
CONFIDENT about their interaction
VIASAT PROPRIETARY
22
©2013 ViaSat Inc.
Determining QoT
A device has been
authenticated and has joined
the “fabric” of CCS enabled
devices
QoT – Devices are monitoring
each other’s behaviour and
reporting on those that they are
physically and/or logically
connected to.
Status
Quality
of
Trust
Establishes that a device is
what it’s meant to be
Identity
VIASAT PROPRIETARY
23
Bill of
Health
Dissemination restricted as described on cover page.
A device reporting about
itself based on a defined list
of characteristics/attributes
23
Conceptual Operation
Proxy –
CCS-Enabled Gateway
Bump-In-The-Wire
VIASAT PROPRIETARY
24
Bump-In-The-Stack
Security
VIASAT PROPRIETARY
25
Common Cybersecurity Service Concepts
Security Policy Enforcement & Status based on device and function
Device
A
Policies
Device
B
Policies
BoH
HEARTBEAT
INTEGRITY
QoT
ID
QUALITY of TRUST
CERTIFICATE
Status:
Trusted
Questionable
Untrusted
Unknown
Device
C
Policies
VIASAT PROPRIETARY
Status
26
©2013 ViaSat, Inc.
Common Cybersecurity Service Highlights
» The most advanced security system in the energy sector
›
›
›
›
Next generation utility technologies
DoD technology transfer
Best practices from many sectors
Modern SOA style architecture
» The most compliant security system
› NERC CIP Version X
› All Federal Processing Standards (DHS, FIPS)
› NIST Compliant (NISTIR, SP)
» The most scalable and dynamic security system
›
›
›
›
Supports all Grid Applications
Supports current and next generation networking (MPLS)
Supports all major protocols used on the Grid
Modular Construction
VIASAT PROPRIETARY
27
©2013 ViaSat Inc.
CCS Highlights
» Easily Integrated into existing environment
› Supports existing control and IT investments (Directory Services,
Enterprise PKI)
› 8 inflight advanced programs are relying on new services (e.g.
ISGD, Phasor Measurement, SA3, C-RAS, etc.)
› Supports gradual evolution to full compliance over time
» Ease of Use
› AMI Security uses command line and requires vendor support
› CCS has next generation web based graphical user interface
› Enables a powerful and unified security operations center
» IEC has committed to align with CCS principles
› Hosted IEC TC 57 Security Meetings
› New Part to FERC reviewed/recommended 62351
VIASAT PROPRIETARY
28
©2013 ViaSat Inc.
CCS Concepts:
Advanced Visualization & Wide Area Situational Awareness (WASA)
VIASAT PROPRIETARY
29
©2013 ViaSat Inc.
Questions?
Brett Luedde
[email protected]
+1-760-893-3749
VIASAT PROPRIETARY
30
©2013 ViaSat, Inc.