text: December 2013

text: December 2013

text: Notice must be taken that this publication represents the views and interpretations of the authors and editors, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the

text: Regulation (EU) No 526/2013

text: . This publication does not necessarily represent state-of the-art and ENISA may update it from time to time. Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication. This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

text: © European Union Agency for Network and Information Security (ENISA), 2013 Reproduction is authorised provided the source is acknowledged.

text: December 2013

text: http://ec.europa.eu/dgs/home-affairs/what-we-do/policies/crisis-and-terrorism/criticalinfrastructure/index_en.htm, accessed 13 Nov 2013. http://en.wikipedia.org/wiki/The_Art_of_War, accessed 13 Nov 2013.

text: December 2013

text: December 2013

text: 9.1 IT Systems and Logical Networks 26

text: 9.1.1 WAN 28 9.1.2 Gateway 29 9.1.3 Home Area Network (HAN) and Zigbee (IEEE 802.15.4) protocol 29 9.1.4 Advanced Metering Infrastructure (AMI) 29 9.1.5 Master Terminal Unit (MTU) and Remote Terminal Unit (RTU)’ 30

text: 9.2 Supply Chain 30

text: 9.2.1 Providers 30 9.2.2 Distribution and Logistics 31 9.2.3 Customers 33

text: December 2013

text: http://www.cen.eu/cen/Sectors/Sectors/UtilitiesAndEnergy/SmartGrids/Pages/default.aspx#, accessed 11 November 2013. 4 http://www.cenelec.eu/aboutcenelec/whatwedo/technologysectors/smartgrids.html, accessed 11 November 2013. 5 http://www.ec.europa.eu/digital-agenda/en/news/eu-cybersecurity-plan-protect-open-internet-and-online-freedomand-opportunity-cyber-security, accessed 28 Nov 2013. 6 http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2013:165:0041:0058:EN:PDF, accessed 28 Nov 2013. 1

text: December 2013

text: http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2012:073:0009:0022:EN:PDF, accessed 3 December 2013. defined in points 3.f and 18 of the Recommendation

text: "Evaluation of available methodologies for a trustworthy network sharing vulnerabilities and threats analysis of Smart Grid and Smart Metering systems among stakeholders" 2

text: December 2013

text: http://ec.europa.eu/energy/gas_electricity/smartgrids/doc/xpert_group1_reference_architecture.pdf, accessed 10 Sept 2013. 3

text: December 2013

text: T Threat

text: Figure 1: Threats targeting an asset by trying to exploit its vulnerabilities.

text: December 2013

text: December 2013

text: http://www.smart-cities.eu/press-ressources.html, accessed 5 September 2013. http://www.mobincity.eu/, accessed 5 September 2013. 6

text: December 2013

text: Rem. Term. Unit Adv. Met. Infr (AMI) Cables

text: (RTU) Smart Grid

text: Metering End Dev. Relays Intellig. Electr. Device (IED) Loc. Netw. Acc. (LNAP) Transformers Smart Progr. Logic Neighb. Netw. Acc. Power Switches Meter (NNAP) Controller (PLC) Earth Switches Emission Control Server Ext. Display

text: Inventory of (ECS) Home Autom. Comp. Sensors Electrical Assets Engineering Workstation Cables Actuators (EWS) Relays

text: Operational Distributed Control System Transformers Status Server (DCS)

text: information about Electrical

text: Power Switches

text: Events Electrical Assets Assets

text: Earth Switches Shortage/Disturbance

text: Information Actuators

text: Alerts Sensors

text: Server PC

text: Network Mobile Device Information (Tablet, Phone, PDA) Topology

text: IP Address System Thin Client

text: Allocation Configuration Printer

text: Inventory of MAC Addresses Switch

text: Client Adv.

text: User Permissions Interr.

text: Information MG

text: Switch Configuration Files Controller

text: Micro Router

text: Security Parameters

text: Hardware Network Operating System

text: Gateway Firewall

text: Device Driver

text: WLAN Acc.

text: Software SSD Point Firmware

text: Smart Grid

text: Mag. Disk Web Server Standard Software Opt. Disk

text: Office Suite Paper

text: Virtual Database

text: File HID

text: Mail Keyboard

text: Terminal Mouse

text: Building Facilities

text: Network Comp

text: Office Aux. room

text: Address Infrastructure

text: Power Collector

text: Authentication Data

text: SaaS (Cloud) Airco

text: IasS (Cloud) Cabling

text: Generator Developer UPS Administrator

text: Electric Vehicle E-Mobility Persons

text: Charging Station Operator

text: Figure 2: Overview of smart grid assets

text: December 2013

text: Routers, Routers, Routers, Routers, Switches, Switches, Routers, Switches, Switches, Switches, Market Firewalls, Firewalls, Firewalls, Servers, Firewalls, Servers, Firewalls, Servers, Servers, Servers, Workstations Workstations Workstations Workstations Workstations

text: Routers, Routers, Routers, Routers, Switches, Switches, Routers, Switches, Switches, Switches, Enterprise Firewalls, Firewalls, Firewalls, Servers, Firewalls, Servers, Firewalls, Servers, Servers, Servers, Workstations Workstations Workstations Workstations Workstations

text: Routers, Routers, Routers, Routers, Switches, Switches, Routers, Switches, Switches, Switches, Operation Firewalls, Firewalls, Firewalls, Servers, Firewalls, Servers, Firewalls, Servers, Servers, Servers, Workstations Workstations Workstations Workstations Workstations

text: Routers, Routers, Routers, Routers, ES Switches, Switches, Routers, Switches, N Switches, Switches, Firewalls, Firewalls, Firewalls, Servers, ZO Station Firewalls, Servers, Firewalls, Servers, Servers, Servers, Workstations Workstations Workstations Workstations Workstations

text: IEDs, Router,

text: Servers, Field RTUs, IEDs RTUs, IEDs RTUs, IEDs RTUs, IEDs Workstations,

text: Actuators and

text: Actuators and Actuators and Actuators and Actuators and Sensors (local

text: Sensors (local Sensors (local Sensors (local Sensors (local communication line

text: communication communication communication communication wired with IEDs or Process line wired with line wired with line wired with line wired with Customer Energy

text: RTUs or IEDs at RTUs or IEDs at RTUs or IEDs at RTUs or IEDs at Management

text: Field level) Field level) Field level) Field level) Systems at Field

text: Generation Transmission Distribution DER Customer Premises

text: Table 1: List of SGAM assets and their decomposition

text: December 2013

text: http://www.enisa.europa.eu/activities/risk-management/evolving-threat-environment/ENISA_Threat_Landscape, accessed 5 September 2013. 14 http://ec.europa.eu/information_society/newsroom/cf/dae/document.cfm?action=display&doc_id=1763, accessed 5 September 2013. http://www.enisa.europa.eu/activities/Resilience-and-CIIP/Incidents-reporting/annual-reports/annual-incident-reports- 2012/at_download/fullReport, accessed 5 September 2013. 9

text: December 2013

text: Bomb attack, threat Natural disaster Natural

text: Disaster Sabotage

text: Environmental disaster Vandalism Fire Deliberate Theft (device, media)

text: Flood physical

text: Polution, dust, corrosion attacks Information leakage, sharing

text: Thunder stroke Unauthorised physical access Unfavourable climatic conditions Fraud Major environmental events

text: Erroneous information sharing, lekage Erroneous use or adminisration of devices, systems

text: Damage, Loss

text: Damage by third party of IT assets Usage of information Damage, corruption from testing from unreliable source

text: Integrity loss of information Unintentional alteration of data Loss of devices, media, documents Unintentional Inadequate design, planning, adaptation Destruction of records, devices, media data damage

text: Information leakage

text: Failures of devices and services Failure, disruption of Internet outage communication links Network outage Failure, disruption of main sypply functions Loss of support services Threats Failures, Malfunction Failure, disruption of Strike service providers

text: Shortage of personnel Malfunction of devices, Energy outage systems

text: Lack of resources

text: Identity theft War driving Unsolicited e-mail Intercepting, Denial of service compromizing emissions

text: Malicious code, activity Interception, Interception of information Social Engineering Hijacking Interferring radiation Nefarious Man in the middle, Abuse of Information Leakage Activity, Abuse session hijacking Generation and use of rogue certificates Repudiation of actions Manipulation of HW and SW Network Manipulation of information reconnaissance, information gathering Misuse of audit tools Replay of messages Falsification of records Misuse of information, information systems Unauthorised use of administration Unauthorized use of copyright material Unauthorised access to systems Legal Failure to meet contractual agreements

text: Unauthorised software installation Violation of laws, breach of legislation Unauthorised use of software

text: Compromising confidential information Abuse of authorizations Hoax Badware Remore activity (execution) Targeted attacks

text: Figure 3: Overview of threats assumed for smart grid assets

text: December 2013

text: http://www.enisa.europa.eu/activities/risk-management/evolving-threatenvironment/ENISA_Threat_Landscape/at_download/fullReport, accessed 11 Nov 2013. http://www.enisa.europa.eu/activities/risk-management/evolving-threat-environment/enisa-threatlandscape-mid-year-2013/at_download/fullReport, accessed 11 Nov 2103. http://www.enisa.europa.eu/activities/risk-management/evolving-threat-environment/enisa-threatlandscape-2013-overview-of-current-and-emerging-cyber-threats/at_download/fullReport, accessed 11 Dec 2013. http://www.energy.ca.gov/2013publications/CEC-500-2013-056/CEC-500-2013-056.pdf, accessed 11 Nov 2013. 11

text: December 2013

text: http://csrc.nist.gov/publications/nistir/ir7628/introduction-to-nistir-7628.pdf, accessed 11 Nov 2013. http://www.ece.ncsu.edu/netwis/papers/13wl-comnet.pdf, accessed 11 Von 2013. 12

text: December 2013

text: http://www.enisa.europa.eu/activities/Resilience-and-CIIP/Incidents-reporting/annual-reports/annualincident-reports-2012/at_download/fullReport, accessed 11 Nov 2013. http://www.etsi.org/WebSite/document/0905_RA%20smart%20grids-Bdef.pdf, accessed 11 Nov 2013. Crisalis Project EU (http://www.crisalis-project.eu/), Deliverable D2.2 Final Requirement Definition. 13

text: December 2013

text: http://www.ijsgce.com/uploadfile/2012/1011/20121011121836539.pdf, accessed 11 Nov 2013. 14

text: December 2013

text: http://www.iitmicrogrid.net/event/greatlake2012/publication/PPTs/32- Smart%20Grid%20Monitoring%20and%20Cyber%20Security/32-ZuyiLi- Load%20Redistribution%20Attacks%20and%20Protection%20Strategy%20in%20Electric%20Power%20Syste ms.pdf, accessed 11 Nov 2013. https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/SmartMeter/PP- SmartMeter.pdf?__blob=publicationFile, accessed 11 Nov 2013. 15

text: December 2013

text: Threat Group Threat Asset Group Asset/Detail Comment

text: Infrastructure Physical attack (deliberate/ intentional) Hardware E-Mobility Persons

text: Bomb attack / threat

text: Fraud Ditto

text: Sabotage Ditto

text: Theft (of devices, storage Ditto

text: media and documents)

text: Information leakage/sharing

text: Unauthorized physical access / Unauthorised entry to premises

text: Coercion, extortion or corruption

text: Hardware Unintentional damage Software (accidental) Information Services

text: Information leakage/sharing due to user error

text: This ENISA contribution to Commission’s EG2 working group is going to be published in short. Upon availability, the URL is going to be referenced.

text: http://di.dk/SiteCollectionDocuments/Virksomhed/Sikkerhed/Presentations/05-Moulinos.pdf, accessed 3 Dec 2013

text: December 2013

text: Erroneous use or administration of devices and systems

text: Using information from an unreliable source

text: Unintentional change of Ditto

text: data in an information system

text: Inadequate design and Ditto

text: planning or lack of adaptation

text: Infrastructure Disaster (natural, environmental) Hardware E-Mobility Persons

text: Disaster (natural earthquakes, floods, landslides, tsunamis)

text: Disaster (environmental fire, explosion, dangerous radiation leak)

text: Flood Ditto

text: Pollution, dust, corrosion Ditto

text: Thunder stroke

text: Water Ditto

text: Unfavourable climatic conditions

text: Major events in the Ditto

text: Damage/Loss (IT Assets) Hardware Software Information Services

text: Damage caused by a third Ditto

text: party Damages resulting from Software penetration testing Information Services Loss of (integrity of) Software Information sensitive information Services Loss of devices, storage Hardware media and documents Facilities

text: Software Destruction of records, devices or storage media Information Services

text: Information Leakage Ditto

text: Failures/ Malfunction Hardware Software Information Services Hardware Failure of devices or systems Software Services

text: December 2013

text: Threat Group Threat Asset Group Asset/Detail Comment Network Failure or disruption of communication links Services (communication networks) Failure or disruption of Facilities main supply Power Airco

text: Failure or disruption of service providers (supply chain) Hardware Malfunction of equipment (devices or systems) Software Services Insecure Interfaces (APIs) Hardware Software Services

text: Infrastructure Outages Hardware Software Services E-Mobility

text: Lack of resources Ditto Persons

text: Loss of electricity

text: Absence of personnel Ditto

text: Strike Ditto Persons

text: Loss of support services

text: Internet outage Ditto

text: Network outage Ditto

text: Eavesdropping/Interception/ Network Hijacking Hardware Software Services Information War driving Network Services Network Intercepting Services compromising emissions Interception of Information Network information Media Interfering radiation HID Displays Electrical Assets Network Replay of messages Services Software Network Reconnaissance Network Information and Information gathering Persons

text: Man in the middle/ Network Services Session hijacking Hardware Software Repudiation of actions Network Services Hardware Software Persons

text: December 2013

text: Network Nefarious Activity/ Abuse Services Hardware Software Person Identity theft Network Services Software Person Unsolicited E-mail Person

text: Denial of service Network Service Software Malicious code/ Software software/ activity Service

text: Person Social Engineering

text: Abuse of Information Ditto

text: Leakage Network Generation and use of rogue certificates Service Software Manipulation of Hardware Software hardware and software Service Information Manipulation of information Service Software Misuse of audit tools Software Information Information Falsification of records Software Information Misuse of information/ information systems Software

text: Unauthorised use or Ditto

text: administration of devices and systems

text: Unauthorized access to the information system / network Information Unauthorized changes of Software records Unauthorized installation Software of software Software Unauthorized use of software Network Compromising confidential information Information (data breaches) Service Software

text: Abuse of authorizations

text: Abuse of personal data Ditto

text: Hoax Ditto

text: Network Badware Information Service Software Remote activity Network Information (execution) Software

text: December 2013

text: Ditto Information

text: Targeted attacks (APTs etc.)

text: Information Legal Software People

text: Violation of laws or Ditto

text: regulations / Breach of legislation

text: Failure to meet Ditto

text: contractual requirements

text: Unauthorized use of copyrighted material

text: Table 2: Association between Threats and smart grid Assets

text: December 2013

text: December 2013

text: Cyber- Employee Hackti- Nation Natural Cyber Corporation Terrorists criminals s vists States Disasters fighters

text: Physical attacks √ √

text: Unintentional √ damage

text: Failures / √ √ √ √ √ Malfunction

text: Eavesdropping / Interception / √ √ √ √ √ √ √ Hacking

text: Legal √

text: Nefarious √ √ √ √ √ √ √ activity / abuse

text: Outages √ √ √

text: Damage / Loss √ √ √ √ √ √ √ (IT-Assets)

text: Disaster √ √

text: Table 3: Involvement of Threat Agents in the threats

text: http://krebsonsecurity.com/2013/06/iranian-elections-bring-lull-in-bank-attacks/ , accessed 13 Nov 2013. http://www.dailymail.co.uk/news/article-2313652/AP-Twitter-hackers-break-news-White-Houseexplosions-injured-Obama.html http://www.mcafee.com/us/resources/white-papers/wp-hacktivism.pdf http://mashable.com/2012/08/10/syrian-electronic-army/

text: December 2013

text: Vast amount of material does exist in this area. The reference give is just an example: http://www.ijarcce.com/upload/2013/july/49-h-marigowdasecurity%20vulnerability%20issues%20in%20wireless.pdf accessed 11 Nov 2013. http://www.tecnalia.com/, accessed 11 Nov 2013. 23

text: December 2013

text: December 2013

text: http://www- 304.ibm.com/jct03001c/procurement/proweb.nsf/objectdocswebview/filesupply+chain+security+white+pap er+and+assessment+guide+april+2004/$file/supply+chain+security+white+paper+and+assessment+guide+ap ril+2004.pdf, accessed 12 Nov 2013. http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=5452993, accessed 12 Nov 2013. http://ieeexplore.ieee.org/xpl/articleDetails.jsp?reload=true&arnumber=6309314, accessed 12 Nov 2013. http://s3.amazonaws.com/sdieee/207-SG-Threats_Vulns_Countermeasure.pdf, accessed 12 Nov 2013. http://www.smartgrid.gov/sites/default/files/doc/files/2012_Cybersecurity_Information_Exchange.pdf, accessed 12 Nov 2013. http://energy.gov/sites/prod/files/oeprod/DocumentsandMedia/14- AMI_System_Security_Requirements_updated.pdf, accessed 12 Nov 2013. http://www.navigantresearch.com/wp-assets/uploads/2013/03/WP-SG10T-13-Navigant-Research.pdf, accessed 12 Nov 2013. http://www.enisa.europa.eu/activities/Resilience-and-CIIP/critical-infrastructure-and-services/smart-gridsand-smart-metering/appropriate-security-measures-for-smart-grids, accessed 2 Dec 2013. 25

text: December 2013

text: December 2013

text: December 2013

text: December 2013

text: December 2013

text: 19,20 10. Encrypt meter data to protect consumer privacy . 19,20 11. Provide integrity protection and origin authentication of meter data . 12. Provide a means of non‐repudiation for consumer demand response programs . 19,20 13. Physical protection security and tamper-protection . 14. Authenticate and integrity check meter firmware and configuration images when updates are provisioned. It is when firmware is being reprogrammed that devices can be most 19,20 vulnerable . 15. Code Signing. It is a mechanism whereby publishers of software and content can use a certificate-based digital signature to verify their identities to users of the code, thus allowing users to decide whether or not to install it based on whether they trust the publisher . 16. Virtual Home Command Exec. Execute all the commands received from the outside world on itself (Virtual Home Command Exec.) before deploying it on the real environment . 17. Authenticate all commands from the head-end to the customer endpoint. The Head‐End manages the information exchanges between external systems, such as the Meter Data 19,20 Management (MDM) system and the AMI network .` 19,20 18. Authenticate all reporting from the customer endpoint to the head-end . 19,20 19. Protect Head‐End systems as if they were critical cyber assets . 20. Implement host‐based Intrusion Detection with software integrity checking of the Head-End 19,20 systems . 21. Perform frequent, irregularly scheduled audits of Head-End outputs to ensure they reflect inputs . 19,20 22. Use strong user authentication on all Head-End systems and log all user actions . 23. Implement safety logic to prevent rapid changes in pricing information sent from the Head-End 19,20 to the customer endpoint . 9.1.5 Master Terminal Unit (MTU) and Remote Terminal Unit (RTU)’ 1. Security Architecture Design . 2. Security features provided by device and system vendors . 19,20 3. Check regularly and see if there is an abnormal operations taking place . 4. Conducting physical security surveys and assessing all remote sites connected to SCADA Network . 19,20 5. Use of firewalls and Demilitarized Zones (DMZs . 19,20 by 6. Implement electronic Perimeter Control means of a more rigorous scheme to implement network protection beyond IDS and Firewall. 7. Use of Intrusion Detection Systems (external and internal), including Domain-Specific IDS . 19,20 8. Proper implementation of IEC-60870 101, IEC-60870 104, DNP 3.0 and Modbus protocols .

text: December 2013 2. Build a common understanding in security with vendors: standards, testing, checking, audits… 36,40 (Work collaboratively with suppliers to refine security requirements.) . 39,36 3. Evaluation of vendors . 36,40 4. Provide strong contractual language in Request for Proposals (RFPs . 5. Implement the security features provided by device and system vendors. Many SCADA systems (old) in use have no security features whatsoever. SCADA system owners must insist that their system vendor implement security features in the form of product patches or upgrades. Some newer SCADA devices are shipped with basic security features, but these are usually disabled to ensure ease of installation. Analyse each SCADA device to determine whether security features 36,37 are present . 36,40 6. To ensure the secure device design . 7. Develop database of components and too with all the discrete components, though this can be difficult to maintain with thousands of components . 36,39 8. To make available to vendors devices to track end of life of their products . 9. Provide regular feedback for terminal/port operator regarding supply chain security requirements and performance . 10. Test proactively terminal operators’ supply chain security capabilities . 11. Control access to order and shipment information . 12. Inform the consumers of how information collected from them will be used . 13. Provide the consumers with clear instructions on how to use the privacy safeguards offered, such as a secure login and password, as well as how to de-enrol or delete personally identifiable information relating to them . 14. Require verification of carrier and driver prior to allowing entry . 15. Use Radio Frequency (RFDC) to track storage and retrieval of product and movement by employee . 16. Have backup power for key operational areas and high-value cargo areas . 17. Establish alternative source as part of contracting process . 18. Require contractually electronic seals for monitoring access to containers . 19. Employ closed-circuit monitoring of cargo loading process with recordings to be maintained for a specified period . 9.2.2 Distribution and Logistics 1. Include specific supply chain security requirements in contracts as a condition for acceptance . 2. Mandate that suppliers adhere to established standards, help them to do it and supervise periodically . 3. Include appropriate language in contractual agreements to safeguard consumers . 4. Have information regarding customer supply chain security concerns and to develop implications . 5. Work collaboratively with suppliers to refine security requirements . 6. Replicate best practices and results among trading partners . 7. Pre-screen potential suppliers with security capabilities as a major consideration . 31

text: December 2013 8. Demand transparency and visibility across the supply chain . 9. Adequate control in all the points: Supplier, Terminal/Port Operator, Carrier, Customer . 10. Require use of closed-circuit video monitoring of facilities, docks, and cargo . 11. Monitor the process closely during the cargo loading process and transportation journey and record it for a specific period of time . 12. Automate the chain of custody . 13. Record and reports detected deviations from approved transport routes . 14. Secure the cross-border supply chains . 15. Inspect products and containers at the points of origin and maintain cargo integrity . 16. Require Supply Chain Event Management (SCEM) capability to proactively manage transport movements . 17. Use Radio Frequency (RFDC) to track storage and retrieval of product and movement by employee . 18. Have extensive policies such as two drivers, use of GPS, escorted service, driver security training, and route varying for high-risk shipments . 19. Require verification of carrier and driver prior to allowing entry . 20. Require approval by firm security of any deviation from approved transport routes . 21. Require satellite tracking of trucks and containers as a condition of contract . 22. Use tracking and protocols to allow real-time notification of diversion to security and law enforcement . 23. Check systematically containers prior to release for re-use . 24. Have a mode-shifting protocol to accommodate unexpected delays, interruptions and disasters . 25. Plan to guarantee continuous supply of critical components to the customers . 26. Employ backup power supply for operations and security systems . 27. Establish comprehensive metrics for evaluating supply chain security performance and makes them available . 28. Test and review regularly, objectively and proactively carrier supply chain security capabilities and response plans . 29. Perform unannounced inspections/assessments or validation by third party . 30. Acquire comprehensive education regarding the role in enhancing supply chain security . 31. Have a comprehensive “code of ethics” regarding supply chain security practices . 32. Train personnel to observe for signs of employees who might respond to coercion . 33. Require contractually international carriers to transmit electronic crew and cargo manifests . 34. Identify supply chain security education initiatives and have a formal plan for moving employees through the program . 35. Participate actively in cross-organizational initiatives to develop and influence governmental supply chain security policies .

text: December 2013 36. Take active role in initiatives to educate and exchange information with government officials responsible for enhancing supply chain security . 37. Take active role in guiding and providing feedback for government initiatives to enhance supply chain security initiatives . 38. Provide carrier drivers with comprehensive education regarding their role in enhancing supply chain security . 39. Adjust processes based on government security levels . 40. Provide facility security using a combination of passive and active measures including fences, locks, video, and human inspections . 41. Establish an Internet supply-chain-theft report that contains all the information to be reported to law enforcement . 42. Employ redundant communications system for critical incident management . 43. Define procedures and conditions for notifying customs and other law enforcement agencies regarding shortages, overages, anomalies, or illegal activities . 44. Centralize responsibility for supply chain security management with a high-visibility crossfunctional team . 36,41 45. Keep the integrity and confidentiality of system data .

text: December 2013 5. Requires verification of carrier and driver prior to allowing entry . 6. Document receiving discrepancies using electronic and video means . 7. Require matches for production and inventory receipt quantities . 8. Require proper weighing, counting, and documenting of cargo equipment verified against manifest documents .

text: December 2013

text: December 2013

text: December 2013

text: December 2013 o Local Network Access Point (LNAP). o Neighbourhood Network Access Point (NNAP). o External Display. o Home Automation Components. o AMI Head End (Advanced Metering Infrastructure).  Servers: related with hardware, computer hardware that holds the necessary software to run an infrastructure.  Clients: devices from which personal staff, end users and potential clients will connect with available applications: o PC. o Notebook. o Tablet. o ThinClient. o PDA. o (Mobil-)Phone. o Printer. o Smart Appliances and Equipment (Customer): home appliances and devices (i.e., thermostats, pool pumps, clothes washers/dryers, water heaters, etc.) that use wireless technology to receive real-time data from the AMI system to control or modulate their operation.  Network Components: physical devices needed for the correct functioning of the network: o Advanced Interrupting Switch: switches or technologies that can detect and clear faults more quickly or without a traditional reclosing sequence. o Switch. o Router. o Bridge. o Repeater. o Modem. o Gateway. o Firewall. o WLAN Access Point.  Media: physical support to storage the information: o Semiconductor Storage. o Magnetic Storage. o Optical Storage o Paper

text: December 2013 o Human  Displays: devices to present the information to the user: o Monitor o Beamer  Human Interaction Devices (HID): devices to let the user introduce information to the system. o Keyboard o Mouse A main issue talking about hardware is the supply chain. For the critical hardware, the supply chain should be controlled by the owner of the infrastructure.

text: December 2013 vehicles and fleets. Powertrain technologies include full electric vehicles and plug-in hybrids, as well as hydrogen fuel cell vehicles that convert hydrogen into electricity. The main assets are:  Electric Vehicle Charging Station.  Vehicles

text: December 2013

text: Threat Group Threat Threat details Threat Agent Trend Comments

text: Physical attack (deliberate/ intentional) Bomb attack / threat Fraud

text: Fraud by Employees Increasing employees Sabotage Corporations Cybercriminals Employees Hacktivists Nation States Terrorists

text: Vandalism Employees Terrorists Rioter

text: Theft (of devices, storage media and documents)

text: Theft of Corporations Increasing mobile devices Employees (smartphones/ Nation States Stable (theft tablets) Terrorists internal staff) Theft of other Corporations Stable hardware Employees Nation States Terrorists

text: Information Corporations Increasing leakage/sharing Cybercriminals Employees Hacktivists Nation States Terrorists

text: Unauthorized Employees physical access / Hacktivists Unauthorised Terrorists

text: entry to premises

text: Coercion, extortion Corporations or corruption Cybercriminals Employees Hacktivists Nation States Terrorists

text: Threats that have been assigned a trend are the ones that have been encountered within the ENISA Threat Landscape 2012.

text: Terrorists as a Threat Agent: Based on the publicly available information resources, the profile of cyber terrorists still seems to be blurry due to lack of concrete evidence. There are opinions in the literature that cyber criminals and cyber terrorists are involved in similar activities with the difference being solely in their content. On the other hand, it is reported that terrorists are involved mostly in sabotage attacks against high impact targets and their capability resources vary from low to average. Finally, it is often reported that cybercriminals can be engaged by individuals with terroristic motive to perform an attack on their behalf.

text: December 2013

text: Unintentional damage (accidental) Information leakage/sharing due to user error

text: Accidental Employees Increasing leaks/sharing of data by staff Mobile privacy Employees Increasing and mobile applications Web Employees Increasing applications Network Employees Increasing Erroneous use or Overall administration of increasing devices and (additional systems mobile devices)

text: Decreasing (as Internal threat) Errors in Employees maintenance Configuration/ Employees installation error Technological Employees obsolescence Increasing Employees recover time Unpatched Employees software (delayed patching processes) Using information Employees

text: from an unreliable source

text: Unintentional Employees

text: change of data in an information system

text: Inadequate design Employees

text: and planning or lack of adaptation

text: Disaster (natural, environmental)

text: Disaster (natural NA

text: earthquakes, floods, landslides, tsunamis)

text: Disaster NA

text: (environmental fire, explosion, dangerous radiation leak)

text: Fire NA Flood NA Pollution, dust, NA

text: December 2013

text: Thunder stroke NA Water NA Unfavourable NA

text: climatic conditions

text: Major events in NA

text: the environment

text: Damage/Loss (IT Assets)

text: Damage caused by Security Third party Increasing a third party failure by third provider party Damages resulting Third party from penetration provider

text: Loss of (integrity Loss of Corporations Increasing of) sensitive integrity of Cybercriminals information certificates Employees Hacktivists Nation States Terrorists

text: Loss of devices, storage media and documents

text: Mobile Corporations Increasing devices Cybercriminals Employees Hacktivists Nation States Terrorists

text: Storage media Corporations Increasing Cybercriminals Employees Hacktivists Nation States Terrorists

text: Documentatio Corporations n of IT Cybercriminals Infrastructure Employees Hacktivists Nation States Terrorists

text: Destruction of records, devices or storage media

text: Infection of Corporations Increasing removable Cybercriminals media Employees Hacktivists Nation States

text: Abuse of Corporations Increasing storage Cybercriminals Employees Hacktivists Nation States

text: Information Leakage

text: Mobile data Corporations increasing and data of Cybercriminals mobile Employees

text: December 2013

text: applications Hacktivists Nation States Terrorists

text: Web privacy Corporations and web Cybercriminals applications Employees Hacktivists Nation States Terrorists Network Corporations increasing traffic Cybercriminals Employees Hacktivists Nation States Terrorists

text: Failures/ Malfunction Failure of devices or systems

text: Defective data NA media Hardware NA failure Failure of NA applications and services

text: Failure or disruption of communication links (communication networks)

text: Failure of NA cable networks Failure of NA wireless networks Failure of NA mobile networks Failure or NA

text: disruption of main supply

text: Failure or NA

text: disruption of service providers (supply chain)

text: Malfunction of NA

text: equipment (devices or systems) Insecure Interfaces (APIs)

text: Lack of resources NA Loss of electricity NA Absence of NA

text: Strike NA Loss of support NA

text: December 2013

text: Threat Group Threat Threat details Threat Agent Trend Comments services

text: Internet outage NA

text: Network outage

text: Outage of NA cable networks Outage of NA wireless networks Outages of NA mobile networks

text: Eavesdropping/Inter War driving Search and ception/ Hijacking cartography of free Wi-Fi networks with the objective to abuse them. Intercepting Numerous Corporations compromising devices use Cybercriminals emissions air-interfaces Employees (Wi-Fi, Hacktivists Bluetooth, Nation States Infrared, etc.). Terrorists These can be abused.

text: Interception of information

text: Corporate Corporations Decreasing Espionage Employees Nation States

text: Unsecured Wi- Corporations Fi, rogue Cybercriminals access points Employees Hacktivists Nation States Terrorists

text: Interfering High Corporations radiation frequency Nation States devices (e.g. Terrorists displays) radiate. This information can be misused. Replay of Cybercriminals messages Employees

text: Network The activity to Corporations To be taken Reconnaissan-ce collect Cybercriminals seriously in and Information sufficient Employees the middle gathering information Hacktivists term. from Nation States legitimate Terrorists channels about the structure of a network. Man in the Corporations Increasing middle/ Session Cybercriminals hijacking Employees Hacktivists

text: December 2013

text: Nation States Terrorists

text: Repudiation of Corporations actions Cybercriminals Employees Hacktivists Nation States Terrorists

text: Nefarious Activity/ Identity theft Credentials Corporations Overall Identity Abuse stealing Cybercriminals increasing theft, trojans Employees (with some achieved by Hacktivists stability/ exploiting Nation States decrease in existing Terrorists reported vulnerabilitie cases) s via threats, especially Trojans over private PCs.

text: Unsolicited E-mail

text: SPAM Cybercriminals Decreasing/ Stable

text: Unsolicited Cybercriminals Stable/ infected e- Increasing mails

text: Denial of service

text: Plain denial of Cybercriminals Increasing service (DoS) Hacktivists (e.g. against application services of critical infrastructure) Distributed Cybercriminals Increasing DoS (DDoS) Hacktivists

text: Malicious code/ software/ activity

text: Search Engine Cybercriminals Increasing Poisoning Exploitation of Cybercriminals Increasing fake trust of social media

text: Worms/Trojan Corporations Increasing s Cybercriminals (strongly for Nation States mobile devices) Mobile Cybercriminals Increasing malware Hacktivists strongly Nation States

text: Alternation of Corporations Increasing software Cybercriminals Employees Hacktivists Nation States

text: Infected Corporations trusted mobile Cybercriminals apps Employees Hacktivists Nation States

text: December 2013

text: Elevation of Corporations privileges Cybercriminals Hacktivists Nation States

text: Phishing Corporations Stable/ attacks Cybercriminals Decreasing Employees Hacktivists Nation States Terrorists

text: Web injection Corporations Increasing attacks (Code Cybercriminals injection: SQL, Hacktivists XSS) Nation States

text: Exploit Kits Corporations Increasing Cybercriminals Hacktivists Nation States

text: Social Engineering

text: Rogue security Cybercriminals Increasing software/ Hacktivists Rogueware/ Scareware

text: Ransomware Cybercriminals Increasing

text: Abuse of Information Leakage

text: Leakage Corporations affecting Cybercriminals mobile privacy Employees and mobile Hacktivists applications Nation States

text: Leakage Corporations affecting web Cybercriminals privacy and Employees web Hacktivists applications Nation States

text: Leakage Corporations affecting Cybercriminals network traffic Employees Hacktivists Nation States

text: Generation and use of rogue certificates

text: Loss of Corporations Increasing (integrity of) Cybercriminals sensitive Hacktivists information Nation States

text: Man in the Cybercriminals Increasing middle/ Hacktivists Session Nation States hijacking Social Corporations Increasing Engineering Cybercriminals (e.g. install Employees

text: December 2013

text: fake trust OS Hacktivists updates) Nation States

text: Manipulation of hardware and software

text: Anonymous Corporations Increasing proxies Cybercriminals Hacktivists Nation States

text: Abuse of Corporations computing Cybercriminals power of Hacktivists cloud to Nation States launch attacks (cybercrime as a service)

text: Abuse of 0- Corporations day Cybercriminals vulnerabilities Employees Hacktivists Nation States

text: Access of web Cybercriminals sites through chains of HTTP Proxies (Obfuscation)

text: Manipulation of information

text: Misuse of audit Corporations tools Cybercriminals Employees Hacktivists Nation States

text: Falsification of records

text: Misuse of Corporations Increasing information/ Cybercriminals information Employees systems Hacktivists Nation States

text: Unauthorised use Corporations or administration Cybercriminals of devices and Employees systems Hacktivists Nation States

text: Unauthorized Network Corporations Stable/ access to the Intrusion Cybercriminals Decreasing information Employees system / network Hacktivists Nation States

text: Unauthorized Cybercriminals

text: changes of records

text: Unauthorized Drive-by Corporations Increasing installation of download / Cybercriminals software malicious URLs Employees Hacktivists Nation States

text: December 2013

text: Unauthorized use Corporations of software Cybercriminals Employees Hacktivists Nation States

text: Compromising Corporations Increasing confidential Cybercriminals information (data Employees breaches) Hacktivists Nation States

text: Abuse of Corporations Stable/Decre authorizations Cybercriminals asing Employees Hacktivists Nation States

text: Abuse of personal data

text: Hoax False rumour Corporations and/or a fake Cybercriminals warning Employees Hacktivists Nation States Terrorists

text: Badware Spyware or Corporations deceptive Cybercriminals adware Nation States

text: Remote activity (execution)

text: Remote Corporations Increasing Command Cybercriminals slowly and Execution Employees steadily Hacktivists Nation States Terrorists

text: Botnets / Corporations Increasing Remote Cybercriminals activity Employees Hacktivists Nation States Terrorists

text: Targeted attacks (APTs etc.)

text: Spear phishing Corporations Increasing attacks Cybercriminals Nation States

text: Installation of Corporations Stable/ sophisticated Cybercriminals Increasing and targeted Nation States malware

text: Legal Violation of laws Corporations Increasing or regulations / Cybercriminals Breach of Employees legislation Nation States

text: Failure to meet Employees

text: contractual requirements

text: December 2013

text: Unauthorized use File Sharing Corporations Increasing of copyrighted services Cybercriminals material Employees Nation States

text: December 2013

text: SOURCES Smart grid Information Enhancing Security Threat 20 Assurance and Security 21,37,38,39,40,41,42 Threat Threat details NIST Throughout the Supply Other Group 36 Technology Assessment Chain (IBM Center) 19 (Sacramento State) Physical Bomb attack / threat [9.1].1-2 // [9.1].4 // [9.2.1].1 // [9.2.1].7-19 [9.1].1-4 // [9.1].6-11 // [9.1].12 // [9.1].14 // attack [9.1].8 // [9.1].10-17 // // [9.2.2] // [9.2.3].1 // [9.1].13 // [9.1].15 // [9.1].20-22 // [9.1].23 // (deliberate/ [9.1].22 // [9.1].26-29 // [9.2.3].5-8 [9.1].16 // [9.1].17 // [9.1].24 // [9.1].26 // intentional) [9.1].31 // [9.1].33-35 // [2.1.].22-24 // [9.1].26-35 [9.1].28 // [9.1].35 // [9.1.4].13 // [9.2.1].1 // [9.1.4].13 // [9.1.5].4 // [9.2.1].1 // [9.2.2].45-47 // [9.2.2].49 Fraud Cheating customer [9.1].1-2 // [9.1].4 // [9.2.1].1 // [9.2.1].7-19 [9.1].1-4 // [9.1].6-11 // [9.1].12 // [9.1].14 // (Reverse [9.1].8 // [9.1].10-15 // // [9.2.2] // [9.2.3].1 // [9.1].13 // [9.1].15 // [9.1].20-22 // [9.1].24 // engineering) [9.1].22 // [9.1].26-29 // [9.2.3].3 // [9.2.3].5-8 [2.1.].22 // [9.1].24 // [9.1].26 // [9.1].28 // [9.1].31 // [9.1].33-35 // [9.1].26-35 // [9.1.4].13 // [9.1].35 // [9.2.1].1 // [9.1.4].13 // [9.2.1].1 // [9.1.5].4 // [9.2.2].45-47 // [9.2.2].49 [9.2.3].3-4 // [9.2.3].3-4 Cheating companies [9.1].1-2 // [9.1].4 // [9.2.1].1 // [9.2.1].7-19 [9.1].1-4 // [9.1].6-11 // [9.1].12 // [9.1].14 // [9.1].8 // [9.1].10-17 // // [9.2.2] // [9.2.3].1 // [9.1].13 // [9.1].15 // [9.1].20-22 // [9.1].24 // [9.1].22 // [9.1].26-29 // [9.2.3].5-8 [9.1].16 // [9.1].17 // [9.1].26 // [9.1].28 // [9.1].31 // [9.1].33-35 // [2.1.].22 // [9.1].24 // [9.1].35 // [9.2.1].1 // [9.1.4].13 // [9.2.1].1 [9.1].26-35 // [9.1.4].13 // [9.2.2].45-47 // [9.2.2].49 [9.1.5].4 // Sabotage [9.1].1-2 // [9.1].4 // [9.2.1].1 // [9.2.1].7-19 [9.1].1-4 // [9.1].6-11 // [9.1].12 // [9.1].14 // [9.1].8 // [9.1].10-17 // // [9.2.2] // [9.2.3].1 // [9.1].13 // [9.1].15 // [9.1].20-22 // [9.1].23 // [9.1].22 // [9.1].26-29 // [9.2.3].5-8 [9.1].16 // [9.1].17 // [9.1].24 // [9.1].26 // [9.1].31 // [9.1].33-35 // [2.1.].22-24 // [9.1].26-35 [9.1].28 // [9.1].35 // [9.1.4].13 // [9.2.1].1 // [9.1.4].13 // [9.1.5].4 // [9.2.1].1 // [9.2.2].45-47 //

text: December 2013

text: SOURCES Smart grid Information Enhancing Security Threat 20 Assurance and Security 21,37,38,39,40,41,42 Threat Threat details NIST Throughout the Supply Other Group 36 Technology Assessment Chain (IBM Center) 19 (Sacramento State) [9.2.2].49 Vandalism [9.1].1-2 // [9.1].4 // [9.2.1].1 // [9.2.1].7-19 [9.1].1-4 // [9.1].6-11 // [9.1].12 // [9.1].14 // [9.1].8 // [9.1].10-15 // // [9.2.2] // [9.2.3].1 // [9.1].13 // [9.1].15 // [9.1].20-22 // [9.1].23 // [9.1].17 // [9.1].22 // [9.2.3].5-8 [9.1].17 // [2.1.].22-24 // [9.1].24 // [9.1].26 // [9.1].26-29 // [9.1].31 // [9.1].26-35 // [9.1.4].13 // [9.1].28 // [9.1].35 // [9.1].33-35 // [9.1.4].13 [9.1.5].4 // [9.2.1].1 // [9.2.2].45-47 // // [9.2.1].1 [9.2.2].49 Theft (of devices, [9.1].1-2 // [9.1].4 // [9.2.1].1 // [9.2.1].7-19 [9.1].1-4 // [9.1].6-11 // [9.1].12 // [9.1].14 // storage media and [9.1].8 // [9.1].10-15 // // [9.2.2] // [9.2.3].1 // [9.1].13 // [9.1].15 // [9.1].20-22 // [9.1].23 // documents) [9.1].22 // [9.1].26-29 // [9.2.3].5-8 [2.1.].22-24 // [9.1].26-35 [9.1].24 // [9.1].26 // [9.1].31 // [9.1].33-35 // // [9.1].28 // [9.1].35 // [9.2.1].1 [9.2.1].1 // [9.2.2].45-47 // [9.2.2].49 Information [9.1].1-2 // [9.1].4 // [9.2.1].1 // [9.2.1].7-19 [9.1].1-4 // [9.1].6-11 // [9.1].12 // [9.1].14 // leakage/sharing [9.1].8 // [9.1].10-15 // // [9.2.2] // [9.2.3].1 // [9.1].13 // [9.1].15 // [9.1].19 // [9.1].20-22 // [9.1].22 // [9.1].26-29 // [9.2.3].5-8 [2.1.].22-24 // [9.1].26-35 [9.1].23 // [9.1].24 // [9.1].31 // [9.1].33-35 // // [9.1.4].13 // [9.1.5].4 // [9.1].26 // [9.1].28 // [9.1.4].13 // [9.2.1].1 [9.1].35 // [9.2.1].1 // [9.2.2].45-47 // [9.2.2].49 Unauthorized [9.1].1-2 // [9.1].4 // [9.2.1].1 // [9.2.1].7-19 [9.1].1-4 // [9.1].6-11 // [9.1].12 // [9.1].14 // physical access / [9.1].8 // [9.1].10-16 // // [9.2.2] // [9.2.3].1 // [9.1].13 // [9.1].15 // [9.1].20-22 // [9.1].23 // Unauthorised entry [9.1].22 // [9.1].26-29 // [9.2.3].5-8 [9.1].16 // [2.1.].22-24 // [9.1].24 // [9.1].26 // to premises [9.1].31 // [9.1].33-35 // [9.1].26-35 // [9.1.4].13 // [9.1].28 // [9.1].35 // [9.1.4].13 // [9.2.1].1 [9.1.5].4 // [9.2.1].1 // [9.2.2].45-47 // [9.2.2].49 Coercion, extortion [9.1].1-2 // [9.1].4 // [9.2.1].1 // [9.2.1].7-19 [9.1].1-4 // [9.1].6-11 // [9.1].12 // [9.1].14 // or corruption [9.1].8 // [9.1].10-15 // // [9.2.2] // [9.2.3].1 // [9.1].13 // [9.1].15 // [9.1].19 // [9.1].20-22 // [9.1].17 // [9.1].19 // [9.2.3].5-8 [9.1].17 // [2.1.].22 // [9.1].24 // [9.1].26 // [9.1].22 // [9.1].26-29 // [9.1].24 // [9.1].26-35 // [9.1].28 // [9.1].35 //

text: December 2013

text: SOURCES Smart grid Information Enhancing Security Threat 20 Assurance and Security 21,37,38,39,40,41,42 Threat Threat details NIST Throughout the Supply Other Group 36 Technology Assessment Chain (IBM Center) 19 (Sacramento State) [9.1].31 // [9.1].33-35 // [9.2.1].1 // [9.2.2].45-47 // [9.2.1].1 [9.2.2].49 Unintention Information [9.1].2 // [9.1].8 // [9.1].2-3 // [9.1].8 // [9.1].12-13 // [9.1].19 // al damage leakage/sharing due [9.1].11-13 // [9.1].15-19 [9.1].11 // [9.1].13 // [9.1].23 (accidental) to user error // [9.1.5].3 [9.1].15-18 // [9.1].23 // [9.1.2].5 // [9.1.3].7 // [9.1.4].15-16 // [9.1.5].3 Erroneous use or [9.1].2 // [9.1].8 // [9.1].2-3 // [9.1].8 // [9.1].12-13 // [9.1].19 // administration of [9.1].11-13 // [9.1].15-19 [9.1].11 // [9.1].13 // [9.1].23 devices and systems // [9.1.5].3 [9.1].15-18 // [9.1].23 // [9.1.2].5 // [9.1.3].7 // [9.1.4].15-16 // [9.1.5].3 Using information [9.1.5].3 [9.1.2].5 // [9.1.3].7 // from an unreliable [9.1.4].15-16 // [9.1.5].3 source Unintentional change [9.1].2 // [9.1].8 // [9.1].2-3 // [9.1].8 // [9.1].12-13 // [9.1].19 // of data in an [9.1].11-13 // [9.1].15-19 [9.1].11 // [9.1].13 // [9.1].23 information system // [9.1.5].3 [9.1].15-18 // [9.1].23 // [9.1.2].5 // [9.1.3].7 // [9.1.4].15-16 // [9.1.5].3 Unintentional loss of [9.1].2 // [9.1].8 // [9.1].2-3 // [9.1].8 // [9.1].12-13 // [9.1].19 // data [9.1].11-13 // [9.1].15-19 [9.1].11 // [9.1].13 // [9.1].23 // [9.1.5].3 [9.1].15-18 // [9.1].23 // [9.1.2].5 // [9.1.3].7 // [9.1.4].15-16 // [9.1.5].3 Inadequate system [9.1].43 [9.1].43 // [9.1.5].1 [9.2.1].6 design and planning or lack of adaptation Lack of awareness [9.1].1 // [9.2.1].1 [9.2.1].1-2 // [9.2.2].1-6 [9.1].1 [9.2.1].1-2

text: December 2013

text: SOURCES Smart grid Information Enhancing Security Threat 20 Assurance and Security 21,37,38,39,40,41,42 Threat Threat details NIST Throughout the Supply Other Group 36 Technology Assessment Chain (IBM Center) 19 (Sacramento State) // [9.2.2].28-32 Disaster Disaster (natural [9.1].15 // [9.1].17 [9.2.2].24 // [9.2.2].49 [9.1].15 // [9.1].17 [9.2.2].49 (natural, earthquakes, floods, environment landslides, tsunamis) al) Disaster [9.1].15 // [9.1].17 [9.2.2].24 // [9.2.2].49 [9.1].15 // [9.1].17 [9.2.2].49 (environmental - fire, explosion, dangerous radiation leak) Fire [9.1].15 // [9.1].17 [9.2.2].24 // [9.2.2].49 [9.1].15 // [9.1].17 [9.2.2].49 Flood [9.1].15 // [9.1].17 [9.2.2].24 // [9.2.2].49 [9.1].15 // [9.1].17 [9.2.2].49 Pollution, dust, [9.1].15 // [9.1].17 [9.2.2].24 // [9.2.2].49 [9.1].15 // [9.1].17 [9.2.2].49 corrosion Thunder stroke [9.1].15 // [9.1].17 [9.2.2].24 // [9.2.2].49 [9.1].15 // [9.1].17 [9.2.2].49 Water [9.1].15 // [9.1].17 [9.2.2].24 // [9.2.2].49 [9.1].15 // [9.1].17 [9.2.2].49 Unfavourable [9.1].15 // [9.1].17 [9.2.2].24 // [9.2.2].49 [9.1].15 // [9.1].17 [9.2.2].49 climatic conditions Major events in the [9.1].15 // [9.1].17 [9.2.2].24 // [9.2.2].49 [9.1].15 // [9.1].17 [9.2.2].49 environment Animal [9.1].15 // [9.1].17 [9.2.2].24 // [9.2.2].49 [9.1].15 // [9.1].17 [9.2.2].49 Damage/Los Damage caused by a [9.1].1-2 // [9.1].4 // [9.2.1].1 // [9.2.1].7-19 [9.1].1-4 // [9.1].6-11 // [9.1].12 // [9.1].14 // s (IT Assets) third party [9.1].8 // [9.1].10-15 // // [9.2.2] // [9.2.3].1 // [9.1].13 // [9.1].15 // [9.1].20-22 // [9.1].23 // [9.1].22 // [9.1].26-29 // [9.2.3].5-8 [2.1.].22-24 // [9.1].26-35 [9.1].24 // [9.1].26 // [9.1].31 // [9.1].33-35 // // [9.1].28 // [9.1].35 // [9.2.1].1 [9.2.1].1 // [9.2.2].45-47 // [9.2.2].49 Damages resulting [9.1].5 // [9.1].14 // [9.1].5 // [9.1].22-24 // [9.1].14 // [9.1].22 // from penetration [9.1].22 // [9.1].26 // [9.1].26 // [9.1].28-38 // [9.1].23-26 // [9.1].28 // testing [9.1].28-29 // [9.1].31 // [9.1].40-44 // [9.1.1].1-3 // [9.1].35 // [9.1].39 [9.1].33-37 // [9.1].39 // [9.1.2]. 2 // [9.1.3].4-6 //

text: December 2013

text: SOURCES Smart grid Information Enhancing Security Threat 20 Assurance and Security 21,37,38,39,40,41,42 Threat Threat details NIST Throughout the Supply Other Group 36 Technology Assessment Chain (IBM Center) 19 (Sacramento State) [9.1].42-44 // [9.1.1].1-2 [9.1.3].8 // [9.1.4].3-5 // // [9.1.2]. 2 // [9.1.3].4 // [9.1.4].14 // [9.1.4].17-18 [9.1.4].3-4 // [9.1.4].14 // [9.1.4].20 // [9.1.5].5-8 // [9.1.4].17-18 // [9.1.4].20 // [9.1.5].5-6 // [9.1.5].8 Loss of (integrity of) [9.1].5 // [9.1].8 // [9.1].5-8 // [9.1].10-11 // [9.1].22 // [9.1].24-26 // sensitive information [9.1].10-11 // [9.1].22 // [9.1].24 // [9.1].26 // [9.1].35 // [9.1].39 [9.1].26 // [9.1].33-36 // [9.1].33-36 // [9.1].38 // [9.1].39 // [9.1].43-44 // [9.1].40-41 // [9.1].43-44 [9.1.1].1-2 // [9.1.2].1 // // [9.1.1].1-3 // [9.1.2].1 // [9.1.3].10 // [9.1.4].1 // [9.1.3].2 // [9.1.3].5 // [9.1.4].7-8 // [9.1.4].10- [9.1.3].10 // [9.1.4].1-2 // 11 // [9.1.4].14 // [9.1.4].7-8 // [9.1.4].10-11 [9.1.4].19 // [9.1.5].8 // [9.1.4].14 // [9.1.4].19 // [9.1.5].1-2 // [9.1.5].8 Loss of devices, Media scavenging [9.1].1-2 // [9.1].4 // [9.2.1].1 // [9.2.1].7-19 [9.1].1-4 // [9.1].6-11 // [9.1].12 // [9.1].14 // storage media and [9.1].8 // [9.1].10-15 // // [9.2.2] // [9.2.3].1 // [9.1].13 // [9.1].15 // [9.1].20-22 // [9.1].23 // documents [2.1.].22 // [9.1].26-29 // [9.2.3].5-8 [2.1.].22-24 // [9.1].26-35 [9.1].24 // [9.1].26 // [9.1].31 // [9.1].33-35 // // [9.1].28 // [9.1].35 // [9.2.1].1 [9.2.1].1 // [9.2.2].45-47 // [9.2.2].49 Destruction of [9.1].1-2 // [9.1].4 // [9.2.1].1 // [9.2.1].7-19 [9.1].1-4 // [9.1].6-11 // [9.1].12 // [9.1].14 // records, devices or [9.1].8 // [9.1].10-15 // // [9.2.2] // [9.2.3].1 // [9.1].13 // [9.1].15 // [9.1].20-22 // [9.1].23 // storage media [2.1.].22 // [9.1].26-29 // [9.2.3].5-8 [2.1.].22-24 // [9.1].26-35 [9.1].24 // [9.1].26 // [9.1].31 // [9.1].33-35 // // [9.1].28 // [9.1].35 // [9.2.1].1 [9.2.1].1 // [9.2.2].45-47 // [9.2.2].49 Information Leakage [9.1].1-2 // [9.1].4 // [9.2.1].1 // [9.2.1].7-19 [9.1].1-4 // [9.1].6-11 // [9.1].12 // [9.1].14 //

text: December 2013

text: SOURCES Smart grid Information Enhancing Security Threat 20 Assurance and Security 21,37,38,39,40,41,42 Threat Threat details NIST Throughout the Supply Other Group 36 Technology Assessment Chain (IBM Center) 19 (Sacramento State) [9.1].8 // [9.1].10-15 // // [9.2.2] // [9.2.3].1 // [9.1].13 // [9.1].15 // [9.1].19 // [9.1].20-22 // [9.1].19 // [2.1.].22 // [9.2.3].5-8 [2.1.].22-24 // [9.1].26-35 [9.1].23 // [9.1].24 // [9.1].26-29 // [9.1].31 // // [9.1.4].13 // [9.1.5].4 // [9.1].26 // [9.1].28 // [9.1].33-35 // [9.1.4].13 [9.1].35 // [9.2.1].1 // // [9.2.1].1 [9.2.2].45-47 // [9.2.2].49 Failures/ Failure of devices or [9.1].2 // [9.1].8 // [9.1].2-3 // [9.1].8 // [9.1].12-13 // [9.1].19 // Malfunction systems [9.1].11-13 // [9.1].15-19 [9.1].11 // [9.1].13 // [9.1].23 // [9.1.2].5 // [9.1.3].7 // [9.1].15-18 // [9.1].23 // [9.1.4].15-16 // [9.1.5].3 [9.1.2].5 // [9.1.3].7 // [9.1.4].15-16 // [9.1.5].3 Failure or disruption [9.1].40 [9.1].42 of communication links (communication networks) Failure or disruption [9.1.3].9 [9.2.1].16 // [9.2.2].26 [9.1.3].9 of main supply Failure or disruption [9.2.1].1 [9.2.1].1 // [9.2.1].4-11 [9.2.1].1-2 // [9.2.1].4-6 // of service providers // [9.2.1].14-19 [9.2.1].8 (supply chain) Malfunction of [9.1].2 // [9.1].8 // [9.1].2-3 // [9.1].8 // [9.1].12-13 // [9.1].19 // equipment (devices [9.1].11-13 // [9.1].15-19 [9.1].11 // [9.1].13 // [9.1].23 or systems) // [9.1.2].5 // [9.1.3].7 // [9.1].15-18 // [9.1].23 [9.1.4].15-16 // [9.1.5].3 //[9.1.2].5 // [9.1.3].7 // [9.1.4].15-16 // [9.1.5].3 Insecure Interfaces [9.1].25 (APIs) Outages Lack of resources [9.2.1].1 [9.2.1].1 // [9.2.1].4-11 [9.2.1].1-2 // [9.2.1].4-6 // // [9.2.1].14-19 [9.2.1].8 Loss of electricity [9.1.3].9 [9.2.1].16 // [9.2.2].26 [9.1.3].9

text: December 2013

text: SOURCES Smart grid Information Enhancing Security Threat 20 Assurance and Security 21,37,38,39,40,41,42 Threat Threat details NIST Throughout the Supply Other Group 36 Technology Assessment Chain (IBM Center) 19 (Sacramento State) Absence of personnel [9.2.2].1-2 // [9.2.2].25 // [9.2.2].50 Strike [9.2.2].1-2 // [9.2.2].25 // [9.2.2].50 Loss of support [9.2.1].1 [9.2.1].1 // [9.2.1].4-11 [9.2.1].1-2 // [9.2.1].4-6 // services // [9.2.1].14-19 [9.2.1].8 Internet outage [9.1].40 [9.1].42 Network outage [9.1].40 [9.1].42 Lack in the supply [9.2.1].1 [9.2.1].1 // [9.2.1].4-11 [9.2.1].1-2 // [9.2.1].4-6 // line // [9.2.1].14-19 [9.2.1].8 Eavesdroppi War driving [9.1].5 // [9.1].34-35 // [9.1].5 // [9.1].34-35 // [9.1].35 // [9.1].39 // ng/ [9.1].39 // [9.1.1].1-2 // [9.1.1].1-3 // [9.1.5].8 Interception [9.1.5].8 / Hijacking Intercepting, [9.1].5 // [9.1].8 // [9.1].5-8 // [9.1].10-11 // [9.1].14 // [9.1].22 // compromising [9.1].10-11 // [9.1].14 // [9.1].22-24 // [9.1].26 // [9.1].23-26 // [9.1].28 // emissions [9.1].22 // [9.1].26 // [9.1].28-38 // [9.1].40-44 [9.1].35 // [9.1].39 [9.1].28-29 // [9.1].31 // // [9.1.1].1-3 // [9.1.2].1-2 [9.1].33-37 // [9.1].39 // // [9.1.3].2 // [9.1.3].4-6 // [9.1].42-44 // [9.1.1].1-2 [9.1.3].8 // [9.1.3].10 // // [9.1.2].1-2 // [9.1.3].4 [9.1.4].1-5 // [9.1.4].7-8 // // [9.1.3].10 // [9.1.4].1 [9.1.4].10-11 // [9.1.4].14 // [9.1.4].3-4 // [9.1.4].7- // [9.1.4].17-20 // 8 // [9.1.4].10-11 // [9.1.5].1-2 // [9.1.5].5-8 [9.1.4].14 // [9.1.4].17- 20 // [9.1.5].1 // [9.1.5].5-6 // [9.1.5].8 Interception of Hijacking of the [9.1.4].1 // [9.1.4].3-4 // [9.1.4].1-5 // [9.1.4].7-9 // information meter connection [9.1.4].7-9 // [9.1.4].11 [9.1.4].11-20 // [9.1.4].22 // [9.1.4].13-14 //

text: December 2013

text: SOURCES Smart grid Information Enhancing Security Threat 20 Assurance and Security 21,37,38,39,40,41,42 Threat Threat details NIST Throughout the Supply Other Group 36 Technology Assessment Chain (IBM Center) 19 (Sacramento State) [9.1.4].17-20 // [9.1.4].22 Side-channel attack [9.1.3].9 // [9.1.4].1 // [9.1.3].9 // [9.1.4].1-2 // [9.1.4].8 // [9.1.4].13 [9.1.4].8 // [9.1.4].13 Scanning / Sniffer / [9.1].1-2 // [9.1].4 // [9.1].1-4 // [9.1].11 // [9.1].12 // [9.1].14 // External traffic [9.1].11-14 // [9.1].19 // [9.1].13 // [9.1].23-24 // [9.1].19 // [9.1].23-24 // analyser [9.1].34-37 // [9.1].39 // [9.1].34-38 // [9.1.1].1-3 // [9.1].35 // [9.1].39 // [9.1.1].1-3 // [9.1.4].7 // [9.1.4].7 // [9.1.4].11 [9.1.4].11 Interfering radiation EM /RF Interception. [9.1.3].9 // [9.1.4].1 // [9.1.3].9 // [9.1.4].1-2 // Tempest attack [9.1.4].8 // [9.1.4].13 [9.1.4].8 // [9.1.4].13 Replay of messages Acknowledges [9.1.1].1 // [9.1.4].9 [9.1].38 // [9.1.1].1 // forgery [9.1.4].9 Network [9.1].1-2 // [9.1].4 // [9.1].1-4 // [9.1].11 // [9.1].12 // [9.1].14 // Reconnaissance and [9.1].11-14 // [9.1].19 // [9.1].13 // [9.1].23-24 // [9.1].19 // [9.1].23-24 // Information [9.1].34-37 // [9.1].39 // [9.1].34-38 // [9.1.1].1-3 // [9.1].35 // [9.1].39 // gathering [9.1.1].1-3 // [9.1.4].7 // [9.1.4].7 // [9.1.4].11 [9.1.4].11 Man in the middle/ [9.1].5 // [9.1].8 // [9.1].5-8 // [9.1].10-11 // [9.1].14 // [9.1].22 // Session hijacking [9.1].10-11 // [9.1].14 // [9.1].22-24 // [9.1].26 // [9.1].23-26 // [9.1].28 // [9.1].22 // [9.1].26 // [9.1].28-38 // [9.1].40-44 [9.1].35 // [9.1].39 [9.1].28-29 // [9.1].31 // // [9.1.1].1-3 // [9.1.2].1-2 [9.1].33-37 // [9.1].39 // // [9.1.3].2 // [9.1.3].4-6 // [9.1].42-44 // [9.1.1].1-2 [9.1.3].8 // [9.1.3].10 // // [9.1.2].1-2 // [9.1.3].4 [9.1.4].1-5 // [9.1.4].7-8 // // [9.1.3].10 // [9.1.4].1 [9.1.4].10-11 // [9.1.4].14 // [9.1.4].3-4 // [9.1.4].7- // [9.1.4].17-20 // 8 // [9.1.4].10-11 // [9.1.5].1-2 // [9.1.5].5-8 [9.1.4].14 // [9.1.4].17-

text: December 2013

text: SOURCES Smart grid Information Enhancing Security Threat 20 Assurance and Security 21,37,38,39,40,41,42 Threat Threat details NIST Throughout the Supply Other Group 36 Technology Assessment Chain (IBM Center) 19 (Sacramento State) 20 // [9.1.5].1 // [9.1.5].5-6 // [9.1.5].8 Repudiation of [9.1].5 // [9.1].11-12 // [9.1].5-7 // [9.1].11 // [9.1].12 // [9.1].26 actions [9.1].26-27 // [9.1].34 // [9.1].26-27 // [9.1].34 // //[9.1].39 [9.1].39-40 // [9.1.1].1-2 [9.1].40 // [9.1.1].1-3 // // [9.1.2].1-4 // [9.1.3].4 [9.1.2].1-4 // [9.1.3].4 // // [9.1.3].10 // [9.1.4].4 [9.1.3].6 // [9.1.3].8 // // [9.1.4].6-8 // [9.1.3].10 // [9.1.4].4 // [9.1.4].11 // [9.1.4].14 // [9.1.4].6-8 // [9.1.4].11-12 [9.1.4].17-18 // // [9.1.4].14-15 // [9.1.4].22 // [9.1.5].8 [9.1.4].17-18 // [9.1.4].22 // [9.1.5].8 Nefarious Identity theft [9.1].5 // [9.1].8 // [9.1].5-8 // [9.1].10-11 // [9.1].14 // [9.1].22 // Activity/ [9.1].10-11 // [9.1].14 // [9.1].22-24 // [9.1].26 // [9.1].23-26 // [9.1].28 // Abuse [9.1].22 // [9.1].26 // [9.1].28-38 // [9.1].40-44 [9.1].35 // [9.1].39 [9.1].28-29 // [9.1].31 // // [9.1.1].1-3 // [9.1.2].1-2 [9.1].33-37 // [9.1].39 // // [9.1.3].2 // [9.1.3].4-6 // [9.1].42-44 // [9.1.1].1-2 [9.1.3].8 // [9.1.3].10 // // [9.1.2].1-2 // [9.1.3].4 [9.1.4].1-5 // [9.1.4].7-8 // // [9.1.3].10 // [9.1.4].1 [9.1.4].10-11 // [9.1.4].14 // [9.1.4].3-4 // [9.1.4].7- // [9.1.4].17-20 // 8 // [9.1.4].10-11 // [9.1.5].1-2 // [9.1.5].5-8 [9.1.4].14 // [9.1.4].17- 20 // [9.1.5].1 // [9.1.5].5-6 // [9.1.5].8 Unsolicited E-mail [9.1].22 // [9.1].26 // [9.1].22 // [9.1].26 // [9.1].26 Anonymous or [9.1.1].1-2 // [9.1.2].4 // [9.1.1].1-3 // [9.1.2].4 // Unsolicited e-mail to [9.1.3].3 // [9.1.4].4 // [9.1.3].3 // [9.1.3].6 // smart grid staff [9.1.5].5 [9.1.4].4 // [9.1.5].5

text: December 2013

text: SOURCES Smart grid Information Enhancing Security Threat 20 Assurance and Security 21,37,38,39,40,41,42 Threat Threat details NIST Throughout the Supply Other Group 36 Technology Assessment Chain (IBM Center) 19 (Sacramento State) Denial of service [9.1].45 // [9.1.4].9 [9.1].45 // [9.1.4].9 Malicious code/ Exploits / Worms / [9.1].1-2 // [9.1].4 // [9.2.1].1 // [9.2.1].6 // [9.1].1-4 // [9.1].11 // [9.1].12 // [9.1].14 // software/ activity Trojans / Backdoor / [9.1].11-18 // [9.1].22 // [9.2.3].1 [9.1].13 // [9.1].15-18 // [9.1].18-20 // [9.1].22-26 Trapdoor / Targeted [9.1].26 // [9.1].33-37 // [9.1].22 // [9.1].24 // // [9.1].35 // [9.1].39 // attacks (APTs etc.) [9.1].39 // [9.1.1].1-2 // [9.1].26 // [9.1].33-38 // [9.2.1].1 // [9.2.1].6 // [9.1.2].1-4 // [9.1.4].1 // [9.1.1].1-3 // [9.1.2].1-5 // [9.1.4].3-4 // [9.1.4].6 // [9.1.4].1-6 // [9.1.4].20-23 [9.1.4].20 // [9.1.4].22- // [9.1.5].1-3 // [9.1.5]5-7 23 // [9.1.5].1 // [9.1.5].3 // [9.1.5]5-6 // [2.2.1.].1 Service spoofing (ARP [9.1].1-2 // [9.1].4 // [9.2.1].1 // [9.2.1].6 // [9.1].1-4 // [9.1].11 // [9.1].12 // [9.1].14 // spoofing) [9.1].11-18 // [9.1].22 // [9.2.3].1 [9.1].13 // [9.1].15-18 // [9.1].18-20 // [9.1].22-26 [9.1].26 // [9.1].33-37 // [9.1].22 // [9.1].24 // // [9.1].35 // [9.1].39 // [9.1].39 // [9.1.1].1-2 // [9.1].26 // [9.1].33-38 // [9.2.1].1 // [9.2.1].6 // [9.1.2].1-4 // [9.1.4].1 // [9.1.1].1-3 // [9.1.2].1-5 // [9.1.4].3-4 // [9.1.4].6 // [9.1.4].1-6 // [9.1.4].20-23 [9.1.4].20 // [9.1.4].22- // [9.1.5].1-3 // [9.1.5]5-7 23 // [9.1.5].1 // [9.1.5].3 // [9.1.5]5-6 // [2.2.1.].1 ICMP flooding [9.1].1-2 // [9.1].4 // [9.2.1].1 // [9.2.1].6 // [9.1].1-4 // [9.1].11 // [9.1].12 // [9.1].14 // [9.1].11-18 // [9.1].22 // [9.2.3].1 [9.1].13 // [9.1].15-18 // [9.1].18-20 // [9.1].22-26 [9.1].26 // [9.1].33-37 // [9.1].22 // [9.1].24 // // [9.1].35 // [9.1].39 // [9.1].39 // [9.1.1].1-2 // [9.1].26 // [9.1].33-38 // [9.2.1].1 // [9.2.1].6 // [9.1.2].1-4 // [9.1.4].1 // [9.1.1].1-3 // [9.1.2].1-5 // [9.1.4].3-4 // [9.1.4].6 // [9.1.4].1-6 // [9.1.4].20-23 [9.1.4].20 // [9.1.4].22- // [9.1.5].1-3 // [9.1.5]5-7 23 // [9.1.5].1 // [9.1.5].3 // [9.1.5]5-6 // [2.2.1.].1 Social Engineering [9.2.2].32 // [9.2.2].34

text: December 2013

text: SOURCES Smart grid Information Enhancing Security Threat 20 Assurance and Security 21,37,38,39,40,41,42 Threat Threat details NIST Throughout the Supply Other Group 36 Technology Assessment Chain (IBM Center) 19 (Sacramento State) Abuse of Information [9.1].1-2 // [9.1].4 // [9.2.1].1 // [9.2.1].7-19 [9.1].1-4 // [9.1].6-11 // [9.1].12 // [9.1].14 // Leakage [9.1].8 // [9.1].10-15 // // [9.2.2] // [9.2.3].1 // [9.1].13 // [9.1].15 // [9.1].19 // [9.1].20-22 // [9.1].19 // [9.1].22 // [9.2.3].5-8 [2.1.].22-24 // [9.1].26-35 [9.1].23 // [9.1].24 // [9.1].26-29 // [9.1].31 // // [9.1.4].13 // [9.1.5].4 // [9.1].26 // [9.1].28 // [9.1].33-35 // [9.1.4].13 [9.1].35 // [9.2.1].1 // // [9.2.1].1 [9.2.2].45-47 // [9.2.2].49 Generation and use [9.1].39 [9.1].39 of rogue certificates Manipulation of False data injection in [9.1].5 // [9.1].8 // [9.1].5-8 // [9.1].10-11 // [9.1].14 // [9.1].22 // information: smart grid traffic [9.1].10-11 // [9.1].14 // [9.1].22-24 // [9.1].26 // [9.1].23-26 // [9.1].28 // authenticity [9.1].22 // [9.1].26 // [9.1].28-38 // [9.1].40-44 [9.1].35 // [9.1].39 [9.1].28-37 // [9.1].39 // // [9.1.1].1-3 // [9.1.2].1-2 [9.1].42-44 // [9.1.1].1-2 // [9.1.3].2 // [9.1.3].4-6 // // [9.1.2].1-2 // [9.1.3].4 [9.1.3].8 // [9.1.3].10 // // [9.1.3].10 // [9.1.4].1 [9.1.4].1-5 // [9.1.4].7-8 // // [9.1.4].3-4 // [9.1.4].7- [9.1.4].10-11 // [9.1.4].14 8 // [9.1.4].10-11 // // [9.1.4].17-20 // [9.1.4].14 // [9.1.4].17- [9.1.5].1-2 // [9.1.5].5-8 20 // [9.1.5].1 // [9.1.5].5-6 // [9.1.5].8 Manipulation of Buffer overflow [9.1].16 [9.1].16 // [9.1.2].5 // information: [9.1.4].16 intercept / alter / repudiation Load redistribution [9.1].16 [9.1].16 // [9.1.2].5 // attack [9.1.4].16 Deliver wrong data to [9.1].16 [9.1].16 // [9.1.2].5 // operator station [9.1.4].16 Manipulation data [9.1].16 [9.1].16 // [9.1.2].5 //

text: December 2013

text: SOURCES Smart grid Information Enhancing Security Threat 20 Assurance and Security 21,37,38,39,40,41,42 Threat Threat details NIST Throughout the Supply Other Group 36 Technology Assessment Chain (IBM Center) 19 (Sacramento State) sent or received [9.1.4].16 to/from TSO or central system Alter meter data, [9.1].5 // [9.1].8 // [9.1].5-8 // [9.1].10-11 // [9.1].22 // [9.1].24-26 // gateway [9.1].10-11 // [9.1].22 // [9.1].24 // [9.1].26 // [9.1].35 // [9.1].39 configuration data, [9.1].26 // [9.1].33-36 // [9.1].33-36 // [9.1].38 // meter configuration [9.1].39 // [9.1].43-44 // [9.1].40-41 // [9.1].43-44 data, CLS [9.1.1].1-2 // [9.1.2].1 // // [9.1.1].1-3 // [9.1.2].1 // configuration data, [9.1.3].10 // [9.1.4].1 // [9.1.3].2 // [9.1.3].5 // etc. [9.1.4].7-8 // [9.1.4].10- [9.1.3].10 // [9.1.4].1-2 // 11 // [9.1.4].14 // [9.1.4].7-8 // [9.1.4].10-11 [9.1.4].19 // [9.1.5].1 // // [9.1.4].14 // [9.1.4].19 [9.1.5].8 // [9.1.5].1-2 // [9.1.5].8 Misuse of audit tools [9.1].20 Falsification of [9.1].5 // [9.1].8 // [9.1].5-8 // [9.1].10-11 // [9.1].14 // [9.1].22 // records [9.1].10-11 // [9.1].14 // [9.1].22-24 // [9.1].26 // [9.1].23-26 // [9.1].28 // [9.1].22 // [9.1].26 // [9.1].28-38 // [9.1].40-44 [9.1].35 // [9.1].39 [9.1].28-29 // [9.1].31 // // [9.1.1].1-3 // [9.1.2].1-2 [9.1].33-39 // [9.1].20-44 // [9.1.3].2 // [9.1.3].4-6 // // [9.1.1].1-2 // [9.1.2].1- [9.1.3].8 // [9.1.3].10 // 2 // [9.1.3].4 // [9.1.3].10 [9.1.4].1-5 // [9.1.4].7-8 // // [9.1.4].1 // [9.1.4].3-4 [9.1.4].10-11 // [9.1.4].14 // [9.1.4].7-8 // // [9.1.4].17-20 // [9.1.4].10-11 // [9.1.5].1-2 // [9.1.5].5-8 [9.1.4].14 // [9.1.4].17- 20 // [9.1.5].1 // [9.1.5].5-6 // [9.1.5].8 Misuse of [9.1].2 // [9.1].8 // [9.1].2-3 // [9.1].8 // [9.1].12-13 // [9.1].19 // information/ [9.1].11-13 // [9.1].15-19 [9.1].11 // [9.1].13 // [9.1].23

text: December 2013

text: SOURCES Smart grid Information Enhancing Security Threat 20 Assurance and Security 21,37,38,39,40,41,42 Threat Threat details NIST Throughout the Supply Other Group 36 Technology Assessment Chain (IBM Center) 19 (Sacramento State) information systems // [9.1.5].3 [9.1].15-18 // [9.1].23 // [9.1.2].5 // [9.1.3].7 // [9.1.4].15-16 // [9.1.5].3 Unauthorized use or Unauthorized use of [9.1].1 // [9.1].4-5 // [9.1].1 // [9.1].4-8 // // [9.1].12-14 // [9.1].21-22 administration of facilities and [9.1].8 // [9.1].10-15 // [9.1].10-11 // [9.1].13 // // [9.1].24 // [9.1].26 // devices, systems and infrastructure [9.1].22 // [9.1].26-29 // [9.1].15 // [9.1].24 // [9.1].28 // [9.1].39 communications [9.1].31 // [9.1].33-37 // [9.1].26-37 // [9.1].40-41 [9.1].39 // [9.1.1].1-2 // // [9.1.1].1-3 // [9.1.2].2 // [9.1.2].2 // [9.1.2].4 // [9.1.2].4 // [9.1.3].3-10 // [9.1.3].3-4 // [9.1.3].9-10 [9.1.4].4-5 // [9.1.4].7-8 // // [9.1.4].4 // [9.1.4].7-8 [9.1.4].12 // [9.1.4].14 // // [9.1.4].14 // [9.1.4].17-20 // [9.1.5].5-8 [9.1.4].17-20 // [9.1.5].5- 6 // [9.1.5].8 Unauthorized use of [9.1].1 // [9.1].4-5 // [9.1].1 // [9.1].4-8 // // [9.1].12-14 // [9.1].21-22 files and information [9.1].8 // [9.1].10-15 // [9.1].10-11 // [9.1].13 // // [9.1].24 // [9.1].26 // [9.1].22 // [9.1].26-29 // [9.1].15 // [9.1].24 // [9.1].28 // [9.1].39 [9.1].31 // [9.1].33-37 // [9.1].26-37 // [9.1].40-41 [9.1].39 // [9.1.1].1-2 // // [9.1.1].1-3 // [9.1.2].2 // [9.1.2].2 // [9.1.2].4 // [9.1.2].4 // [9.1.3].3-10 // [9.1.3].3-4 // [9.1.3].9-10 [9.1.4].4-5 // [9.1.4].7-8 // // [9.1.4].4 // [9.1.4].7-8 [9.1.4].12 // [9.1.4].14 // // [9.1.4].14 // [9.1.4].17-20 // [9.1.5].5-8 [9.1.4].17-20 // [9.1.5].5- 6 // [9.1.5].8 Unauthorized use of [9.1].1 // [9.1].4-5 // [9.1].1 // [9.1].4-8 // // [9.1].12-14 // [9.1].21-22 software [9.1].8 // [9.1].10-15 // [9.1].10-11 // [9.1].13 // // [9.1].24 // [9.1].26 // [9.1].22 // [9.1].26-29 // [9.1].15 // [9.1].24 // [9.1].28 // [9.1].39 [9.1].31 // [9.1].33-37 // [9.1].26-37 // [9.1].40-41

text: December 2013

text: SOURCES Smart grid Information Enhancing Security Threat 20 Assurance and Security 21,37,38,39,40,41,42 Threat Threat details NIST Throughout the Supply Other Group 36 Technology Assessment Chain (IBM Center) 19 (Sacramento State) [9.1].39 // [9.1.1].1-2 // // [9.1.1].1-3 // [9.1.2].2 // [9.1.2].2 // [9.1.2].4 // [9.1.2].4 // [9.1.3].3-10 // [9.1.3].3-4 // [9.1.3].9-10 [9.1.4].4-5 // [9.1.4].7-8 // // [9.1.4].4 // [9.1.4].7-8 [9.1.4].12 // [9.1.4].14 // // [9.1.4].14 // [9.1.4].17-20 // [9.1.5].5-8 [9.1.4].17-20 // [9.1.5].5- 6 // [9.1.5].8 Unauthorized access Unauthorized access [9.1.2].1-4 // [9.2.3].3-4 [9.2.3].3 [9.1.1] // [9.1.2].1-4 // [9.2.3].3-4 to the information from customer [9.1.5] /information system endpoint / network Masquerade (gained [9.1.2].1-4 [9.1.1] // [9.1.2].1-4 // access and privileges [9.1.5] escalation) Password attacks [9.1].33 [9.1].33 Unauthorized access [9.1].1 // [9.1].4-5 // [9.1].1 // [9.1].4-8 // // [9.1].12-14 // [9.1].21-22 to the information, [9.1].8 // [9.1].10-15 // [9.1].10-11 // [9.1].13 // // [9.1].24 // [9.1].26 // system or data [9.1].22 // [9.1].26-29 // [9.1].15 // [9.1].24 // [9.1].28 // [9.1].39 [9.1].31 // [9.1].33-37 // [9.1].26-37 // [9.1].40-41 [9.1].39 // [9.1.1].1-2 // // [9.1.1].1-3 // [9.1.2].2 // [9.1.2].2 // [9.1.2].4 // [9.1.2].4 // [9.1.3].3-10 // [9.1.3].3-4 // [9.1.3].9-10 [9.1.4].4-5 // [9.1.4].7-8 // // [9.1.4].4 // [9.1.4].7-8 [9.1.4].12 // [9.1.4].14 // // [9.1.4].14 // [9.1.4].17-20 // [9.1.5].5-8 [9.1.4].17-20 // [9.1.5].5- 6 // [9.1.5].8 Unauthorized remote [9.1].1 // [9.1].4-5 // [9.1].1 // [9.1].4-8 // // [9.1].12-14 // [9.1].21-22 access to SCADA [9.1].8 // [9.1].10-15 // [9.1].10-11 // [9.1].13 // // [9.1].24 // [9.1].26 // systems [9.1].22 // [9.1].26-29 // [9.1].15 // [9.1].24 // [9.1].28 // [9.1].39 [9.1].31 // [9.1].33-37 // [9.1].26-37 // [9.1].40-41

text: December 2013

text: SOURCES Smart grid Information Enhancing Security Threat 20 Assurance and Security 21,37,38,39,40,41,42 Threat Threat details NIST Throughout the Supply Other Group 36 Technology Assessment Chain (IBM Center) 19 (Sacramento State) [9.1].39 // [9.1.1].1-2 // // [9.1.1].1-3 // [9.1.2].2 // [9.1.2].2 // [9.1.2].4 // [9.1.2].4 // [9.1.3].3-10 // [9.1.3].3-4 // [9.1.3].9-10 [9.1.4].4-5 // [9.1.4].7-8 // // [9.1.4].4 // [9.1.4].7-8 [9.1.4].12 // [9.1.4].14 // // [9.1.4].14 // [9.1.4].17-20 // [9.1.5].5-8 [9.1.4].17-20 // [9.1.5].5- 6 // [9.1.5].8 Unauthorized [9.1].1 // [9.1].4-5 // [9.1].1 // [9.1].4-8 // // [9.1].12-14 // [9.1].21-22 information [9.1].8 // [9.1].10-15 // [9.1].10-11 // [9.1].13 // // [9.1].24 // [9.1].26 // manipulation or [9.1].22 // [9.1].26-29 // [9.1].15 // [9.1].24 // [9.1].28 // [9.1].39 deletion [9.1].31 // [9.1].33-37 // [9.1].26-37 // [9.1].40-41 [9.1].39 // [9.1.1].1-2 // // [9.1.1].1-3 // [9.1.2].2 // [9.1.2].2 // [9.1.2].4 // [9.1.2].4 // [9.1.3].3-10 // [9.1.3].3-4 // [9.1.3].9-10 [9.1.4].4-5 // [9.1.4].7-8 // // [9.1.4].4 // [9.1.4].7-8 [9.1.4].12 // [9.1.4].14 // // [9.1.4].14 // [9.1.4].17-20 // [9.1.5].5-8 [9.1.4].17-20 // [9.1.5].5- 6 // [9.1.5].8 Compromise DCS [9.1].1 // [9.1].4-5 // [9.1].1 // [9.1].4-8 // // [9.1].12-14 // [9.1].21-22 server and disable [9.1].8 // [9.1].10-15 // [9.1].10-11 // [9.1].13 // // [9.1].24 // [9.1].26 // communication with [9.1].22 // [9.1].26-29 // [9.1].15 // [9.1].24 // [9.1].28 // [9.1].39 controllers, [9.1].31 // [9.1].33-37 // [9.1].26-37 // [9.1].40-41 //[9.1].42 manipulate [9.1].39 // [9.1].42 // // [9.1].45 // [9.1.1].1-3 // configuration [9.1].45 //[9.1.1].1-2 // [9.1.2].2 // [9.1.2].4 // parameters of [9.1.2].2 // [9.1.2].4 // [9.1.3].3-10 // [9.1.4].4-5 controllers, or stop [9.1.3].3-4 // [9.1.3].9-10 // [9.1.4].7-9 // [9.1.4].12 communication with // [9.1.4].4 // [9.1.4].7-9 // [9.1.4].14 // [9.1.4].17operator station // [9.1.4].14 // 20 // [9.1.5].5-8 [9.1.4].17-20 // [9.1.5].5-

text: December 2013

text: SOURCES Smart grid Information Enhancing Security Threat 20 Assurance and Security 21,37,38,39,40,41,42 Threat Threat details NIST Throughout the Supply Other Group 36 Technology Assessment Chain (IBM Center) 19 (Sacramento State) 6 // [9.1.5].8 Compromise RTU [9.1].1 // [9.1].4-5 // [9.1].1 // [9.1].4-8 // // [9.1].12-14 // [9.1].21-22 [9.1].8 // [9.1].10-15 // [9.1].10-11 // [9.1].13 // // [9.1].24 // [9.1].26 // [9.1].22 // [9.1].26-29 // [9.1].15 // [9.1].24 // [9.1].28 // [9.1].39 [9.1].31 // [9.1].33-37 // [9.1].26-37 // [9.1].40-41 [9.1].39 // [9.1.1].1-2 // // [9.1.1].1-3 // [9.1.2].2 // [9.1.2].2 // [9.1.2].4 // [9.1.2].4 // [9.1.3].3-10 // [9.1.3].3-4 // [9.1.3].9-10 [9.1.4].4-5 // [9.1.4].7-8 // // [9.1.4].4 // [9.1.4].7-8 [9.1.4].12 // [9.1.4].14 // // [9.1.4].14 // [9.1.4].17-20 // [9.1.5].5-8 [9.1.4].17-20 // [9.1.5].5- 6 // [9.1.5].8 Violation of the [9.1].5 // [9.1].8 // [9.1].5-8 // [9.1].10-11 // [9.1].22 // [9.1].24-26 // privacy of the [9.1].10-11 // [9.1].22 // [9.1].24 // [9.1].26 // [9.1].35 // [9.1].39 consumer [9.1].26 // [9.1].33-36 // [9.1].33-36 // [9.1].38 // [9.1].39 // [9.1].43-44 // [9.1].40-41 // [9.1].43-44 [9.1.1].1-2 // [9.1.2].1 // // [9.1.1].1-3 // [9.1.2].1 // [9.1.3].10 // [9.1.4].1 // [9.1.3].2 // [9.1.3].5 // [9.1.4].7-8 // [9.1.4].10- [9.1.3].10 // [9.1.4].1-2 // 11 // [9.1.4].14 // [9.1.4].7-8 // [9.1.4].10-11 [9.1.4].19 // [9.1.5].1 // // [9.1.4].14 // [9.1.4].19 [9.1.5].8 // [9.1.5].1-2 // [9.1.5].8 Unauthorized [9.1].1 // [9.1].4-5 // [9.1].1 // [9.1].4-8 // // [9.1].12-14 // [9.1].21-22 changes of records [9.1].8 // [9.1].10-15 // [9.1].10-11 // [9.1].13 // // [9.1].24 // [9.1].26 // [9.1].22 // [9.1].26-29 // [9.1].15 // [9.1].24 // [9.1].28 // [9.1].39 [9.1].31 // [9.1].33-37 // [9.1].26-37 // [9.1].40-41 [9.1].39 // [9.1.1].1-2 // // [9.1.1].1-3 // [9.1.2].2 // [9.1.2].2 // [9.1.2].4 // [9.1.2].4 // [9.1.3].3-10 // [9.1.3].3-4 // [9.1.3].9-10 [9.1.4].4-5 // [9.1.4].7-8 //

text: December 2013

text: SOURCES Smart grid Information Enhancing Security Threat 20 Assurance and Security 21,37,38,39,40,41,42 Threat Threat details NIST Throughout the Supply Other Group 36 Technology Assessment Chain (IBM Center) 19 (Sacramento State) // [9.1.4].4 // [9.1.4].7-8 [9.1.4].12 // [9.1.4].14 // // [9.1.4].14 // [9.1.4].17-20 // [9.1.5].5-8 [9.1.4].17-20 // [9.1.5].5- 6 // [9.1.5].8 Unauthorized [9.1].1 // [9.1].4-5 // [9.1].1 // [9.1].4-8 // // [9.1].12-14 // [9.1].21-22 installation of [9.1].8 // [9.1].10-15 // [9.1].10-11 // [9.1].13 // // [9.1].24 // [9.1].26 // software [9.1].22 // [9.1].26-29 // [9.1].15 // [9.1].24 // [9.1].28 // [9.1].39 [9.1].31 // [9.1].33-37 // [9.1].26-37 // [9.1].40-41 [9.1].39 // [9.1.1].1-2 // // [9.1.1].1-3 // [9.1.2].2 // [9.1.2].2 // [9.1.2].4 // [9.1.2].4 // [9.1.3].3-10 // [9.1.3].3-4 // [9.1.3].9-10 [9.1.4].4-5 // [9.1.4].7-8 // // [9.1.4].4 // [9.1.4].7-8 [9.1.4].12 // [9.1.4].14 // // [9.1.4].14 // [9.1.4].17-20 // [9.1.5].5-8 [9.1.4].17-20 // [9.1.5].5- 6 // [9.1.5].8 Compromising [9.1].5 // [9.1].8 // [9.1].5-8 // [9.1].10-11 // [9.1].22 // [9.1].24-26 // confidential [9.1].10-11 // [9.1].22 // [9.1].24 // [9.1].26 // [9.1].35 // [9.1].39 information (data [9.1].26 // [9.1].33-36 // [9.1].33-36 // [9.1].38 // breaches) [9.1].39 // [9.1].43-44 // [9.1].40-41 // [9.1].43-44 [9.1.1].1-2 // [9.1.2].1 // // [9.1.1].1-3 // [9.1.2].1 // [9.1.3].10 // [9.1.4].1 // [9.1.3].2 // [9.1.3].5 // [9.1.4].7-8 // [9.1.4].10- [9.1.3].10 // [9.1.4].1-2 // 11 // [9.1.4].14 // [9.1.4].7-8 // [9.1.4].10-11 [9.1.4].19 // [9.1.5].1 // // [9.1.4].14 // [9.1.4].19 [9.1.5].8 // [9.1.5].1-2 // [9.1.5].8 Abuse of [9.1].1 // [9.1].4-5 // [9.1].1 // [9.1].4-8 // // [9.1].12-14 // [9.1].21-22 authorizations [9.1].8 // [9.1].10-15 // [9.1].10-11 // [9.1].13 // // [9.1].24 // [9.1].26 // [9.1].22 // [9.1].26-29 // [9.1].15 // [9.1].24 // [9.1].28 // [9.1].39 [9.1].31 // [9.1].33-37 // [9.1].26-37 // [9.1].40-41

text: December 2013

text: SOURCES Smart grid Information Enhancing Security Threat 20 Assurance and Security 21,37,38,39,40,41,42 Threat Threat details NIST Throughout the Supply Other Group 36 Technology Assessment Chain (IBM Center) 19 (Sacramento State) [9.1].39 // [9.1.1].1-2 // // [9.1.1].1-3 // [9.1.2].2 // [9.1.2].2 // [9.1.2].4 // [9.1.2].4 // [9.1.3].3-10 // [9.1.3].3-4 // [9.1.3].9-10 [9.1.4].4-5 // [9.1.4].7-8 // // [9.1.4].4 // [9.1.4].7-8 [9.1.4].12 // [9.1.4].14 // // [9.1.4].14 // [9.1.4].17-20 // [9.1.5].5-8 [9.1.4].17-20 // [9.1.5].5- 6 // [9.1.5].8 Remote activity [9.1].11 // [9.1].13-14 // [9.1].11 // [9.1].13 // [9.1] [9.1].13-14 // [9.1].26 // (execution) [9.1] 26-29 // [9.1].31 // 26-33 // [9.1.2].3 // [9.1].28 // [9.1].39 // [9.1].33 // [9.1].39 // [9.1.3].3-10 // [9.1.4]1-5 // [9.1.2].3 // [9.1.3].3-4 // [9.1.4].8 // [9.1.5].1-8 [9.1.3].9-10 // [9.1.4]1 // [9.1.4].3-4 // [9.1.4].8 // [9.1.5].1 // [9.1.5].3 // [9.1.5]5-6 // [9.1.5].8 Communication [9.1.3].9 // [9.1.4].1 // [9.1.3].9 // [9.1.4].1-2 // jamming [9.1.4].8 // [9.1.4].13 [9.1.4].8 // [9.1.4].13 Bypass of devices [9.1].1 // [9.1].4-5 // [9.2.3].3 [9.1].1 // [9.1].4-8 // // [9.1].12-14 // [9.1].21-22 (bypass security [9.1].8 // [9.1].10-15 // [9.1].10-11 // [9.1].13 // // [9.1].24 // [9.1].26 // controls) [9.1].22 // [9.1].26-29 // [9.1].15 // [9.1].24 // [9.1].28 // [9.1].39 // [9.1].31 // [9.1].33-37 // [9.1].26-37 // [9.1].40-41 [9.2.3].3-4 [9.1].39 // [9.1.1].1-2 // // [9.1.1].1-3 // [9.1.2].2 // [9.1.2].2 // [9.1.2].4 // [9.1.2].4 // [9.1.3].3-10 // [9.1.3].3-4 // [9.1.3].9-10 [9.1.4].4-5 // [9.1.4].7-8 // // [9.1.4].4 // [9.1.4].7-8 [9.1.4].12 // [9.1.4].14 // // [9.1.4].14 // [9.1.4].17-20 // [9.1.5].5-8 [9.1.4].17-20 // [9.1.5].5- 6 // [9.1.5].8 // [9.2.3].3- 4

text: December 2013

text: SOURCES Smart grid Information Enhancing Security Threat 20 Assurance and Security 21,37,38,39,40,41,42 Threat Threat details NIST Throughout the Supply Other Group 36 Technology Assessment Chain (IBM Center) 19 (Sacramento State) Insider attack Hardware, Software PCT manipulation [9.1].1 // [9.1].4-5 // [9.1].1 // [9.1].4-8 // // [9.1].12-14 // [9.1].21-22 and Device [9.1].8 // [9.1].10-15 // [9.1].10-11 // [9.1].13 // // [9.1].24 // [9.1].26 // manipulation [9.1].22 // [9.1].26-29 // [9.1].15 // [9.1].24 // [9.1].28 // [9.1].39 [9.1].31 // [9.1].33-37 // [9.1].26-37 // [9.1].40-41 [9.1].39 // [9.1.1].1-2 // // [9.1.1].1-3 // [9.1.2].2 // [9.1.2].2 // [9.1.2].4 // [9.1.2].4 // [9.1.3].3-10 // [9.1.3].3-4 // [9.1.3].9-10 [9.1.4].4-5 // [9.1.4].7-8 // // [9.1.4].4 // [9.1.4].7-8 [9.1.4].12 // [9.1.4].14 // // [9.1.4].14 // [9.1.4].17-20 // [9.1.5].5-8 [9.1.4].17-20 // [9.1.5].5- 6 // [9.1.5].8 Firmware [9.1.4].14 [9.1.4].14 manipulation Compromise Central [9.1.4].1 // [9.1.4].3-4 // [9.1.3] // [9.1.4].1-6 // Systems to switch off [9.1.4].6 // [9.1.4].8-11 [9.1.4].8-23 // [9.1.5] homes with E- // [9.1.4].13-14 // meters, deletes all [9.1.4].17-20 // keys for the E-meters [9.1.4].22-23 and distribute malicious firmware. Time manipulation [9.1.4].8 //[9.1.4].11 [9.1.4].8 //[9.1.4].11 //[9.1.4].13-14 //[9.1.4].13-14 Legal Violation of laws or [9.1.4].1 // [9.2.1].1 [9.2.1].1-3 // [9.2.2].1-2 [9.1.4].1-2 [9.2.1].1-3 regulations / Breach of legislation Failure to meet [9.1.4].1 // [9.2.1].1 [9.2.1].1-3 // [9.2.1].4 // [9.1.4].1-2 [9.2.1].1-3 // [9.2.1].4 contractual [9.2.1].17-18 // [9.2.2].1requirements 3 // [9.2.2].21 //

text: December 2013

text: SOURCES Smart grid Information Enhancing Security Threat 20 Assurance and Security 21,37,38,39,40,41,42 Threat Threat details NIST Throughout the Supply Other Group 36 Technology Assessment Chain (IBM Center) 19 (Sacramento State) [9.2.2].33 // [9.2.2].35- 37 // [9.2.2].39 // [9.2.2].52 // [9.2.3].2 Unauthorized use of [9.1.4].1 // [9.2.1].1 [9.2.1].1-3 // [9.2.2].1-2 [9.1.4].1-2 [9.2.1].1-3 copyrighted material

text: December 2013

text: Name of the Information Information Item (URL Relevance DATE of Item Comments Item/Document or file) (High/Medium/L ow)

text: http://www.cencenelec 1 M/490 Document base High .eu/STANDARDS/HOTT OPICS/SMARTGRIDS/Pa ges/default.aspx http://ec.europa.eu/inf 2 Documentation on Smart High relevance. It ormation_society/news Grids of DG-CONNECT includes a threat room/cf/dae/itemdetail assessment. .cfm?item_id=9817

text: Documents on Smart Grid http://ec.europa.eu/en High of DG ENERGY ergy/gas_electricity/sm artgrids/taskforce_en.h tm

text: Draft of M/441 on Smart High Meters regarding Privacy and Security approach SM-CG AHWG PS report v0 9.pdf

text: ENISA Documents from Items are available at Medium Mid 2012 last year’s survey ENISA. Can be delivered on demand

text: BSI Protection Profile for https://www.bsi.bund. High March 2013 Smart Meters de/SharedDocs/Downlo ads/DE/BSI/SmartMete r/PP- SmartMeter.pdf?__blo b=publicationFile

text: Crisalis risk assessment High May 2013 Risk Assessment

text: crisalis_deliverable-D 2.2.pdf

text: Functional reference ftp://ftp.cen.eu/cen/Se Medium December 2011 architecture for ctors/List/Measuremen communications in smart t/Smartmeters/CENCLC metering systems. ETSI_TR50572.pdf (Technical Report http://www.cenelec.eu CEN/CLC/ETSI/TR 50572) /aboutcenelec/whatwe do/technologysectors/s martmetering.html

text: Steps towards http://www.eos- Low November 2011 implementing a European eu.com/files/Document cyber-security strategy s/WhitePapers/Steps_c yber_security.pdf

text: EURACOM (EUropean http://www.eos- Medium 2012 Main Risk Assessment and eu.com/?Page=euraco objectives: Contingency planning m - Promote a Methodologies for

text: December 2013

text: interconnected networks) dialogue reports and deliverables between energy and security stakeholders to attend the security of energy infrastructures. - Support European policies for the protection of critical energy infrastructures.

text: Sicherheit im Smart Grid. http://www.stiftungakt Medium 2011 Key elements of Eckpunkte für ein uell.de/files/sr90_siche a smart grid Energieinformationsnetz rheit_im_energieinform security. ationsnetz_gesamt.pdf

text: NISTIR 7628. Guidelines http://csrc.nist.gov/pub High September 2010 for Smart Grid Cyber lications/nistir/ir7628/i Security ntroduction-to-nistir- 7628.pdf

text: Supply Chain Solutions http://www.us- High 2012 Emerging risks for Smart Grid Security: nesco.org/files/2013/01 and supply Building on Business Best /SupplyChain-Solutions- chain solutions. Practices for-Smart-Grid- Business best Security.pdf practices to secure the smart grid supply chain.

text: Smart Grid Cyber http://www.energy.ca. High May 2012 Security. Potential gov/2012publications/C Threats, Vulnerabilities EC-500-2012-047/CECand Risks 500-2012-047.pdf

text: Cisco Smart Grid Security http://www.cisco.com/ Medium 2009 www.cisco.com Solutions web/strategy/docs/ene /go/smartgrid rgy/CiscoSmartGridSec urity_solutions_brief_c 22-556936.pdf

text: Cisco GridBlocks http://www.cisco.com/ Medium 2011 www.cisco.com Reference Model web/strategy/docs/ene /go/smartgrid rgy/gridblocks_ref_mod el.pdf

text: Cisco GridBlocks http://www.cisco.com/ Medium 2012 www.cisco.com Overview web/strategy/docs/ene /go/smartgrid rgy/overview_gba.pdf

text: Smart Grid Security: http://www.aloul.net/P High September 2012 Research paper Threats, Vulnerabilities apers/faloul_ijsgce12.p and Solutions df

text: December 2013

text: Cyber Attack Exposure http://ieeexplore.ieee.o Medium December 2011 Research paper Evaluation Framework for rg/stamp/stamp.jsp?tp the Smart Grid =&arnumber=6025254

text: Cyber Security and Power http://ieeexplore.ieee.o Medium July 2010 Research paper System Communication— rg/stamp/stamp.jsp?tp Essential Parts of a Smart =&arnumber=5452993 Grid Infrastructure

text: Security Technology for http://ieeexplore.ieee.o Medium June 2010 Research paper Smart Grid Networks rg/stamp/stamp.jsp?tp =&arnumber=5460903

text: Smart-grid security issues http://ieeexplore.ieee.o Medium Feb 2010 Research paper rg/stamp/stamp.jsp?tp =&arnumber=5403159

text: Towards a Framework for http://ieeexplore.ieee.o Medium 2010 Research paper Cyber Attack Impact rg/stamp/stamp.jsp?tp Analysis of the Electric =&arnumber=5622049 Smart Grid

text: Decreased time delay and http://ieeexplore.ieee.o Medium 2010 Specific security enhancement rg/stamp/stamp.jsp?tp Research paper recommendations for =&arnumber=5434780 AMI smart meter networks

text: Smart Grid Privacy via http://ieeexplore.ieee.o Medium 2010 Specific Anonymization of Smart rg/stamp/stamp.jsp?tp Research paper Metering Data =&arnumber=5622050

text: Security and Privacy http://ieeexplore.ieee.o Medium June 2009 Specific Challenges in the Smart rg/stamp/stamp.jsp?tp Research paper Grid =&arnumber=5054916

text: Securing where smart http://www.embedded. Medium May 2013 grids meets SCADA com/design/safety-andsecurity/4413576/4/Sec uring-the-smart-gridand-SCADA

text: Energy measurement and http://www.maximinte Medium Jan 2013 security for the smart grid grated.com/app- – too long overlooked notes/index.mvp/id/55 36

text: Information of EEUU http://www.smartgrid.g High Currently updated initiatives in smart grids. ov/ and http://www.smartgrid.g ov/library

text: December 2013

text: 21 steps to improve cyber 21 Steps to improve CS High Not specified security of SCADA of SCADA networks networks

text: AMI System Security http://energy.gov/sites Medium 17/12/2008 Requirements /prod/files/oeprod/Doc umentsandMedia/14- AMI_System_Security_ Requirements_updated .pdf

text: Industrial control systems Industrial Control Medium 4Q 2012 security Systems Security

text: Infrastructure protection: http://www.homelands Medium 19 august 2013 U.S. power plants, ecuritynewswire.com/d utilities face growing r20130819-u-s-powercyber vulnerability plants-utilities-facegrowing-cybervulnerability

text: Guidelines for Assessing http://collaborate.nist.g Medium February 2011 Wireless Standards for ov/twiki- Smart Grid sggrid/pub/SmartGrid/ PAP02Wireless/NISTIR7 Applications 761.pdf

text: Protecting SCADA devices http://www.embedded. Medium September 2012 from threats and hackers com/design/safety-andsecurity/4397214/Prote cting-SCADA-devicesfrom-threats-andhackers-

text: Recommendations for http://www.etsi.org/W Medium May 2011 smart grid ebSite/document/0905 standardization _RA%20smart%20grids- Bdef.pdf

text: Utility Cyber Security http://www.navigantre Medium 4Q 2011 Research report search.com/wp- Seven Key Smart Grid assets/uploads/2011/1 Security 1/UCS-11-Pike- Trends to Watch in 2012 Research.pdf and Beyond

text: Smart Grid: 10 Trends to http://www.navigantre Medium 1Q 2013 White paper Watch in 2013 and search.com/wp- Beyond assets/uploads/2013/0 3/WP-SG10T-13- Navigant-Research.pdf

text: Smart Grid Information http://ec.europa.eu/en Medium November 2012 Security ergy/gas_electricity/sm artgrids/doc/xpert_gro up1_security.pdf

text: Smart Grid Security: http://s3.amazonaws.c High October 2012 PPT

text: December 2013

text: threats, vulnerabilities & om/sdieee/207-SG- presentation potential Threats_Vulns_Counter countermeasures measure.pdf

text: Cyber security in smart http://www.ece.ncsu.e High January 2013 grids - survey and du/netwis/papers/13wl challenges -comnet.pdf

text: 2012 DOE Smart Grid http://www.smartgrid.g High December 2012 It shows a Cybersecurity ov/sites/default/files/d summary of Information Exchange oc/files/2012_Cybersec best practices urity_Information_Exch exposed in the ange.pdf event.

text: Smart management is the http://www.embedded. High December 2010 The article key to smart grid meter com/design/connectivit defends the security y/4211457/Smart- smart management-is-the- management key-to-smart-grid- for smart grids. meter-security

text: Supply Chain Solutions US_ResilienceProject High 2012 for Smart Grid Security: Building on Business Best Practices

text: Load Redistribution Load Redistribution Medium 2012 Attacks and Protection Attacks and Protection Strategy in Electric Power Strategy in Electric Systems Power Systems

text: Developing a Solid SCADA DevelopingASolidSCAD Medium 11/2002 Security Strategy ASecurityStrategy

text: Next Generation SCADA NextGenerationSCADAs 2005 Security: Best Practices ecurityBestPracticesAn High and Client Puzzles dClientPuzzles

text: Security as a New SecurityASANewDimens High 2004 Dimension in Embedded ionInEmbeddedSystem System Design Design

text: Enhancing security http://www- High 2004 Throughout the Supply 304.ibm.com/jct03001c Chain /procurement/proweb. nsf/objectdocswebview /filesupply+chain+secur ity+white+paper+and+a ssessment+guide+april+ 2004/$file/supply+chai n+security+white+pape r+and+assessment+guid e+april+2004.pdf

text: Smart grid information http://www.energy.ca. High 2010-2013 assurance and security gov/2013publications/C technology assessment EC-500-2013-056/CEC- 500-2013-056.pdf

text: December 2013

text: Best practices in the BestPracticesInTheDepl High 2010 deployment of smart oymentOfSmartGridTec grids technologies hnologies

text: Privacy by Design Privacy by Design: High 2010 Achieving the Gold Achieving the gold Standard in Data standard in data Protection for the protection for the smart Smart Grid grid.

text: Embedding Privacy into Embedding privacy in High 2010 Smart Grid Initiatives smart grids

text: Towards Addressing http://ieeexplore.ieee.o High 2012 Common Security Issues rg/xpl/articleDetails.jsp in Smart Grid ?reload=true&arnumbe Specifications r=6309314

text: December 2013

identifier: Smart Grid Threat Landscape and Good Practice Guide

publisher: Europeiska unionens cybersäkerhetsbyrå

sprak: en

title: Smart Grid Threat Landscape and Good Practice Guide

serie: rapporter

text: 9 December 2013

type: stycke

text: European Union Agency for Network and Information Security www.enisa.europa.eu

text: Smart Grid Threat Landscape and Good Practice Guide

text: About ENISA

type: rubrik

text: The European Union Agency for Network and Information Security (ENISA) is a centre of network and information security expertise for the EU, its member states, the private sector and Europe’s citizens. ENISA works with these groups to develop advice and recommendations on good practice in information security. It assists EU member states in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in EU member states by supporting the development of cross-border communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found at www.enisa.europa.eu.

text: Authors

text: Louis Marinos, ENISA E-mail: Louis.marinos@enisa.europa.eu

text: Contact

text: For contacting the editors please use resilience@enisa.europa.eu. For media enquires about this paper, please use press@enisa.europa.eu.

text: Page ii

text: Acknowledgements

text: This study has been carried out in collaboration a group of experts in the area of Smart Grids, namely: Ralph Eckmaier, Independent Advisor, Austria, Michael John, Elster GmbH, Germany and Jean-Pierre Mennella, Alstom Grid, France. Everis Aerospace and Defence, together with Universidad Politécnica de Madrid has contributed as external contractor in the phase of information collection and analysis. The involved experst within this contract were:  Everis Aerospace & Defence: María Pilar Torres Bruna, Fernando Sanchez Palencia  Universidad Politécnica de Madrid: Professor Dr Victor Villagrá González, Professor Dr Carmen Sanchez Ávila, Verónica Mateos Lanchas, Vicente Jara Vera

text: Legal notice

text: Copyright Notice

text: Page iii

text: Executive summary

text: Smart grids are complex systems. A smart grid is a system of systems delivering energy to consumers. Smart grid stores, transports and manages energy. Smart grid is a de facto Critical Infrastructure as energy is important for the well-functioning of the society and economy. Being the blending of the energy and telecommunication critical infrastructures, smart grids should operate securely and by respecting end users’ privacy. Moreover, the protection of the smart grid is the key to energy availability. In this document we elaborate on cyber security issues with regards to smart grid information infrastructure. The security of a complex system is also a complex matter. In order to cope with this complex environment, this document leverages the following principles for simplifying the problem: Consider external and internal threats: In cyber-security the external environment are the cyberthreats. This cyber-threat environment originates from threat agents, the adversaries utilizing cyberthreats and launching cyber-attacks. Although dynamically changing, the cyber-threat landscape can be described and has finite elements. An understanding of the cyber-threat landscape is indispensable for the identification of the necessary protection measures. In this document, we provide a threat landscape affecting smart grid components. Internal threats are considered as well: a variety of threats emanating from errors and insider attacks are also taken into account. Decompose and classify the elements: A decomposition of smart grid components is one of the main tasks to tackle its complexity. This task is currently being performed by various experts around Europe and the World. Within this report, we have adopted the smart grid decomposition provided in the document Smart Grid Reference Architecture of the Smart Grid Standardization Coordination Group of CEN-CENELEC-ETSI. This is because this work is a highly reputed document among the security experts in Europe. Capture available knowledge: What have others done in the area of smart grid protection? This has been addressed by taking stock of available cyber-security approaches, protection approaches and good practices developed recently. In response to the urgent question of many stakeholders: How does this document support me in my work? this document provides tools to assess risk exposure of smart grid assets and will show what others have done in this respect. It elaborates on the threats smart grid components are exposed to and on the security controls to reduce threat exposure. But the assessment on the living object can be done only by the asset owner, just because asset owners master the complexity of infrastructures and the interdependencies among various assets. This task cannot be done as a generic exercise or it would have low value. Concluding, one should note that the use of these tools will depend on the capabilities of the expert users. In cyber-security preparedness, however, much depends on the capabilities of the adversary, which are not always known and certain; “That which depends on me, I can do; that which depends on the enemy cannot be certain. Therefore it is said that one may know how to win, but cannot necessarily do so” (Sun Tzu ).

text: Page iv

text: Being knowledgeable about what can be achieved is one thing. The other is to reduce the impact. In cyber-security – an environment with asymmetric approaches - this can be achieved through common effort and coordination.

text: Page v

text: Table of Contents

text: Executive summary iv 1 Introduction 1 2 Method 4 3 Smart Grid Assets 6 4 Threats 9 5 Specific Smart Grid Threats 11 6 Smart Grid assets exposure to cyber threats 16 7 Threat agents 21 8 Vulnerabilities and Risks in Smart Grid 23 9 Good Practice of Smart Grid Security Measures 25 10 Conclusions 35

text: Page vi

text: 1 Introduction

text: This document elaborates on threats related to smart grids. Being an ENISA deliverable in the area of Threat Landscape, it comprises a detailed threat assessment in the area of smart grids, based on input form the generic ENISA Threat Landscape activities . The rationale behind this piece of work is to “deepen” the generic threat assessment by taking into account specificities of smart grids, a vital CIIP sector. By doing so, the objective is to complement various activities going on both within and outside ENISA, that is:  To perform a threat assessment on the basis of which smart grid security measures will be based. This activity is in support of related activities of the Commission: DG-ENER, in close cooperation with ENISA and DG CNECT, has decided to task the EG2 working group with the organisation of consultations security requirements with national cyber security authorities and the energy and ICT industry. 3 4  To deliver input to other international activities, in particular in the area of standardisation , . In this context, the threat analysis provided in this document will be reused in the definition of security measures for smart grid infrastructure models (scenarios). The present work is based on information developed within the ENISA Threat Landscape (ETL): relevant information about top threats is included in this document. The threats have been mapped to smart grid assets: this indicates the kind of exposure each asset has. Moreover, threat agents have been identified as originators of these threats. Through the established relationship among threats->assets->threat agents it becomes evident what threats smart grid assets are exposed to. Moreover, the capabilities of possible adversaries are also identified. This information is useful for a variety of security related activities in the area of smart grids, such as risk assessments, formulation of security requirements, identification of protection requirements, etc. This work is concluded with a good practice guide, consisting of an overview of smart grid security approaches. In particular, it is demonstrated how available smart grid controls from various existing standards protect against the identified threats. The structure of this report has been agreed with the expert group that has supported this ENISA work. Moreover, a contribution to the ENISA work on security measures for smart grids has been generated.

text: Policy Context

text: The Cyber Security Strategy for the EU stresses the importance of threat analysis and emerging trends in cyber security. The ENISA Threat Landscape is an activity towards the achievement of objectives formulated in this regulation, in particular by contributing to the identification of emerging trends in cyber-threats and understanding the evolution of cyber-crime (see 2.4 regarding proposed role of ENISA). Moreover, the new ENISA regulation mentions the necessity to analyse current and emerging risks (and their components), stating: “the Agency, in cooperation with Member States and, as

text: appropriate, with statistical bodies and others, collects relevant information”. In particular, under Art. 3, Tasks, d), iii), the new ENISA regulations states that ENISA should “enable effective responses to current and emerging network and information security risks and threats”. From the above points it becomes apparent that the ENISA Threat Landscape is a significant contribution to the EU Cyber Security Strategy by streamlining and consolidating available information on cyber-threats and their evolution. Detailing the ENISA Threat Landscape for various emerging areas provides valuable contextual information to existing policy measures established by the commission. In the area of smart grids, in particular, this work supports a recommendation of the Commission: the European Commission included a number of data protection, privacy and security measures in the March 2012 Commission Recommendation on preparations for the roll-out of Smart Metering systems . Furthermore, it initiated action under the auspices of the smart grids Task Force with a dedicated Expert Group (EG2) focusing on two key concrete outcomes to be delivered in 2013, namely: 1) a Data Protection Impact Assessment (DPIA) template as a response to consumer concerns related to data protection and privacy; and 2) a cyber-security assessment framework as a response to investor and industry concerns related to system security. The cyber security assessment framework is composed of two sub-deliverables. First, a set of Best Available Techniques (BATs) pinpoints the potential cyber security risks inherent to each of the common minimal functional requirements for Smart Metering Systems recommended in the March 2012 Recommendation and identifies optimal controls and Privacy Enhancing Technologies to mitigate each of these risks. Second, a blueprint for a network will be elaborated, where information about incidents, threats, vulnerabilities and good practices can be shared for critical infrastructure protection . This work aims to provide a significant contribution towards assessing cyber threat exposure of smart grid infrastructures. As such it will directly contribute to the assessment of cyber security and comes to support investor and industry concerns.

text: Target Audience

text: This material is a tool for smart grid asset owners who wish to perform threat analysis and risk assessment according to their particular needs (i.e. asset protection level based on asset impact, vulnerabilities and detail of mitigation measures). While in this document the threat exposure of smart grid assets is being presented, asset owners may deepen their threat analysis and risk assessment by using asset and threat details provided in this document. A deeper analysis will be based on assessed threats, vulnerabilities and impact statements with regard to the concrete assets participating in a smart grid infrastructure scenario (see also specific threats in section 5). Moreover, the smart grid threat landscape will be of interest for policy makers: current threats and threat trend may be important input in policy actions in the area of cyber-security, critical infrastructure protection and smart grid in particular. Through the large number of collected reports, the smart grid threat landscape provides a unique collection of information regarding cyber-security threats. Hence, a further target group of this document are individuals who would like to obtain access to these sources in order to use them for their own purposes.

text: Structure of this document

text: The rest of this document is organised as follows:  The rationale of the smart grid threat landscape is presented  A section that presents asset types that are typical for a smart grid environment. Moreover, composite assets are being presented, covering various asset types as they are foreseen within the Smart Grid Reference Architecture Model (SGAM) ;  A section on the threat categories smart grid assets are exposed to. In this section, smart grid specific threats are presented as they emerged from the performed information collection and analysis.  A section showing the smart grid asset types exposure to the threats and  A section showing which threats emerge from which threat agent groups.  A chapter with available smart grid security good practices indicating their protection against the identified threats.  A conclusion summarizes various issues and gives an outlook of activities/open issues and upcoming actions in this area. It is worth mentioning that in order to keep the size of this text as short as possible and enhance readability, detailed material is being provided by means of Annexes. This information is important for smart grid owners who wish to perform risk assessment and/or adapt the proposed security measures to their particular environment and needs.

text: 2 Method

text: In order to identify required protection levels of valuable assets it is common to perform a risk assessment. Subsequently, security measures have to be introduced to achieve the target level of protection by mitigating (part of) the assessed risks. As discussed below, threats are an important element in risk assessment. In this chapter we present the rationale and method followed within the Smart Grid Threat Landscape (SGTL). It consists of a number of threats to which smart grid assets are exposed. Hence, the presented SGTL is an important tool for those who want to assess the risks within a smart grid environment. Based on these risks, appropriate security measures can be selected to achieve risk mitigation. The role of threats in the risk assessment activity becomes evident when looking at the components of risks. According to the widely accepted ISO 27005 definition risks emerge when: “Threats abuse vulnerabilities of assets to generate harm for the organization”. In more detailed terms, we consider risk as taking into account the following elements: Asset (Vulnerabilities, Controls), Threat (Threat Agent Profile, Likelihood) and Impact The elements of risks are graphically depicted in the figure below:

text: This figure has been adopted from ISO 13335-4 and shows how threats try to exploit asset vulnerabilities in order to harm/take over the asset. The asset owner has implemented security measures to protect the asset, that is, to eliminate its vulnerabilities. The impact achieved by the potential materialization of a threat is the final element to evaluate the risk of an asset (see also risk definition above). While the definition of risks for an asset is a quite straight forward task, in complex environments it is often a challenge to assess risks. This is in particular the case in smart grids due to their technical complexity, interdependencies among components, multiplicity in operational responsibilities and 4

text: complex supply processes. The present document is generic, hence it does not assume any particular smart grid environment and/or the processes implemented through it. As such, it is impossible to make any valid assumptions about impact and vulnerabilities of assets. These are activities that can solely be performed by the asset owner. Hence, the need for supporting tools for the performance of risk assessments becomes obvious and essential for the asset owner in this complex environment. In this document, we provide information on threats and threat exposure of typical smart grid assets, independently of any infrastructure scenarios. In other words, the smart grid Threat Landscape consists of a list of assets, and the threats applying to these assets. Further, by means of the presented good practices, we identify various security measures found in smart grid security approaches. By mapping these measures against threats we show how security measures are the used to avoid the assumed threat exposure. Given this information, the asset owner will need to assess vulnerabilities and impact in order to assess the risk and find risk mitigation measures (eventually among the ones from the processed good practices).

text: 3 Smart Grid Assets

text: A smart grid may consist of a plethora of asset types. For the sake of information security, we consider assets that are mainly related to information and communication technology. Due to the massive deployment of IT-based components in the area of electricity and transport network, some assets that are characteristic for smart grids have been added. These assets generate or process data and as such are exposed to cyber-security threats. In addition to the IT-assets, some non-IT assets have been included that are tightly related to the proper operation of IT assets. Examples hereto are: some electrical assets such as cables and relays, facilities, human resources, non-IT media, etc. The figure bellow gives an overview of the smart grid assets structure into relevant categories according to their use (see Figure 2). A more detailed description of these assets is given in Annex A. Besides these smart grid assets, some composite, more complex assets have been identified. These assets have been taken from the Smart Grid Architecture Model (SGAM) . By considering these assets, our intention is to take into account this standard, while at the same time showing the decomposition of the SGAM assets by means of the assets of Figure 2. This will allow interested individuals to find threats applying to such complex assets by cumulating the threats of their counterparts. Given the relatively young age of smart grid, it has to be taken as given that smart grid environments might grow over what is today being considered to be part of a smart grid infrastructure. Examples 11 12 of such assets might be elements currently considered as part of Smart Cities and Smart Mobility . Indicatively for this type of assets, we have included a relevant part of e-Mobility in the smart grid asset types. Hence, the asset taxonomy presented should be considered as a snapshot of the current state-of-play and as such non-exhaustive.

text: The SGAM composite assets are decomposed by means of the asset groups shown in Figure 2. The decomposition of SGAM assets is presented in Table 1 below. It is worth mentioning that the terminology used, in particular zones and domains, has been taken as-is from the SGAM standard. Interested individuals might visit the SGAM document to find more explanations about zones, domains and their counterparts.

text: 4 Threats

text: For the purpose of the SGTL, a threat-taxonomy has been developed. The threats included in this collection of threats are all applicable to the smart grid assets presented in the previous section. The presented threat taxonomy covers mainly cyber-security threats, that is, threats applying to information and communication technology assets. Some additional non-IT threats have been assumed in order to cover threats to physical assets that are necessary to operate the considered ICT-assets. It is worth mentioning that the presented threats are a consolidation of threats from the ENISA Threat Landscape and threats used within a smart grid assessment performed by DG CONNECT . Moreover, the threats presented reflect the experience made within the ENISA Annual Incident Report 2012 regarding incidents in the telecommunication sector . This report is considered relevant, as attack methods and threats in smart grid and the telecommunication sector are considered to be very similar (i.e. as applying to similar IT-assets). The threats presented in Figure 3 are an overview. A detailed listing of these threats can be found in Annex B. This material contains additional information on threats such as:  Threat details: this field explains further details of a threat as they have been found in analysed material on cyber-threats.  Threat Agent: This field explains which threat agent group is considered to deploy attacks based on this threat.  Trend: This field indicates assessed trends for each particular threat. Such trends have been assessed by analysing publicly available threat reports. Threats that do not have a value in the trend field are not subject of ENISA Threat Landscape. They are mentioned because they might be potentially useful for risk assessments.

text: It should be noted, that the details presented reflect the current state of play within the ENISA Threat Landscape and are subject to changes according to new developments in that area and emerging threat issues (i.e. being a living document reflecting dynamic changes in the cyber-threat environment).

text: 5 Specific Smart Grid Threats

text: By analysing existing literature on smart grid security (see references and collected information in Annex D), we have identified specific threats that have been taken into account in existing assessments. The analysed material covers parts of smart grid infrastructure, in particular smart meters and some generic smart grid infrastructures within research projects. Thus, the specific smart grid threats presented in this section reflect the state-of-play in relevant available documents and, as such, are not exhaustive. Due to the complexity of smart grid infrastructures, one should argue that the set of threats presented in this chapter still have relevance for prospective infrastructure configurations and should be considered within risk assessments when relevant assets are part of the scenario at hand.

text: The specific smart grids encountered in the analysed literature are structured according to the categories mentioned in Figure 3. They are presented by means of threat details of particular threats and threat groups. It should be noted that the sequence of the specific smart grid threats presented below is not prioritized. This is because the analysed material has not provided any information that would allow prioritizing threats. Given the fact that no significant experience exists in this domain from existing implementations (i.e. through incident statistics in this area), no attempt has been undertaken to introduce any priorities for these threats. For obtaining a priority list of current cyber- 16,17,18 threats, we suggest interested readers to visit the ENISA Threat Landscape report . In the presentation of specific smart grid threats below, we use the same threat classification as the one used in Figure 3. Threat Group: Damage/Loss Threat: Loss of devices, media and documents In smart grid environments this threat involves rummaging through disposed magnetic media for retrieving sensitive data that is left behind on it. In particular, it is assumed that unauthorized people might come to possession of data related to Advanced Metering Infrastructure (AMI) communication . Threat: Information leakage Attacks of this type target various smart grid components and their main aim is to acquire private 19,20 sensitive information (energy consumption, credit cards, session data, access control data) .

text: Threat Group: Eavesdropping/Interception/Hijacking

text: Threat: Interfering radiation Electro ‐Magnetic/ Radio Frequency interception is a threat that aims at performing unauthorized interception of private communication. In particular, it is assumed that unauthorized people might come to possession of data related to Advanced Metering Infrastructure (AMI) communication .

text: This threat materialises when threat agents are trying to interfere with the physical transmission and reception of wireless communications. It is one of the most efficient ways to launch physical-layer DoS attacks, especially targeting wireless communications. This can severely impact smart grid operations as they use wireless communication for various tasks . Another threat of this type in smart grid regards the extraction of data by analysis of various types of electromagnetic radiation emitted by a CPU, display, keyboard, etc. In case of smart grids, these attacks are viable because equipment is installed in the field, geographically distributed and they are accessible . Threat: Man in the middle, session hijacking In smart grid environments, interactions of AMI components with the infrastructure can be compromised. That could lead to unauthorized access to AMI communication information, modification of AMI data, denial of service to authorized users, and repudiation of actions . Threat: Interception of information Through interception of information several networks of different natures can be affected, such as WIFI, Zegbee and fixed networks. Particular variations of this threat may include:  Hijacking of the meter connection though a kind of unauthorized devices / messages to communicate with the DR system .  Intercepting information by side-channel attacks. Such attacks are based on physical accessibility (Substation, smart meters, collectors, etc.) to gain information from the physical implementation of a cryptosystem as the components of the smart grid are geographically distributed.  Intercepting and examining messages in order to deduce information from patterns in communication .  Sniffer attacks whereby an attacker with the appropriate access captures and analyses the 19,20,21 messages transmitted over the network .  Use of External Traffic with the aim to intercepting and examining messages in order to deduce information from patterns in communication . Threat: Network reconnaissance and information gathering Information gathering attacks of mobile communication (in particular 802.16e) may target the Advanced Encryption Standard (AES) cipher providing strong confidentiality on user data .

text: Threat: Replay of messages Acknowledges forgery is a threat where an attacker knows the DNS value and can send a false acknowledgement messages to the sender saying that the receiver has received the message when, in fact, it hasn't .

text: Threat Group: Failures/Malfunction Threat: Failure of devices and systems Given the complexity of smart grids and the multiplicity of devices and systems, it should be taken as given that a significant amount of incidents will be attributed to failures, misconfiguration and

text: errors. This has been confirmed by incidents communicated to ENISA in the area of telecommunications , a sector with equally complex infrastructure. Threat: Failure or disruption of communication links (communication networks) Attacks abusing implementations of standards are based on missing or weak implementations of security mechanisms, in particular when standards used have not been developed with security in mind .

text: Threat Group: Nefarious Activity/Abuse Threat: Unsolicited e-mail Personnel engaged by various players in smart grid can be victims of anonymous, unsolicited e-mail attacks. This might be part of a targeted campaign . Threat: Denial of Service attacks These attacks attempt to make smart grid resources unavailable to its intended users (internal and 20,21 external). They can target to different layers of network and applications (physical / data-link) . Such attacks can be also performed by jamming the power-line . Threat: Manipulation of hard- and software Through manipulation, an attacker may manipulate scheduling by disabling antenna and changing Programmable Communicating Thermostat (PCT) Time locally . In particular:  Break into EWS, use engineering software to access field controllers and change their logic .  Get access to the operator station and perform targeted operator actions to stop all machines .  Manipulation of firmware of smart e-meters. This may include manipulated firmware that is sent from Central System to E-meter of manipulated firmware that is sent from Central system (via Data Concentrator) .  Compromise Central Systems to (1) switch off homes with E-meters; (2) delete all keys for the Emeters; and (3) distribute malicious firmware . Threat: Malicious code /Activity These threats affect smart grid as all the functioning of all involved IT components depends on the installed software. In detail, this threat consists of:  Exploit kits are a widely deployed form attack. Through exploit kits virus and malware infections are performed. Infected devices may be manipulated by the attacker. Malware infected operator stations may send targeted commands to DCS Server to disturb or manipulate they operation .  In smart grid, worms may be distributed by using the network to send copies to other nodes (computers on the network) . Worms may affect the operation of all smart grid components connected to the network.  Trojans are pieces of malware that facilitate unauthorized access to a computer system . Worms may affect the operation of all smart grid components connected to the network.

text:  Backdoor / trapdoor is an undocumented entry point into a computer program, which is generally inserted by a programmer to allow access to the program . Vendors of smart meters, for example, may have installed firmware with backdoors or some hidden functionality to facilitate access to the device.  Service Spoofing is an attack in which the adversary successfully masquerades as another by falsifying data and thereby gaining an illegitimate advantage . A concrete example of spoofing is ARP spoofing in the MAC layer: the management frames are not authenticated in 802.11. Every frame has a source address. The attackers take advantage of the spoofed frame to redirect the traffic and corrupt the ARP tables .  With an ICMP-flooding attack, an adversary can flood a gateway with ICMP packets, thereby creating difficulties in the operation of clients associated to the same IP to send and receive packet.

text: A special case of a malicious activity that is leading to numerous incidents in all environments is that of “insider threat”. With this approach, adversaries would take advantage of access to systems at the operator’s end of the AMI system. The systems that the insider may be able to access include multiple appliances of a smart grid environment, including AMI, the system containing pricing information (either EMS or ICCP server to an ISO or generation entity), as well as the network infrastructure supporting those systems. Which malicious activity an insider uses, depends on their access to the various smart grid systems . Threat: Unauthorized access to information system / network External disclosure of information is an attack occurring when information is being disclosed to unauthorized entities. Smart grids manage privacy data, hence this threat is relevant in this environment. Regarding the unauthorized access to systems/network, the attacker may gain unauthorized access 19,21,25 to the information system / network from different locations of the smart grid such as:  Customer endpoint: There is a potential for AMI to allow access to the bulk electric grid from the residential or small business customer endpoint. The adversary can suborn the customer endpoint, intervene in wireless communication between the AMI meter and other endpoint equipment, or from the AMI meter to the local concentrator. These attacks will expose the head end equipment and systems to which the head end are connected. The exact details of this attack are greatly dependent on the implementation of AMI, particularly at the head end. Certain configurations would allow an attacker to affect the bulk electric grid. Through violation of the privacy of the consumer (1) disclose meter data or configuration data (Meter, Gateway or CLS configuration) or parts of it when transmitted between gateway and external entities in the WAN; (2) disclose meter data transmitted between the TOE and the meter. This threat is of specific importance if meters of more than one consumer are served by one gateway .  Remote access: Unauthorized remote access to SCADA systems via remote access from outside the smart grid network.  Remote access or physical access to the network: compromise DCS Server and disturb / disable communication with controllers in the field network . Compromise DCS Server and send commands to control and manipulate the configuration (parameters) of controllers. Compromise

text: DCS Server and stop communication with Operator Station (stop delivery of data to Operator 24 24 Station) . Compromise RTU and send commands directly to controller . Threat: Manipulation of information This threat includes all kinds of manipulative activity regarding smart grid information, in particular AMI data and repudiation related information (e.g. AMI data, pricing information, invoicing 19,20 information, etc.). This threat relates to information of all software used, but also certificates . This threat might be deployed by means of the following methods:  Through buffer overflow attacks by inserting an incorrect value in the message fields, thus affecting message processing or sets the DFC flag. This might cause, for example, an outstation device to appear busy to the master. These attacks can result in data corruption, unexpected actions and device crashes .  Load redistribution attack is an injection of realistic false data with limited access to specific measurement data .  Delivery of wrong data to operator station that looks valid and harmless .  Manipulation of data received from TSO plant will cause working with wrong values, thus affecting the operation of RTU .  Manipulation of data sent to TSO and Energy Management Center, thus affecting the operation of RTU .  Attacker compromises an existing data concentrator and causes sending wrong data to the central system .  Attacker alters meter data when transmitted between meter and Gateway, Gateway and consumer or Gateway and external entities. The objective can be to alter billing-relevant information or grid status information; the attack may be performed via any interface (e.g. LMN, HAN or WAN) .  Attacker alters meter data, gateway configuration data, meter configuration data, CLS configuration data or a firmware update when transmitted between the gateway and an external entity in the Wan .  False data are injected by an attacker in the smart grid traffic. The attacker injects false or malicious DR events in DRAS (Demand Response Automation Server), causing blackouts and instability of the grid. Attacker modifies configuration data in the DRAS such as DR program data, customer list and shed event information, affecting the DR program behavior .  Through time modification of the Gateway time attackers aim at changing the relation between date / time measured consumption or production values in the meter data records . Threat: Misuse of information/Information Systems

text: In the absence of end-to-end encryption, a compromised data concentrator can be misused to monitor data of other customers .

text: Threat Group: Physical attack

text: Threat: Fraud

text: Within a reverse engineering attack, the customer at an endpoint would achieve reduction of cost of electric and/or natural gas use. They would use information freely available from the AMI meter vendor or the standard used within AMI meters to reset the meter and reprogram it to report false information. If the information is not freely available, the attacker would reverse‐engineer a meter to develop a way to modify it. This is very similar to the many cable modem attacks that are openly available. Either the configuration settings from the utility or the actual firmware controlling the

text: operation of the meter would be modified in this attack . With the same objective, AMI meters can

text: be removed from one home and placed to another .

text: 6 Smart Grid assets exposure to cyber threats

text: In this section the threat exposure of smart grid assets is presented. The association between assumed threats from Figure 3 and assets from Figure 2 is established through Table 2 below. As such, this table shows the threat exposure of assets and can be used as guidance in identification of

text: security needs. This table has been used within the document “Appropriate Security Measures”

text: that have been developed by ENISA on behalf of EG2 working group of the Commission .

text: 7 Threat agents

text: Threats emerge from groups of threat agents. For smart grid asset owners it is considered important to know which threats emerge from which threat agent group. This information is significant to decide on the kind of risks that should be mitigated: threat agent groups are indicative of the determination behind launched attacks and capability level. Given the importance of smart grids and the potential impact of attacks, smart grid asset owners will need to spend some thoughts on which protection might be appropriate in order to avoid exposure to attacks from a certain type of threat agent. The threat agents considered within this document are as follows:  Corporations: This kind of threat refers to corporations/organizations/enterprises that adopt and/or are engaged in offensive tactics. In this context, corporations are considered as hostile threat agents and their motivation is to build competitive advantage over competitors, who also make up their main target. Depending on their size and sector, corporations usually possess significant capabilities, ranging from technology up to human engineering intelligence, especially in their area of expertise.  Cybercriminals: Cybercriminals are hostile by nature. Moreover, their motivation is usually financial gain and their skill level is, nowadays, quite high. Cybercriminals can be organised on a local, national or even international level. It should be taken as given, that a certain degree of networking between cybercriminals is being maintained.  Employees: This category refers to the staff, contractors, operational staff or security guards of a company. They can have insider access to company’s resources and they are considered as both non-hostile threat agents (i.e. distracted employees) as well as hostile ones (i.e. disgruntled employees). This kind of threat agents possesses a significant amount of knowledge that allows them to place effective attacks against assets of their organization.  Hacktivists: Hacktivists are politically and socially motivated individuals that use computer systems in order to protest and promote their cause. Moreover, they are usually targeting high profile websites, corporations, intelligence agencies and military institutions.  Nation States: Nation states can have offensive cyber capabilities and use them against an adversary. Nation states have recently become a prominent threat agent due to the deployment of sophisticated attacks that are considered as cyber weapons. From the sophistication of these malware it can be confirmed that nation states have a plethora of resources and they have a high level of skills and expertise.  Natural disasters: Natural disasters are also threat agents and organizations are influenced by them, as they can cause potential physical damage. Natural disasters include lightning, fires, floods, earthquakes, windstorms etc. Although not a human threat agent, natural disasters are considered as such, as they can cause severe physical damage and impact the availability of information systems.  Terrorists: Terrorists have expanded their activities and engage also in cyber-attacks. Their motivation can be political or religious and their capability varies from low to high. Preferred targets of cyber terrorists are mostly critical infrastructures (e.g. public health, energy production, telecommunication etc.), as their failures causes severe impact in society and government. It has to be noted, that in the public material analyses, the profile of cyber terrorists still seems to be blurry.

text:  Cyber fighters: an emerging phenomenon is that of patriotic motivated groups of citizens with the potential to launch cyber-attacks . Such groups might have strong feelings when their political, national or religious values seem to be threatened by another group and are capable of launching cyber-attacks . Having said that, one can argue that such groups are special cases (maybe an evolution or yet another instance) of hacktivism. To an extent, such groups may be supporters of totalitarian regimes and, rightly or wrongly, act on behalf of their supporting parties (i.e. governments) by contributing to national activities in the cyber-space . Their activities may include conflicts with other groups (i.e. hacktivists) .

text: Based on these short threat agent profiles, the threats presented in this document can be assigned to relevant groups. This assignment is based on the threat agent group profile and in particular on assumed motives. Table 3 below presents the potential involvement of threat agent groups in the threats considered for smart grid assets.

text: 8 Vulnerabilities and Risks in Smart Grid

text: In this section some reflections are provided on smart grid vulnerabilities and risks. Before going into the findings, one should note that both developments of smart grid infrastructures and smart grid security are at an early stage of maturity. This is mainly because not very many such infrastructures are operational for a sufficient period such that experiences have been gained, analysed and shared. On the other hand, smart grid developments and security assessments are in many cases managed confidentially, either for reasons of competitiveness or for security reasons. Hence, publicly available information on smart grid security issues originates from research and standardisation activities and is based on requirements and generic assumptions. The validation of this material through real-life experience/examples is currently not feasible, at least at European level. Due to the immense investments that are necessary to set up a smart grid environment, standardisation activities are an important issue towards security of investments. Hence, a big amount of effort is currently invested in standardisation activities. Such activities are based on generic assumptions (i.e. infrastructure components, scenarios, security requirements, etc.) and are aiming at establishing a context that will serve as basis for industrial developments. Having said that, some interesting information on vulnerabilities and risk has been found in the 20,24,25 collected documents . Given the general situation in smart grids the following vulnerabilities and risks were assessed:  Smart grid vulnerabilities: Currently, vulnerabilities assumed within smart grid environments related to some areas that are not differentiated from other IT systems. In particular we have seen vulnerabilities related to the areas : of customer security, physical security (in particular of publicly accessible devices), implicit trust between used components, teams with different skills and competences, involvement of multiple stakeholders (supply chain issues). Further, through to the utilization of wireless communication, relevant components might be vulnerable to threats targeting such components. Besides typical vulnerabilities in the area of 34 20 wireless communication , some relevant material can be found in . In the same document a number of generic non-smart grid related vulnerabilities can also be found. Concluding, one should mention that in the public domain there is a lack of information of vulnerabilities related to smart grid specific infrastructures, scenarios and components. There are some European projects that would cover this gap . Also the analysis has identified a Spanish Centre that is currently working in two European projects related with vulnerabilities in smart grids: n-SHIELD (www.newshield.eu/) and RISC (DG-HOME CIPS call).  Smart grid risks: Regarding smart grid risks, only one document has been found that provides a comprehensive assessment of risks . The risks assessed are related to the unavailability of some key smart grid components such as DCS and RTU; and AMI related components such as data concentrators, smart meters and central system to control and manage smart meters. The risks related to key smart grid components are mainly impact the stability and availability of the smart grid through manipulations in hard- and software (see nefarious activity, eavesdropping, and physical attack threat groups in Figure 3). Risks assessed for AMI are related to manipulation of components by users in order to perform fraud (i.e. primarily manipulating billing information and secondary affect operations of multiple meters). (see nefarious activity, eavesdropping, and physical attack threat groups in Figure 3).

text: Although thoroughly done, this assessment covers only a part of the smart grid infrastructure and takes into account a reduced number of vulnerabilities. As already stated, more assessments will be necessary, ideally based on real infrastructures (even at the level of a laboratory) in order to achieve a better maturity in the implementation of smart grid cyber security measures. Concluding, one should note that due to the fact that a smart grid is a system of systems, it is important to understand the dependencies among involved components. Certainly, work that has been done in the area of SCADA is highly relevant to smart grid environments. Moreover, with increasing proliferation of mobile devices in industrial systems work on mobile security is another important part of such a complex system. Hence, vulnerability and risk assessment will depend on the particular mix of components, processes and human infrastructure involved in a particular scenario.

text: 9 Good Practice of Smart Grid Security Measures

text: In order to elaborate on good practices we took stock of publicly available smart grid security approaches. In doing so, existing literature has been analysed and security measures/controls proposed by these approaches have been identified. The security measures have been categorised in:  Security measures related to IT Systems and Logical Networks used within smart grid infrastructures: Such measures are related to assets such as Wide Area Networks, Gateways, Home Area Network (HAN) and Zigbee (IEEE 802.15.4) protocol, Advanced Metering Infrastructure (AMI), Master Terminal Unit (MTU) and Remote Terminal Unit (RTU)  Security measures related to Supply Chain of smart grid: Such measures are related to Providers, Distribution and Logistics and Customers. In the following sections, the identified security measures are presented with indication of their origin. In summary it is noticeable that three existing good practices provide a comprehensive set of 19,20,36, security measures . The majority of other documents analysed cover only a relatively small part 21,37,38,39,40,41,42 of security measures . This is quite natural thought, as this material is dedicated to some specific portions of smart grid infrastructure. ENISA has also performed some work on security measures for smart grid. A report has been published on the minimum security measures for smart grids in 2012 . Based on this report, ENISA, in collaboration with the Commission, has initiated a number of consultations with both private and public sector stakeholders, under the umbrella of EG2 , aiming at delivering a report with a set of smart grid appropriate cyber security measures which might end up to a Commission Recommendation on minimum cyber security requirements for smart grids in 2014. Both the ENISA report on minimum security measures and the contribution to EG2 are not covered within this good practice guide. The coverage of security measures proposed by ENISA with regard to threats mentioned in the present document can be found in the ENISA contribution to EG2 and are not repeated in this report. The identified security measures are then mapped to the threats, completing thus the picture between threat exposure and proposed security measure. This information can be found in Annex C.

text: 9.1 IT Systems and Logical Networks

text: This group of security measures relates to information and communication systems, nodes and links, transmission systems, control and management. Best practices related to security measures for protection of IT systems and logical networks are:

text: 1. Align cyber-security to the organization’s overall IT strategy based on the defined risk 19,20 profile . 19,20

text: 2. Establish a rigorous, on-going risk management process .

text: 3. Establish effective configuration management process .

text: 4. Utilities to formally publish internal security program (policies, guidelines, procedures) and 19,20 ensure compliance . 19,20

text: 5. Develop cyber-security around IEC 62351 .

text: 6. Adopt the security measures regarding the defined SGIS Security Levels (SGIS-SL) .

text: 7. Adopt the defined smart grid Data Protection classes (SG-DPC) .

text: 8. Document network architecture and identify systems that serve critical functions or contain 19,20 sensitive information that require additional levels of protection .

text: 9. Conduct routine self-assessments . 19,20

text: 10. Ensure Interoperability and Testing/Certification .

text: 11. Implement a Security View per Layer, that is, establish a network protection strategy based on 19,20 the principle of defence-in-depth . 20,37

text: 12. Establish 24-hour-a-day incident monitoring and logging and audit systems .

text: 13. Implement attack mitigation mechanisms and network security proactive measures: prevention, 19,20,21 detection and analysis of vulnerabilities, correlation of events, etc .

text: 14. Implement internal and external Intrusion Detection Systems (IDS) and Attack detection 20,21,37 tools .

text: 15. Establish incident response mechanisms: a breach is inevitable since no system can be 100% secure. Incident response procedures must be developed so that it is used in the event of an 19,20 incident. Incident response includes disaster-recovery and business-continuity plans .

text: 16. Maintain safe start, stop and fail modes for smart grid components: systems shall be capable of operating in an operational or non-operational state according to some policies. These may include activities allowed during initialization state, management functions necessary for element configuration, policy establishment and security domain establishment. The system shall transition into the operational state only upon completion of the critical initialization activities. The system shall transition into the non-operational state upon detection of a critical failure and transition into the operational state when the critical failure has been solved. At this point, the system shall be able to operating in a degraded mode while in an operational state. Also, supporting activities pertaining to the health of the system (e.g., diagnostics, maintenance, 19,20 training, etc.) shall only be allowed during the operational state . 19,20

text: 17. Establish system backups and disaster recovery plans .

text: 18. Apply regular updates: applying software patches on a regular basis to the SCADA operation 19,20 system, applications and components in the smart grid . 37,20

text: 19. Removing or disabling unnecessary services . 26 Smart Grid Threat Landscape and Good Practice Guide

text: 20. Perform technical audits of SCADA devices and networks, and any other connected networks, to identify security concerns: analyse identified vulnerabilities to determine their significance, and take corrective actions as appropriate. Track corrective actions and analyse this information to identify trends. Additionally, retest systems after corrective actions have been taken to ensure that vulnerabilities were actually eliminated. Scan non-production environments actively to identify and address potential problems .

text: 21. Conduct physical security surveys and assess all remote sites connected to the SCADA network to evaluate their security .

text: 22. Identify and develop a comprehensive understanding of all connections to SCADA networks and evaluate and strengthen the security of these connections in order to protect them: internal local area and wide area networks, including business networks, Internet, wireless network devices, including satellite uplinks, modem or dial-up connections, connections to business 37,19 partners, vendors or regulatory agencies, etc . Some security measures can be adopted to protect these connections, such as, conduct penetration testing or vulnerability analysis, use of firewalls, Intrusion Detection Systems (IDSs), and other appropriate security measures at each 37,20 point of entry .

text: 23. Disconnect unnecessary connections to the SCADA network or isolate the SCADA network from other network connections: isolate the SCADA network from other networks as possible using 19,37 “Demilitarized Zones” (DMZs) and data warehousing .

text: 24. Establish strong controls over any medium that is used as a backdoor into the SCADA 19,37 network .

text: 25. Do not rely on proprietary protocols to protect your system: additionally, demand that vendors disclose any backdoors or vendor interfaces to your SCADA systems, and expect them to provide systems that are capable of being secured .

text: 26. Implant Identification, Authentication and Access Control to all network devices, systems and 19,20,21 users . 19,20

text: 27. Support of biometric authentication for user access to critical components .

text: 28. Establish a Role-based Access Control (RBAC): roles or responsibilities that a subject or a user has within the organization and on rules which determine what access rights are permitted for the subject in a given role. Clearly define cyber security roles, responsibilities, and authorities 19,20 for managers, system administrators, and users .

text: 29. Establish an Access Control List (ACL) and a Discretionary Access Control (DAC): list of permissions associated with an object that is used to specify which subjects, users, process, components or systems are allowed to access that particular object as well as which operations 19,20 the subject can perform on that particular object .

text: 30. Establish the necessary Capability Lists (CL): list of objects associated with the permission to it .

text: 31. Establish a Mandatory Access Control (MAC): access policy used in multiple-level systems that 19,20 require highly sensitive data .

text: 32. Data Classification and Retention: data classification refers to classifying data according their security (confidentiality, integrity, or availability) level. Retention refers to how long data is kept before destroyed . 19,20

text: 33. Define a strong Password Requirements and Guidelines and follow them .

text: 34. Follow a correct policy of Control Key Management: all cryptographic keys, load control commands and network management commands must be encrypted before being shared on 19,20 the network and only the intended recipients must possess the decryption keys . 27 Smart Grid Threat Landscape and Good Practice Guide

text: 35. Protect sensitive information using cryptographic functions to avoid external or not authorized 19,20,21 access to it . Sensitive information should be assessed by means of proper risk assessment.

text: 36. Encrypt consumer usage data: only entities that are authorized to view the data possess the 19,20 decryption keys .

text: 37. Keep personally identifiable information in a minimum number of systems from which it may be 19,20 securely accessed .

text: 38. Encrypt the application level load control commands with the trust centre link key: Replay protection will be provided for this command by using a monotonically increasing sequence number .

text: 39. Use Smart Energy Profile 2 (SEP 2) protocol: end-to-end Network Authentication and Authorization. Application Authentication (ACL). Authorization context (HTTPS, TLS). Digital 20,38 Signatures ECDSA-SHA256 and X.509v3 Certificates. Cryptography: ECDHE, ECDSA, AES128 .

text: 40. The network key will be exchanged only with devices that successfully complete the join procedure: the join procedure requires the joining devices to establish a shared secret with the trust centre and use that to initiate communications. The shared key must be derived from the device installation code and shared with the trust centre using a secure out-of-band mechanism. Once the device joins the network successfully, the trust centre sends it the network key encrypted with the shared secret .

text: 41. Avoid any unnecessary trade-offs between privacy and legitimate objectives of smart grid projects .

text: 42. Visible and transparent to consumers — engaging in accountable business practices — to 19,20 ensure that new smart grid systems operate according to stated objectives .

text: 43. Make privacy a core functionality in the design and architecture of smart grid systems and 19,20 practices .

text: 44. Build in privacy end-to-end, throughout the entire life cycle of any personal information 19,20 collected .

text: 45. The trust centre must ensure availability: the centre must implement mechanisms for high availability including protection from denial of service attacks, resource starvation, or network 19,20 congestion . Some best practices are related to specific asset type, such as Wireless Neighbourhood Area Network (WNAN), Demand Response (DR) systems, Gateway, Home Area Network (HAN), Advanced Metering Infrastructure (AMI), or Master Terminal Unit (MTU). 9.1.1 WAN This group of security measures covers all wireless communication that is necessary within smart grids. It covers WNAN (Wireless Neighbourhood Area Network, Wireless Local Area Network (WLAN) and Wireless Wide Area Network (WWAN). 1. IEEE 802.11: Use Media Access Control (MAC) address filtering; Wi-Fi Protected Access (WPA); IEEE 802.11w-2009 (an approved amendment to IEEE 802.11 to increase security of the management frames. The objective of this protocol is to increase the security by providing data confidentiality of management frames, mechanisms that enable data integrity, data origin 19,20 authenticity, and replay protection) . 2. IEEE 802.15.4: Use MAC address filtering; Flash memories; AES encryption; Source Node 19,20 Authentication . 28 Smart Grid Threat Landscape and Good Practice Guide

text: 3. IEEE 802.16: Use Message Authentication Code (MAC) techniques; Protection against masquerading parties, AES-CCM5 . 9.1.2 Gateway 19,20 1. Low Power Encryption techniques (power consumption . 19,20 2. Central Authority for Public Key Infrastructure . 19,20 3. Trusted Platform Module . 19,20 4. MAC address filtering . 5. Virtual Home Command Exec. Execute all the commands received from the outside world on itself (Virtual Home Command Exec.) before deploying it on the real environment . 9.1.3 Home Area Network (HAN) and Zigbee (IEEE 802.15.4) protocol 1. Use Flash memory . 2. Avoiding Counter Mode (not secure Mode) in AES encryption . 19,20 3. Use MAC Address Filtering and Access Control List (ACL . 19,20 4. Source node authentication . 5. Restrict node connectivity using a pre-assigned PAN Identifier . 6. Secure Network Admission Control . 7. Out-of-band key loading method . 8. Trust Center address to be preconfigured in all nodes . 9. Establish an interference control (adequate band of frequency, increase, transmit power, mesh 19,20 topology, frequency hopping . 10. Secure the Demand Response (DR) system. Proper data handling practices must be carried out 19,20 in order to protect the security and privacy of customer information . 9.1.4 Advanced Metering Infrastructure (AMI) 19,20 1. Adopt an open reference standard for security of advanced meters . 2. Enforce full implementation of the security standard by advanced meter vendors . 3. Implement strong separation between the AMI network and the electronic security perimeters 19,20 of other systems . 4. Implement network separation, strong firewalls, and limited router access control lists in the 19,20 AMI network . 5. Traffic Control. Session control and mechanisms of detection and halting of rapid market fluctuations . 19,20 6. Ensure the existence of audit log maintenance . 7. Cryptographically authenticate metering assets to the network to ensure that only known and 19,20 approved devices participate in the network . 8. Authenticate and integrity check system commands, at the meter, to ensure they are 19,20 authorized and haven’t been tampered . 9. Guard against replay attacks to prevent denial of service attacks or load shedding and ensure 19,20 availability of system resources . 29 Smart Grid Threat Landscape and Good Practice Guide

text: 9.2 Supply Chain

text: 9.2.1 Providers 20,36,39 1. Recommend/enforce implementation of security standards .

text: 46. Keep the confidentiality (and access control) of customer equipment, the integrity of control 36,41 messaging and message information and the availability of customer devices .

text: 47. Keep the confidentiality (privacy) and integrity of customer data and payments. Integrity of control messaging and message information containing prepayment data, and also the 36,41 availability of customer payment data and usage balances .

text: 48. Ensure that any personally identifiable information retained is securely destroyed at the end of its lifecycle . 36,42

text: 49. Implement and use a Disaster Recovery System .

text: 50. Establish alternative providers on major lanes .

text: 51. Separate break areas from storage and staging areas .

text: 52. Require contractually electronic seals for monitoring access to containers .

text: 53. Maintain proper storage of empty and full containers in a protected environment to prevent unauthorized access, including use of seals .

text: 54. Segregate and mark international, domestic, high-value, and dangerous goods cargo within the warehouse by a safe, vault, caged, or otherwise fenced-in area .

text: 55. Prohibits private passenger vehicles from parking in cargo areas or immediately adjacent to cargo storage buildings . 9.2.3 Customers 1. Provide information regarding security concerns . 2. Include appropriate language in contractual agreements to safeguard consumers . 36,41,20 3. Keep the confidentiality (privacy) and integrity of customer data and payments . 4. Keep the confidentiality (access control) of customer equipment, the integrity of control 20,41 messaging and message information and the availability of customer devices . 33 Smart Grid Threat Landscape and Good Practice Guide 34 Smart Grid Threat Landscape and Good Practice Guide

text: 10 Conclusions

text: Based on the experience gained within this activity, a number of issues have been identified that are worth further elaboration and/or action from relevant stakeholders. In particular:  Develop attack scenarios for smart grid components. The next step towards facilitating risk assessments for smart grid infrastructures would be to develop some kind of threat intelligence in the form of attack scenarios.  Elaborate on criticality assessment. Stakeholders have expressed the necessity to develop criteria that allow assessing criticality of smart grid components. This would facilitate impact identification and necessary protection levels.  Develop assessments for various scenarios. It seems to be very advantageous to come up with some smart grid scenarios. Risk assessments would contribute to the specification of appropriate security measures for these scenarios.  Elaborate on levels of impact for smart grid incidents. Discussions with stakeholders have shown the need to define impact thresholds for incidents in the area of smart grids. Such thresholds would be important parameters for the definition of security levels, identification and management of critical situations, etc.  As in all CIIP areas, words matter: develop and maintain smart grid security terms and definitions.  Establish better coordination of European/International activities in the area of smart grids, including standardisation. Currently, various activities are on-going in this area, involving multiple organisations and stakeholders. It is important to identify common areas and coordinate the agendas. This will enable coherence and exploitation of synergies.  Elaborate on the overlapping issues of safety vs. security: smart grid is a traditional engineering sector in which safety standards are implemented. Cyber security overlaps with safety as it concerns the operation of parts of the grid. These overlaps need to be identified and interfaces need to be established.  Establish a platform for information exchange on smart grid security. Following the coordination of activities, it is important to establish the platform for information flow. This will enable coherence and exploitation of synergies.  Initiate a debate on need/importance maturity/compliance/certification approaches for (areas of) smart grid security. As in any industrial area, and in particular in CIIP, it is important to discuss the importance in setting criteria for measuring security maturity in smart grids.  Track developments in smart grid security and update relevant material. Both smart grid and cyber security are in a dynamic phase of change/development. This will make updates important in order to maintain their usability.  Link smart grid activities with other related emerging areas such as smart cities, smart (home) environments, eMobility, Future Internet, and liaise with related stakeholders. As the scope of all these areas is quite wide and overlapping, it will be important to identify interfaces and coordinate common topics.  Create circles of trust to share information about smart grid security. Smart grid security is falls into CIIP and as such parts of the work need to be kept in confidentiality. For this purpose, circles of trust among relevant stakeholders need to be developed and modalities need to be developed for managing this information.

text: Annex A: Description of Smart Grid assets

text: Information

text: Information is a valuable asset as, depending on it, machines and staff will make decisions. It can travel by different supports or represent different meanings. Information assets identified are:  Inventory of electrical assets: physical components that storage the information while it is travelling or it is being converted: cables, relays, transformers, power switches, earth switches, controllable/regulating inverter, distribution automation, sensors, equipment health sensor, fault current limiter, FACTS devices.  Operational information about electrical assets: status indicators, alerts, events and shortage - disturbance information.  Historical information: information related to the past that must be storage by law or due to its value / nature.  Trending information: information related to the past that can be used to predict future behaviour, and so, to be prepared for it.  Trading information: information related with commercial issues.  System Configuration: information related with the network itself: network topology, IP addresses Allocation, inventory of MAC addresses, user credentials, user permissions, configuration files, geolocation. Different information may be susceptible to the security principles: confidentiality, integrity, availability.

text: Software

text: The Software of an infrastructure will let us manage the information (access it, modify it and store new information). No availability of the required software will mean any access to information. Main software in a smart grid is:  Applications: we will find different types of applications with different connectivity: connected with the Internet but only accessed by the staff of the company; application oriented to end users, to access its own information; real time applications (utility IT information system capable of integrating, organizing, displaying and analysing real-time or near real-time electric distribution data to offer a wide range of operational benefits; SCADA systems: the application that will control industrial processes, in general no connected with Internet.  Standard Software: software needed to make the applications work. o Database. o Web server.  Operating System.  Device Driver: software installed in the different used drivers as USBs, CDs, DVDs, printers, scanners.  Firmware. When we analyse this asset, we will need to think about: the origin of the software (is this origin trustworthy? Do we know the source code?); access to it (who is able to access it and with what kind of permissions? What procedures of access does it have?); real location of the software (where is the server that holds is located?). 36

text: Services

text: The services are activities between a client and a provider. They are considered as valuable assets because its correct functioning is needed to the correct functioning of the smart grid. Services oriented to the staff of the smart grid:  Mail Service.  Terminal Service.  Print Service.  Authentication Service. Services oriented to the network itself and to make possible the necessary communications:  File Service.  Network Service.  Name Service.  Address Service. Cloud services:  Software as a service.  Infrastructure as a service.

text: Hardware

text: The hardware components considered as main assets of a smart grids are:  Smart grid: o Remote Terminal Unit (RTU): microprocessor-controlled electronic device that interfaces objects in the physical world to a distributed control system or SCADA (supervisory control and data acquisition) system by transmitting telemetry data to a master system, and by using messages from the master supervisory system to control connected objects. o Intelligent Electronic Device (IED): term used in the electric power industry to describe microprocessor-based controllers of power system equipment, such as circuit breakers, transformers, and capacitor banks. o Programmable Logic Controller (PLC): digital computer used for automation of electromechanical processes, such as control of machinery on factory assembly lines, amusement rides, or light fixtures. o Distributed Control System (DCS): is a system used in manufacturing to control set of devices in a distributed environment.  Micro grid: electrical systems that include multiple loads and distributed energy resources that can be operated in parallel with the grid or as an electrical island; Micro grid Controller: devices that control and enable the establishment of micro grids.  Smart Meter: electrical meter that records consumption of electric energy in intervals of an hour or less and communicates that information at least daily back to the utility for monitoring and billing purposes. The components of smart meters to take into account are: o Metering End Device, which let us read date at the end points: Electricity; Gas; Water; Heat. 37

text: Infrastructure

text: Infrastructures are also main assets to protect. There are several types of infrastructures:  Facilities: o Premises o Building o Server Room o Office o Auxiliary Room o Collector o Data centre  Power: o Transformer o Emergency Generator o UPS  Air Conditioning  Cabling

text: Personnel

text: Personnel are now considered a main asset in all the organizations, due to its knowledge and experience. The existing profiles of personnel in a smart grid are:  User  Operator  Administrator  Developer Every profile has different access to the rest of the assets.

text: eMobility

text: EMobility represents the concept of using electric powertrain technologies, in-vehicle information, and communication technologies and connected infrastructures to enable the electric propulsion of 39

text: Annex B: Threats assumed for Smart Grid assets

text: Annex C: Good Practices: protection against the Threats

text: In this annex, various security measures used within the analysed good practices are referenced in the table through the number of the section their section and thir sequence number within each section.

text: Annex D: Collected Information: Inventory of Smart Grid Documents

text: Page 1

text: Page 2

text: Page 3

text: Page 4

text: Page 5

text: Page 6

text: ENISA

text: European Union Agency for Network and Information Security Science and Technology Park of Crete (ITE) Vassilika Vouton, 700 13, Heraklion, Greece

text: Athens Office

text: 1 Vass. Sofias & Meg. Alexandrou Marousi 151 24, Athens, Greece

text: PO Box 1309, 710 01 Heraklion, Greece Tel: +30 28 14 40 9710 info@enisa.europa.eu Page 7 www.enisa.europa.eu