Presentations Evaluating the Effectiveness of Security Mechanisms - PDF document

Trustworthy Cyber Infrastructure for the Power Grid Presentations Evaluating the Effectiveness of Security Mechanisms at Scale David Nicol University of Illinois • Dartmouth College • Cornell University • Washington State University Vision/Drivers for Security Evaluation A long history of research in evaluation of systems has led to significant capabilities – Reliability (e.g. in avionics, safety-critical systems, etc.) – Availability (e g computer systems offering services) Availability (e.g. computer systems offering services) – Capacity planning – Performance • How fast? • How much? – Paths to deleterious states – Likelihood of deleterious states Lik lih d f d l t i t t – Compliance Testing Vision : similar success in security evaluation University of Illinois • Dartmouth College • Cornell University • Washington State University 1 University of Illinois • Dartmouth College • Cornell University • Washington State University

Trustworthy Cyber Infrastructure for the Power Grid Presentations Vision/Drivers for Security Evaluation Evaluation methodologies offer promise for – Assessing effectiveness of security mechanisms • In context of identified threats – Assessing scalability of security mechanisms Assessing scalability of security mechanisms • Where are the bottlenecks? – Quantifying the security of a system • Domain-specific metrics – A basis for cost/benefit analysis – Assessing regulatory compliance – Assessing impact of security mechanisms (and other applications) on overall system behavior • e.g., real-time requirements Drivers : economic, regulatory, competitive University of Illinois • Dartmouth College • Cornell University • Washington State University Problems for Security Evaluation Metrics – What do we measure? Needs driven by emerging power technologies Needs driven by emerging power technologies – e.g., PMUs, smart switches, adaptive flow redistribution Threat characterization – Model known threats, account for unknown threats Issues of Scale (breadth and depth) – Security “flaws” often hinge on small technical details Model Verification / Validation University of Illinois • Dartmouth College • Cornell University • Washington State University 2 University of Illinois • Dartmouth College • Cornell University • Washington State University

Trustworthy Cyber Infrastructure for the Power Grid Presentations Approach to Evaluation Research Thrusts – Power grid drivers for security research • Distributed agent-based grid control • Adaptive Power Flow Redistribution • Adaptive Power Flow Redistribution – Security Evaluation of Vulnerabilities and Solutions • Line dependency analysis • Automated security tools – Test-bed Development • Wireless simulation / emulation models • Wire-line MAC layer modeling • Integration of hardware/software, Powerworld University of Illinois • Dartmouth College • Cornell University • Washington State University Intelligent Agents Problem : Emerging application would be distributed, automate control. Identify communication requirements, e.g. latency; identify security requirements, e.g. authentication y q , g Approach : Develop agent models on simulated network, develop control algorithms and induced communication Results : Simulation models on reference power architectures University of Illinois • Dartmouth College • Cornell University • Washington State University 3 University of Illinois • Dartmouth College • Cornell University • Washington State University

Trustworthy Cyber Infrastructure for the Power Grid Presentations Line contingencies Problem : Assess risk to grid of sets of lines going out Approach : Flow on each line depends on the flows on all other lines – What metrics reveal ordered dependencies? What metrics reveal ordered dependencies? – Explore ways of reducing computational cost through screening to find highest sensitivities Through contingency screening generate a structure that tracks lines impacts on each other Results : regions of grid most sensitive to tampering are identified University of Illinois • Dartmouth College • Cornell University • Washington State University Automated Assessment Problem : Manual vulnerability assessment is difficult. Approach : – Automate assessment through analysis of interacting Automate assessment through analysis of interacting models Results : Design time analysis of SIP requirements and compliance University of Illinois • Dartmouth College • Cornell University • Washington State University 4 University of Illinois • Dartmouth College • Cornell University • Washington State University

Trustworthy Cyber Infrastructure for the Power Grid Presentations Automated Assessment University of Illinois • Dartmouth College • Cornell University • Washington State University TCIP Testbed Problem : Assessment of large-scale power systems Approach : Develop testbed comprised of – Real RTUs, control station systems, historians, etc. Real RTUs control station systems historians etc – Simulator of power generation and distribution – Simulator/emulator of communications, devices, networks – Experimental designs to evaluate technologies – Models and methodologies to deal with problems of scale Results : Demonstration of integrated simulators and power equipment University of Illinois • Dartmouth College • Cornell University • Washington State University 5 University of Illinois • Dartmouth College • Cornell University • Washington State University

Trustworthy Cyber Infrastructure for the Power Grid Presentations TCIP Testbed University of Illinois • Dartmouth College • Cornell University • Washington State University Access Policy Tool Problem : – Firewall misconfigurations in process control systems – Expression/checking best practices in PCS – Verifying compliance of implementation with global policy Verifying compliance of implementation with global policy Approach : – Analyze all possible flows through network for compliance – Computation optimized – Statistical techniques for very large networks – Graphical interface Results : – Prototype tool in beta-testing with power industry partner University of Illinois • Dartmouth College • Cornell University • Washington State University 6 University of Illinois • Dartmouth College • Cornell University • Washington State University

Trustworthy Cyber Infrastructure for the Power Grid Presentations Access Policy Tool University of Illinois • Dartmouth College • Cornell University • Washington State University 7 University of Illinois • Dartmouth College • Cornell University • Washington State University