Оглавление
Mariana Hentea. Building an Effective Security Program for Distributed Energy Resources and Systems
Table of Contents
List of Tables
List of Illustrations
Guide
Pages
Building an Effective Security Program for Distributed Energy Resources and Systems. Understanding Security for Smart Grid and Distributed Energy Resources and Systems
Foreword
Preface Volume 1
Acknowledgments
1 Security. 1.1 Introduction
1.2 Smart Grid
1.2.1 Traditional Power Grid Architecture
1.2.1.1 Key Players
1.2.1.2 Electric Grid Design of the Future
1.2.2 Smart Grid Definitions
1.2.3 Drivers for Change
1.2.4 Smart Grid Communication Infrastructure
1.2.4.1 HAN
1.2.4.2 NAN
1.2.4.3 WAN
1.2.5 Secure Energy Infrastructure
1.3 Distributed Energy Resources
1.3.1 DER Characteristics
1.3.2 DER Uses
1.3.3 DER Systems
1.3.4 Microgrid
1.3.5 Virtual Power Plant
1.4 Scope of Security and Privacy
1.4.1 Security for the Smart Grid
1.4.1.1 Security as Reliability
1.4.1.2 Security as Communication Reliability
1.4.1.3 Security as Information Protection
1.4.2 Privacy
1.4.2.1 Privacy in the Smart Grid
1.4.3 The Need for Security and Privacy
1.5 Computing and Information Systems for Business and Industrial Applications
1.5.1 Information System Classification
1.5.2 Information Systems in Power Grids
1.5.3 DER Information Systems
1.6 Integrated Systems in a Smart Grid
1.6.1 Trends
1.6.2 Characteristics
1.7 Critical Smart Grid Systems
1.7.1 Industrial Control Systems
1.7.2 SCADA Systems
1.7.3 Energy Management Systems
1.7.4 Advanced Meter Systems
1.8 Standards, Guidelines, and Recommendations
1.8.1 Overview of Various Standards
1.8.2 Key Standard Attributes and Conformance
1.8.3 Smart Grid Standards
1.8.3.1 Key Players in Smart Grid Standards Development
1.8.3.1.1 GridWise Architecture Council
1.8.3.1.2 NIST Smart Grid Interoperability Panel
1.8.3.2 How to Use Standards
1.8.4 Cybersecurity Standards
2 Advancing Security. 2.1 Emerging Technologies
2.1.1 Internet of Things
2.1.1.1 Characteristics of Objects
2.1.1.2 Technologies
2.1.1.3 IoT Applications
2.1.1.3.1 Energy Management
2.1.1.3.2 Distribution Automation
2.1.1.3.3 Building and Home Automation
2.1.1.3.4 Infrastructure Management
2.1.1.4 IoT Security and Privacy
2.1.1.5 Challenges
2.1.2 Internet of Everything (IoE)
2.1.3 Cyber–Physical Systems
2.1.4 Cyber–Physical Systems Applications
2.2 Cybersecurity
2.2.1 Cybersecurity Definitions
2.2.2 Understanding Cybersecurity Terms
2.2.3 Cybersecurity Evolution
2.3 Advancing Cybersecurity
2.3.1 Contributing Factors to Cybersecurity Success
2.3.2 Advancing Cybersecurity and Privacy Design
2.3.2.1 Understanding Interdependencies
2.3.2.2 Open Systems
2.4 Smart Grid Cybersecurity: A Perspective on Comprehensive Characterization
2.4.1 Forces Shaping Cybersecurity
2.4.2 Smart Grid Trends
2.5 Security as a Personal, Organizational, National, and Global Priority
2.5.1 Security as Personal Priority
2.5.2 Protection of Private Information
2.5.3 Protecting Cyberspace as a National Asset
2.6 Cybersecurity for Electrical Sector as a National Priority
2.6.1 Need for Cybersecurity Solutions
2.6.2 The US Plans
2.7 The Need for Security and Privacy Programs
2.7.1 Security Program
2.7.2 Privacy Program
2.8 Standards, Guidelines, and Recommendations
2.8.1 Electricity Sector Guidance
2.8.2 International Collaboration
References Part 1
3 Principles of Cybersecurity. 3.1 Introduction
3.2 Information Security
3.2.1 Terminology
3.2.2 Information Security Components
3.2.3 Security Principles
3.3 Security‐Related Concepts
3.3.1 Basic Security Concepts
3.3.2 The Basis for Security
3.4 Characteristics of Information
3.4.1 Data Transformation
3.4.2 Data Characteristics
3.4.3 Data Quality
3.4.4 Information Quality
3.4.5 System Quality
3.4.6 Data Quality Characteristics Assigned to Systems
3.5 Information System Characteristics
3.5.1 Software Quality
3.5.2 System Quality Attributes
3.6 Critical Information Systems
3.6.1 Critical System Characteristics
3.6.2 Information Life Cycle
3.6.3 Information Assurance
3.6.4 Critical Security Characteristics of Information
3.7 Information Security Models
3.7.1 Evolving Models
3.7.2 RMIAS Model
3.7.3 Information Security Goals
3.8 Standards, Guidelines, and Recommendations
3.8.1 SGIP Catalog of Standards
3.8.2 Cybersecurity Standards for Smart Grid
4 Applying Security Principles to Smart Grid. 4.1 Smart Grid Security Goals
4.2 DERInformation Security Characteristics
4.2.1 Information Classification
4.2.2 Information Classification Levels
4.2.3 Information Evaluation Criteria
4.3 Infrastructure
4.3.1 Information Infrastructure
4.3.2 Information Assurance Infrastructure
4.3.3 Information Management Infrastructure
4.3.4 Outsourced Services
4.3.5 Information Security Management Infrastructure
4.3.6 Cloud Infrastructure
4.4 Smart Grid Infrastructure
4.4.1 Hierarchical Structures
4.4.2 Smart Grid Needs
4.4.3 Cyber Infrastructure
4.4.4 Smart Grid Technologies
4.5 Building an Information Infrastructure for Smart Grid
4.5.1 Various Perspectives
4.5.2 Challenges and Relevant Approaches
4.5.3 Common Employed Infrastructures
4.5.3.1 Advanced Metering Infrastructure
4.5.3.2 Wide Area Measurement System
4.6 IT Systems Versus Industrial Control System Infrastructure
4.6.1 Industrial Control Systems General Concepts
4.6.1.1 Control Components
4.6.1.2 Control Network Components
4.6.2 Supervisory Control and Data Acquisition Systems (SCADA)
4.6.3 Differences and Similarities
4.7 Convergence Trends
4.8 Standards, Guidelines, and Recommendations
5 Planning Security Protection. 5.1 Threats and Vulnerabilities
5.1.1 Threats Characterization
5.1.2 Vulnerabilities Characteristics
5.2 Attacks
5.2.1 Attack Categories
5.2.2 Reasons for Attack
5.3 Energy Sector: Threats, Vulnerabilities, and Attacks Overview
5.3.1 Threats
5.3.2 Vulnerabilities
5.3.3 Energy Sector Attacks
5.3.4Smart Grid Cybersecurity Challenges
5.4 Security Controls
5.4.1 Security Controls Categories
5.4.2 Common Security Controls
5.4.3 Applying Security Controls to Smart Grid
5.5 Security Training and Skills
5.5.1 Education, Training, and Awareness
5.5.2 Security Awareness Program
5.6 Planning for Security and Privacy
5.6.1 Plan Structure
5.6.2Security Team
5.7 Legal and Ethical Issues
5.8 Standards, Guidelines, and Recommendations
References Part 2
6 Critical Infrastructure. 6.1 Introduction
6.1.1 Critical Infrastructure
6.1.2 Critical Information Infrastructure
6.2 Associated Industries with Critical Infrastructure
6.2.1 US Critical Sectors
6.2.2 Other Countries
6.3 Critical Infrastructure Components
6.4 Energy Sector
6.4.1 Electrical Subsector
6.4.2 Smart Grid Infrastructure
6.5 Critical Infrastructure Interdependencies
6.5.1 Interdependency Dimensions
6.5.2 Dependencies
6.6 Electrical Power System
6.6.1 Electrical Power System Components
6.6.2 Electrical Power System Evolution and Challenges
6.6.3 Needs
6.7 Recent Threats and Vulnerabilities
6.7.1 Reported Cyber Attacks
6.7.2 ICS/SCADA Incidents and Challenges
6.7.2.1 Stuxnet Exploitation
6.7.2.2 Exposure to Post‐Stuxnet Malware in Rise
6.7.2.3 Inappropriate Design and Lack of Management
6.7.2.4 Safety
6.7.3 Equipment Failure
6.8 Standards, Guidelines, and Recommendations
7 Critical Infrastructure Protection. 7.1 Critical Infrastructure Attacks and Challenges
7.1.1 Power Grid
7.1.2 Attacks on Information Technology and Telecommunications
7.1.3 Attacks in Manufacturing
7.1.4 Defense
7.2 The Internet as a Critical Infrastructure
7.3 Critical Infrastructure Protection
7.3.1 Policies, Laws, and Regulations
7.3.2 Protection Issues
7.4 Information Security Frameworks
7.4.1 NIST Cybersecurity Framework
7.4.2 NIST Updated Cybersecurity Framework
7.4.2.1 Examples of Enhancements
7.4.2.2 Communicating Cybersecurity Requirements with Stakeholders
7.4.2.3 Cyber Supply Chain Risk Management
7.4.3 Generic Framework
7.5 NIST Privacy Framework
7.6 Addressing Security of Control Systems
7.6.1 Challenges
7.6.2 Terrorism Challenges
7.7 Emerging Technologies and Impacts
7.7.1 Control Systems Open to Internet
7.7.2 Wireless and Mobile
7.7.3 Internet of Things and Internet of Everything
7.7.4 Web Technologies
7.7.5 Embedded Systems
7.7.6 Cloud Computing
7.8 Standards, Guidelines, and Recommendations
7.8.1 Department of Homeland Security (DHS)
7.8.2 Federal Communications Commission (FCC)
7.8.3 National Institute of Standards and Technology (NIST)
7.8.4 North American Electric Reliability Corporation (NERC)
7.8.5 Federal Energy Regulatory Commission
7.8.6 DOE Critical Infrastructure Guidance
7.8.7 US‐CERT
References Part 3
8 Smart Power Grid. 8.1 Electric Power Grid
8.1.1 Power System Services
8.1.2 Power System Operations
8.1.3 Energy Management System Overview
8.1.4 Electrical Utilities Evolution
8.2 Smart Grid: What Is It?
8.2.1 Definitions
8.2.2 Vision of the Future Smart Grid
8.2.3 Tomorrow's Utility
8.2.4 EMS Upgrades
8.2.5 Electricity Trade
8.2.6 Trading Capabilities
8.3 Smart Grid Characteristics
8.3.1 Relevant Characteristics
8.3.2 Electrical Infrastructure Evolution
8.4 Smart Grid Conceptual Models
8.4.1 NIST Conceptual Model
8.4.2 IEEE Model
8.4.3 European Conceptual Model
8.5 Power and Smart Devices
8.5.1 Smart Meters
8.5.2 Intelligent Electronic Devices
8.5.3 Phasor Measurement Units
8.5.4 Intelligent Universal Transformers
8.6 Examples of Key Technologies and Solutions
8.6.1 Communication Networks
8.6.2 Integrated Communications
8.6.3 Sensor Networks
8.6.4 Infrastructure for Transmission and Substations
8.6.5 Wireless Technologies
8.6.6 Advanced Metering Infrastructure
8.7 Networking Challenges
8.7.1 Architecture
8.7.2 Protocols
8.7.3 Constraints
8.8 Standards, Guidelines, and Recommendations
8.8.1 Smart Grid Interoperability
8.8.2 Representative Standards
9 Power System Characteristics. 9.1 Analysis of Power Systems
9.1.1 Analysis of Basic Characteristics
9.1.2 Stability
9.1.3 Partial Stability
9.2 Analysis of Impacts
9.2.1 DER Impacts
9.2.2 Interconnectivity
9.3 Reliability
9.3.1 Reliable System Characteristics
9.3.2 Addressing Reliability
9.3.3 Evaluating Reliability
9.3.4 ICT Reliability Issues
9.3.5 DER Impacts
9.4 Resiliency
9.4.1 Increasing Resiliency
9.4.2 DER Opportunities
9.5 Addressing Various Issues
9.5.1 Addressing Cybersecurity
9.5.2 Cyber–Physical System
9.5.3 Cyber–Physical Resilience
9.5.4 Related Characteristics, Relationships, Differences, and Similarities
9.6 Power System Interoperability
9.6.1 Interoperability Dimensions
9.6.2 Smart Grid Interoperability
9.6.3 Interoperability Framework
9.6.4 Addressing Crosscutting Issues
9.7 Smart Grid Interoperability Challenges
9.8 Standards, Guidelines, and Recommendations
9.8.1 ISO/IEC Standards
9.8.2 IEEE Standards
10 Distributed Energy Systems. 10.1 Introduction
10.1.1 Distributed Energy
10.1.2 Distributed Energy Systems
10.2 Integrating Distributed Energy Resources
10.2.1 Energy Storage Technologies
10.2.2 Electric Vehicles
10.2.3 Distributed Energy Resource Systems
10.2.4 Electrical Energy Storage Systems
10.2.4.1 Renewable Energy Generation
10.2.4.2 Energy Storage Systems
10.2.5 Virtual Power Plant
10.3 DER Applications and Security
10.3.1 Energy Storage Applications
10.3.2 Microgrid
10.4 Smart Grid Security Goals
10.4.1 Cybersecurity
10.4.2 Reliability and Security
10.4.3 DER Security Challenges
10.5 Security Governance in Energy Industry
10.5.1 Security Governance Overview
10.5.2 Information Governance
10.5.3 EAC Recommendations
10.5.4 Establishing Information Security Governance
10.5.5 Governance for Building Security In
10.6 What Kind of Threats and Vulnerabilities?
10.6.1 Threats
10.6.2 Reported Cyber Incidents
10.6.3 Vulnerabilities
10.6.4 ICS Reported Vulnerabilities
10.6.5 Addressing Privacy Issues
10.7 Examples of Smart Grid Applications
10.7.1 Smart Grid Expectations
10.7.2 Demand Response Management Systems (DRMS)
10.7.3 Distribution Automation
10.7.4 Advanced Distribution Management System
10.7.5 Smart Home
10.7.6 Smart Microgrid
10.8 Standards, Guidelines, and Recommendations
10.8.1 NIST Roadmap, Standards, and Guidelines
10.8.2 NERC CIP Standards
10.8.3 Security Standards Governance
References Part 4
11 Security Management. 11.1 Security Managements Overview
11.1.1 Information Security
11.1.2 Security Management Components
11.1.3 Management Tasks
11.2 Security Program
11.2.1 Security Program Functions
11.2.2 Building a Security Program: Which Approach?
11.2.3 Security Management Process
11.3 Asset Management
11.3.1 Asset Management for Power System
11.3.2 Asset Management Perspectives
11.3.3 Benefits of Asset Management
11.3.3.1 DER Assets Classification
11.3.3.2 DER Asset Data
11.3.3.3 Asset Management Analytics
11.3.3.4 Applications
11.3.3.5 Asset Management Metrics
11.3.3.6 Asset Management Services
11.4 Physical Security and Safety
11.4.1 Physical Security Measures
11.4.2 Physical Security Evolution
11.4.3 Human Resources and Public Safety
11.5 Human and Technology Relationship
11.5.1 Use Impacts
11.5.2 DER Systems Challenges
11.5.3 Security vs. Safety
11.6 Information Security Management
11.6.1 Information Security Management Infrastructure
11.6.2 Enterprise Security Model
11.6.3 Cycle of the Continuous Information Security Process
11.6.4 Information Security Process for Smart Grid
11.6.4.1 Risk Assessment
11.6.4.2 Policy
11.6.4.3 Deployment
11.6.4.4 Training
11.6.4.5 Audit
11.6.5 Systems Engineering and Processes
11.7 Models and Frameworks for Information Security Management
11.7.1 ISMS Models
11.7.2 Information Security Management Maturity Model (ISM3) Model
11.7.3 BMIS Model
11.7.4 Systems Security Engineering Capability Maturity Model (SSE‐CMM)
11.7.5 Standard of Good Practice (SoGP)
11.7.6 Examples of Other Frameworks
11.7.6.1 COBIT 5
11.7.6.2 Open Information Security Management Maturity Framework (O‐ISM3)
11.7.6.3 Information Technology Infrastructure Library (ITIL)
11.7.6.4 Sherwood Applied Business Security Architecture
11.7.7 Combining Models, Frameworks, Standards, and Best Practices
11.8 Standards, Guidelines, and Recommendations
12 Security Management for Smart Grid Systems. 12.1 Strategic, Tactical, and Operational Security Management
12.1.1 Unified View of Smart Grid Systems
12.1.2 Organizational Security Model
12.2 Security as Business Issue
12.2.1 Strategic Management
12.2.2 Tactical Management
12.2.3 Operational Management
12.3 Systemic Security Management
12.3.1 Comparison and Discussion of Models
12.3.2 Efficient and Effective Management Solutions
12.3.3 Means for Improvement
12.4 Security Model for Electrical Sector
12.4.1 Electricity Subsector Cybersecurity Capability Maturity Model (ES‐C2M2)
12.4.2 Which Guidance and Recommendations Apply in Electrical Sector?
12.4.3 Implementing ISMS
12.4.4 NIST Framework
12.4.5 Blueprints
12.4.6 Control Systems
12.5 Achieving Security Governance
12.5.1 Security Strategy Principles
12.5.2 Governance Definitions and Developments
12.5.3 Information Security Governance
12.5.4 Implementation Challenges
12.5.5 Responsibilities and Roles
12.5.6 Governance Model
12.6 Ensuring Information Assurance
12.6.1 NIST SP800‐55
12.6.2 ISO/IEC 27004
12.7 Certification and Accreditation
12.7.1 Common Criteria
12.7.2 ISO/IEC 27001
12.7.3 ISMS Accreditation
12.8 Standards, Guidelines, and Recommendations
12.8.1 ISO/IEC Standards
12.8.2 ISA Standards
12.8.2.1 ISA/IEC 62443 Standards
12.8.2.2 ISA Security Compliance Institute (ISCI)
12.8.3 National Institute of Standards and Technology (NIST)
12.8.4 Internet Engineering Task Force (IETF)
12.8.5 ISF Standards
12.8.6 European Union Agency for Network and Information Security Guidelines
12.8.7 Information Assurance for Small Medium Enterprise (IASME)
12.8.7.1 IASME Governance Standard
References Part 5
A. Cybersecurity Concepts. Cybersecurity
References
B Power Grid Concepts. Power
B.1 Basic Terms. B.1.1 Ancillary Services
B.1.2 Bulk Electric System
B.1.3 Bulk Power System (BPS)
B.1.4 Centralized Historian
B.1.5 Circuit Breakers
B.1.6 Cooperative
B.1.7 Control System
B.1.8 Conservation of Energy
B.1.9 Critical Characteristic
B.1.10 Critical Safety Item
B.1.11 Distributed Information System
B.1.12 Engineering Station
B.1.13 Historian Database
B.1.14 Energy
B.1.15 Electrical Energy
B.1.16 Energy Forms
B.1.17 Electricity Generation
B.1.18 Electric Generator
B.1.19 Electric Circuit Components
B.1.20 Electric Grid
B.1.21 Electric Power
B.1.22 Electric Power Network
B.1.23 Electric Power Versus Electric Energy
B.1.24 Electric Power System
B.1.25 Electricity Supply System
B.1.26 Electric Utility
B.1.27 Human–Machine Interface
B.1.28 Industrial Control Network (ICS)
B.1.29 Industrial Control System
B.1.30 Instrumentation and Control (I&C) System
B.1.31 Intelligent Electronic Device (IED)
B.1.32 Key Characteristic
B.1.33 Local Historian
B.1.34 Management Information System
B.1.35 Measuring Electricity
B.1.36 Moving Electricity
B.1.37 Passive Sign Convention
B.1.38 Power Plant Efficiency
B.1.39 Power System
B.1.40 Power System Automation
B.1.41 Power Delivery System
B.1.42 Substation Automation
B.1.43 Reliability
B.1.44 Reliable Operation
B.2 US Electric Power Industry Overview
B.2.1 Traditional Electric Utilities
B.2.2 Meters
B.2.3 Consumer Sectors
B.2.4 Energy Sources
B.2.5 Electric Power Transactions and the Interconnected Networks. B.2.5.1 Power Transactions
B.2.5.2 The Interconnected Networks
B.2.5.3 Reliability Planning
B.2.5.4 The Changing Electric Power Industry
B.2.5.5 Time Hierarchy of Power Systems. B.3 Examples of Power Grid Glossaries
References
C Critical Infrastructures Concepts. Critical Infrastructures and Energy Infrastructure
C.1 Critical Infrastructures: Plans, Regulations, Frameworks, Programs
C.1.1 Critical Infrastructure Protection Framework
C.1.2 Critical Infrastructure Protection (CIP) Program
C.1.3 Critical Infrastructure Security and Resilience
C.1.4 Control Systems Security Program
C.1.5 National Infrastructure Protection Plan
C.1.5.1 Risk
C.1.5.2 Consequence
C.1.5.3 Vulnerability
h3. C.1.5.4Threat
C.1.5.5All Hazards
C.1.5.6Asset
C.2 Energy Sector
C.2.1 2015 Energy Sector Goals
C.2.2 Electricity Sector Priorities
C.2.3 Electricity Subsector Risks and Threats
C.2.4 Addressing Cybersecurity
C.2.5 International Interdependency and Coordination
C.3 NIST Cybersecurity Framework
C.4 Privacy
References
D Smart Grid Concepts. Smart Grid: Policy, Concepts, and Technologies
D.1 US Smart Grid Policy
D.2 Smart Grid Definitions and Vision
D.2.1 DOE Future Smart Grid Vision
D.3 Examples of Smart Grid Technologies. D.3.1 Active Distribution Network
D.3.2 Advanced Metering Infrastructure (AMI)
D.3.3 Aggregation and Aggregator
D.3.4 Automatic Meter Reading
D.3.5 Backhaul Communications
D.3.6 Balance
D.3.7 Balancing market
D.3.8 Building Area Networks (BANs)
D.3.9 Building Automation
D.3.10 Content of Information Exchange Between DER and Aggregator
D.3.11 Distributed Energy Resources (DER)
D.3.12 Distributed Generation (DG)
D.3.13 Distribution System Operator (DSO) and Transmission System Operator (TSO)
D.3.14 Flexible DER
D.3.15 Home Area Networks (HANs)
D.3.16 Information and Communication Infrastructure
D.3.17 LonWorks
D.3.18 Market
D.3.19 Metropolitan Area Network (MAN)
D.3.20 Mesh Network
D.3.21 Microgrid
D.3.22 Neighborhood Area Networks
D.3.23 Personal Area Network
D.3.24 Power Exchange
D.3.25 Renewable Energy (Re) Sources (RES)
D.3.26 Resilience/Resiliency
D.3.27 Smart Device
D.3.28 Smart Grid Communications
D.3.29 Smart Meter
D.3.30 Smart Metering
D.3.31 Virtual Power Plant
D.3.32 Wide Area Network
D.3.33 Smart Grid Glossaries
D.4 A Smart Grid Diagram: Past, Present, and Future
D.5 Smart Grid Conceptual Model
D.5.1 Bulk Generation
D.5.2 Distribution
D.5.3 Customer
D.5.4 Operations
D.5.5 Markets
D.5.6 Service Provider
References
J. Acronyms
Index. a
b
c
d
e
f
g
h
i
k
l
m
n
o
p
r
s
t
u
v
w
z
WILEY END USER LICENSE AGREEMENT
