The integration of Information and Communication Technology (ICT) into Smart Grids has revolutionized the efficiency and functionality of power systems. However, this advancement has also introduced significant cybersecurity challenges. Among the most vulnerable components are digital substations, which serve as critical hubs in power distribution and are susceptible to cyberattacks that can trigger cascading failures and widespread disruptions. This paper presents a structured procedure for risk assessment, emphasizing system analysis, dependency evaluation, and asset profiling based on their vulnerability to potential adversarial techniques. Prioritizing risks facilitates targeted and effective post-attack mitigation strategies, ensuring faster recovery, reduced impact, and minimized downtime following an attack. Using the MITRE ICS ATT&CK Framework, we systematically identify adversarial techniques and assess the criticality of substation components. Different substation devices attract specific attack techniques depending on their role and exposure in the system; the MITRE ICS framework helps map these patterns to enable focused and effective defense. With a clear understanding of system structure and threats, we can develop mitigation solutions tailored to specific needs. RF-RADS generates a quantified risk profile by scoring substation assets, enabling systematic identification of critical components, with control servers, workstations, and data gateways identified as the highest-risk assets.

The Smart Grid is an IT-integrated power grid that generates, transmits, and distributes electricity to households and businesses. The substation is a crucial element of the Smart Grid’s operation, which adjusts voltages during the entire process. The integration of IT has increased in the substation’s attack surfaces. Sophisticated attacks such as the Pipeline APT contain multi-protocol modules for various devices. Performance constraints make substations a unique case; hence it is challenging to implement encryption and intrusion detection systems. We believe trust can tackle this problem. We present an improved trust model that detects protocol-based attacks toward an IED/SCADA HMI. This model is included within a multi-agent-based trust management system that computes the substation’s risk posture. Our proposed design was implemented in a Docker-based testbed environment with a SOC-influenced dashboard to provide real-time updates. The implementation was subjected to three attack scenarios: external attack, internal attack from compromised SCADA HMI, and internal attack from a compromised non-trusted IED. We observed that our model was robust against all attacks except for the baseline replay and delay response attacks. Detecting these attacks will be considered for future work as well as trust transferability. Our institute’s website provides a publicly available dataset containing captures of our MAS testbed.

A substation’s security is paramount because it is an integral part of the Smart Grid for the transmission and distribution of electricity. Advanced persistent threats (APTs) have become the bane of the substation because they can remain undetected for a period until final attacks are launched. A lot of existing techniques may not be real-time enough to detect these final attacks. Trust, even though less investigated, can be used to tackle these attacks. In this paper, we present a trust model designed specifically for the Modbus communication protocol that can detect final attacks from APTs when a substation is compromised. This model is formed from the perspective of the substation device and was successfully tested on two publicly available Modbus datasets under three testing scenarios. The external test, the internal test, and the internal test with IP-MAC blacklisting. The first test assumes attackers’ IP, and MAC addresses are not part of the substation network, and the other two assume otherwise. Our model detected the attacks within each dataset and also revealed the attack behaviour within the two datasets. Our model can also be extended to other protocols, and this has been marked for future work.

Fog computing allows data to be processed on the network edge without reaching the cloud infrastructure to reduce latency and network bandwidth. However, it is not without its security challenges as existing security protocols, implemented in the fog, do not fully cater for the mobility and heterogeneity of the fog, especially on resource-constrained fog nodes. As such, this increases latency and overhead on those nodes which also affects the fog. This paper investigates the possibility of creating a one-time pad (OTP)-based encryption protocol with no packet loss; lesser time and energy overheads as compared to protocols that have been proposed by existing research. The protocol will be tested on wireless sensor nodes, which are resource constrained, and the outcome monitored. The OTPs will be generated using a random number generator within the nodes. Outcomes are positive and can be implemented on resource-constrained fog nodes.