Industrial control systems have become ubiquitous, enabling the remote, electronic control of physical equipment and sensors. Originally designed to operate on closed networks, the protocols used by these devices have no built-in security. However, despite this, an alarming number of systems are connected to the public Internet and an attacker who finds a device often can cause catastrophic damage to physical infrastructure. We consider two aspects of ICS security in this work: (1) what devices have been inadvertently exposed on the public Internet, and (2) who is searching for vulnerable systems. First, we implement five common SCADA protocols in ZMap and conduct a survey of the public IPv4 address space finding more than 60K publicly accessible systems. Second, we use a large network telescope and high-interaction honeypots to find and profile actors searching for devices. We hope that our findings can both motivate and inform future work on securing industrial control systems.

It is critical to monitor IT systems that are part of energy delivery system infrastructure. The problem with intrusion detection systems (IDSes) is that they often produce thousands of alerts daily that must be dealt with by administrators manually. To provide situational awareness, detection systems usually employ (alert, priority) mappings that are either built in the IDS without consideration of the high-level mission objectives of the infrastructure, or manually defined by administrators through a time-consuming task that requires deep system-level expertise. In this paper, we present Seclius, an online security evaluation framework that translates low-level IDS alerts into a high-level system security measure and provides a ranking of past malicious events and affected system assets based on how crucial they are for the organization. Seclius significantly reduces human involvement by automatically learning system characteristics, providing a simple formalism that administrators can use to define security requirements. Experiments on a process control network with real vulnerabilities and a multistep attack show that Seclius can accurately report system security with low performance overhead and support the time-constrained security decision-making process that is necessary for critical infrastructure.

The University of Illinois at Urbana Champaign (Illinois), Pacific Northwest National Labs (PNNL), and the University of Southern California Information Sciences Institute (USC-ISI) consortium is working toward providing tools and expertise to enable collaborative research to improve security and resiliency of cyber physical systems. In this extended abstract we discuss the challenges and the solution space. We demonstrate the feasibility of some of the proposed components through a wide-area situational awareness experiment for the power grid across the three sites.

At the tipping of a paradigm shift in the way energy is produced, transmitted and delivered, the research efforts have not been paralleled by the curricular development. With rapid pace of changes in the field of Smart Grid (SG), the traditional research and educational efforts have been a major domain for electrical engineers. As a mode of discovery and education, interdisciplinarity facilitates broadened perspectives, ability to synthesize, analyze, integrate, and apply knowledge, and out-of-the-box thinking. The major contributions of this paper are discussion of requirements of the educational efforts in SG with special emphasis on multidisciplinarity, survey of the related work, which is the first in the literature to the best of our knowledge, and a discussion of the content for such an effort. A mixed team of power engineers and computer scientists are developing a layered curriculum starting from the introductory material from a variety of SG topics. A distinguishing advantage is the availability of many software tools and the state-of-the-art testbed as a result of years of research.

The energy sector worldwide has embarked on a transformational process to modernize the over-a-century-old power grid under an umbrella term of the Smart Grid. This vast infrastructural upgrade and operational change involves integration of a variety of advanced digital computing, communications and industrial control technologies. This brings new capabilities, but also necessitates a re-education of the aging workforce and training of the emerging workforce. While training does exist, the training approach and the accessibility of that training is often at odds with the needs of the utilities. To support this education and training need, in this paper we introduce the beginning of a modular, hands-on and open Smart Grid cybersecurity educational training platform and supporting materials together with an assessment of a preliminary version leveraged at the Trustworthy Cyber Infrastructure for the Power Grid (TCIPG) Summer School held in 2013. We base pedagogical pillars onto: (1) Active Learning that promotes analysis, synthesis, and evaluation of the content from Bloom's taxonomy, (2) The theory of project-based learning, (3) Piaget's learn-by-doing posture, and (4) Constructivist perspective of education. The main goal of this effort is to develop a complete, phased, and modular learning platform to provide the essential base knowledge and hands-on training exercises for understanding and demonstrating competency in Smart Grid cybersecurity.

Preserving the availability and integrity of networked computing systems in the face of fast-spreading intrusions requires advances not only in detection algorithms, but also in automated response techniques. In this paper, we propose a new approach to automated response called the response and recovery engine (RRE). Our engine employs a game-theoretic response strategy against adversaries modeled as opponents in a two-player Stackelberg stochastic game. The RRE applies attack-response trees (ART) to analyze undesired system-level security events within host computers and their countermeasures using Boolean logic to combine lower level attack consequences. In addition, the RRE accounts for uncertainties in intrusion detection alert notifications. The RRE then chooses optimal response actions by solving a partially observable competitive Markov decision process that is automatically derived from attack-response trees. To support network-level multiobjective response selection and consider possibly conflicting network security properties, we employ fuzzy logic theory to calculate the network-level security metric values, i.e., security levels of the system's current and potentially future states in each stage of the game. In particular, inputs to the network-level game-theoretic response selection engine, are first fed into the fuzzy system that is in charge of a nonlinear inference and quantitative ranking of the possible actions using its previously defined fuzzy rule set. Consequently, the optimal network-level response actions are chosen through a game-theoretic optimization process. Experimental results show that the RRE, using Snort's alerts, can protect large networks for which attack-response trees have more than 500 nodes.

Changes taking place in one of the largest and most complex cyber-physical systems out there, the Electric Power Grid are posing interesting challenges. Legacy systems utilizing ancient technology are coupled with cutting-edge implementations for the new smart grid. Smart Metering, Smart Sensors like Phasor Measurement Units, Pluggable Hybrids, Renewable Energy Resources, and increasing interaction between the consumers and the suppliers of the electricity are examples of the evolutions that are posing challenges. With the world rapidly progressing towards a smarter grid, those challenges must be overcome and done so in a manner that provides confidence in their deployment. This talk will examine some of the above challenges in this space and how effective solutions that address those challenges are being designed and evaluated through a testbed as part of the DOE/DHS sponsored Trustworthy Cyber Infrastructure for the Power Grid (TCIPG) Center. Material covered will include setting up the testbed, various hardware and software utilized, unique issues presented, experiences, and lessons learned. The talk will conclude by providing some open issues and suggestions for future direction of research.

Preserving the availability and integrity of networked computing systems in the face of fast-spreading intrusions requires advances not only in detection algorithms, but also in automated response techniques. In this paper, we propose a new approach to automated response called the Response and Recovery Engine (RRE). Our engine employs a game-theoretic response strategy against adversaries modeled as opponents in a two-player Stackelberg stochastic game. RRE applies attack-response trees to analyze undesired security events and their countermeasures using Boolean logic to combine lower-level attack consequences. In addition, RRE accounts for uncertainties in intrusion detection alert notifications. RRE then chooses optimal response actions by solving a partially observable competitive Markov decision process that is automatically derived from attack-response trees. Experimental results show that RRE, using Snort's alerts, can protect large networks for which attack-response trees have more than 900 nodes.