Cybersecurity Architecture for New Power Systems: Countering Insider Attacks with a "Vault" Model

Security analysts agree that utilities need new cybersecurity strategies to address increasingly sophisticated intrusion threats. These threats are endangering the expanding attack surface of increasingly distributed power systems.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) 2023-2025 Strategic Plan (released September 2022) states that every new piece of hardware and software added to the power system presents cyber vulnerabilities. However, according to a February 1 report by the North Carolina Clean Energy Technology Center, U.S. utilities proposed spending $29.22 billion in 2022 on system modernization reliant on hardware and software.

Network analysts say new hardware and software could allow malicious actors to gain internal access to critical operational technology through internet technology isolated by utility firewalls.

Erfan Ibrahim, founder and CEO of The Bit Bazaar, an independent cybersecurity consulting firm, said: "Traditional security measures cannot stop insider threats to critical infrastructure. The traditional mindset of trusted versus untrusted users must be replaced with a zero-trust paradigm with multi-factor authentication and monitoring."

Duncan Greatwood, CEO of cybersecurity provider Xage, also believes that the growing number of distribution system entry points makes keeping hackers out of operational infrastructure nearly impossible. But he noted that if a distributed cybersecurity architecture mirrors the structure of the distribution system, distributed resources can provide resilience, thereby containing and isolating intrusions before they spread to operational systems.

Cybersecurity providers say new multi-layered cybersecurity designs can provide rapid automated distributed protection for distributed resources as well as multi-layered protection for core assets. But analysts note these new strategies are still conceptual, and many utilities are reluctant to bear the cost and complexity of cybersecurity modernization.

Threat Landscape

Critical infrastructure has already shown vulnerability to insider attacks. The 2021 Colonial Pipeline shutdown began with a compromised password, according to public reports. The 2019-2020 SUNBURST attack targeting U.S. corporate and government networks, which infiltrated via software vendors like SolarWinds, was confirmed by CISA. Russia's 2015 attack on Ukraine's power system exploited authentication credentials (possibly obtained via email), as also reported by CISA.

The FBI reported that in 2021, 14 of the 16 U.S. critical infrastructure sectors suffered ransomware attacks, including the energy sector. Technology and research firm Gartner notes that new vulnerabilities also lead to data loss, network traffic disruption, and even denial-of-service outages.

Gartner, other analysts, and the May 2021 Biden executive order (which called for strengthening power system cybersecurity) agree that attacks on utility operational technology could originate from distributed solar, wind, energy storage facilities, employee internet accounts, smart home devices, or electric vehicles.

A Notice of Proposed Rulemaking issued by the Federal Energy Regulatory Commission (FERC) in January 2022 stated that existing Critical Infrastructure Protection (CIP) reliability standards developed by the North American Electric Reliability Corporation (NERC) are insufficient, focusing only on defending the network's secure perimeter. The rule states: "Suppliers or individuals deemed trustworthy, even with authorized access, may still introduce cybersecurity risks." The RM22-3-000 proceeding will provide guidance for updating CIP standards to better protect utilities.

Despite recent Biden administration and FERC actions focusing on the electric sector, utilities and system operators have declined to disclose vulnerabilities or actual attack information.

A 2022 assessment by cybersecurity provider Skybox Security showed that new OT vulnerabilities in U.S. networks reached 20,175 in 2021, an all-time high. The report stated that vulnerabilities were exploited faster and more frequently in 2021, indicating that cybercriminals are rapidly taking advantage of new weaknesses.

In December 2021, a CISA emergency directive confirmed a vulnerability in the Apache Log4j tool, which logs and scans nearly all communications between online systems, as reported by The Wall Street Journal at the time. The tool has been downloaded millions of times and could allow attackers to send and execute malicious code. Cybersecurity expert Wei Chieh Lim stated in a May 2022 blog post that the vulnerability is unlikely to be fully fixed in the coming years.

Tony Turner, CEO of cybersecurity provider Opswright, said the Log4j vulnerability was so simple that it was initially exploited by Minecraft players, indicating that utilities may be unaware of hundreds or even thousands of vulnerabilities.

Network analysts believe that a software bill of materials (SBOM)—a list of all components in a system—could be a solution to vulnerabilities like Log4j. SBOMs were mandated by the May 2021 Biden executive order, and a July 2021 report by the National Telecommunications and Information Administration added SBOM best practices and minimum requirements. But consultant Ibrahim noted that SBOM is just one element in a cybersecurity rethink.

Ibrahim and other analysts say internet technology began with firewalls and external defenses, but the new distributed power system makes penetration of the network's outer layers nearly inevitable. Many believe that only a multi-layered cybersecurity architecture throughout utility operations can protect both the new distributed attack surface of OT and core operational assets.

Conceptual Solutions

Opswright's Turner says the most common utility cybersecurity approach is compliance with NERC CIP standards, or possibly the narrower International Society of Automation (ISA) 62443 standard. But NERC CIP standards are being reformed, and ISA standards focus only on automation and control system vulnerabilities.

Turner notes that the U.S. Department of Energy's (DOE) new Cyber-Informed Engineering program may provide better cybersecurity for critical infrastructure. The program proposes eliminating risks at the earliest stages of OT system cyber defense design, which DOE documents call the best time to introduce low-cost and effective cybersecurity.

David Anteliz, senior technical director at Skybox, says utilities need to bridge the gap between IT and OT systems. A November 2021 Skybox survey found that the complexity of multi-vendor technology and the disconnect between IT and OT architectures increased security risks, while third-party access increased but fewer than half of utilities had relevant policies.

Anteliz said: "I can guarantee that someone is lurking in the background at a utility right now. Skybox's answer is automated defense-in-depth and layered architecture, providing continuous monitoring, visibility, understanding, and response to what needs to be protected and where."

Skybox's 2022 Vulnerability Trends report states that segmentation in design can isolate utility control rooms, making them a vault. The report says that automatically aggregating data and system information from every corner of the network can inform automated responses and provide continuous oversight, enabling utilities to shift from reactive response to proactive prevention.

Other cybersecurity analysts have designed detailed zero-trust and defense-in-depth conceptual architectures applicable to the U.S. electric sector.

Ibrahim of The Bit Bazaar says the first of four layers of security functions is foundational cyber hygiene—establishing user access rules and priority lists, use cases, and necessary transactions. Proper application can limit interactions to those who need to transact.

The second layer is a signature-based intrusion detection system (IDS), which uses automated priority lists to restrict access to authenticated users and valid use cases. The third layer is a context-based IDS that extends access restrictions by blocking or flagging transactions with insufficient authentication. These IDSs operate in stealth mode, invisible even to insiders, but every network session is monitored, and any deviation from normal transactions and rules terminates the session. Utility security information and event management systems can detect and analyze all transactions and respond to and report suspicious or terminated transactions.

The fourth layer, endpoint security, is overseen by automated hypervisor software with three layers of protection. Ibrahim says an intrusion may compromise the target application, but endpoint hardware is protected by the hypervisor, and last-gasp messages can prevent cascading failures in the OT network from reaching the grid at the network edge or the network core.

Gartner says the grid is a collaborative ecosystem of tools and controls used to protect the power system's expanding distributed resources and vulnerable third-party devices. Its distributed security tools provide enhanced detection capabilities and more efficient intrusion response.

Ibrahim says the grid cannot eliminate insiders with legitimate credentials, so utility system modernization reliant on hardware and software should have multiple layers of defense and inspect every line of new code. But if a system is compromised at the edge—for example, at the smart meter or EV charger level—the grid can respond to prevent the intrusion from spreading.

Opswright's Turner says these conceptual architectures can improve situational awareness and control, but most utilities remain focused on NERC CIP compliance to avoid fines. Many utilities believe that designed cyber defenses add complexity that slows and confuses system monitoring and response, and that the added security costs are unjustified. However, it is unclear whether there is a better option, because firewalling the millions of distributed devices in the coming power system is impractical.

Turner, Ibrahim, and others agree that a layered zero-trust architecture—core firewalls, monitored middle-tier gateways protecting operations, and a grid at the network edge—is the emerging consensus solution for comprehensive OT system security. But network experts and power system stakeholders agree that despite federal directives, mandates, and vendor concepts, attacks are still spreading, indicating more efforts are needed.

Utility-Sponsored Cybersecurity Sandbox

Public and private sectors continue to develop zero-trust tools and technologies to help conceptual architectures better protect OT in the power and other industries.

The DOE National Renewable Energy Laboratory (NREL) launched the Clean Energy Cybersecurity Accelerator (CECA) program in December as a sandbox for innovative cybersecurity pilot projects. The CECA website says strategies to address new power system vulnerabilities introduced by clean energy technologies will be deployed and tested.

Jonathan White, NREL's cybersecurity research program director, said at a January 17 CECA planning webinar: "U.S. critical infrastructure is increasingly becoming a target for adversaries." NREL scientists at the webinar said the program is funded by utility sponsors, including Duke Energy, Xcel Energy, and Berkshire Hathaway (BHE), and solutions will be evaluated using NREL's Advanced Research on Integrated Energy Systems Cyber Range.

According to NREL, the Cyber Range is NREL's proprietary, up to 20-megawatt renewable energy system that integrates distributed resources such as electric vehicles and batteries, built specifically for testing innovative technologies. The first CECA demonstrations will test cyber defense approaches from Xage, Blue Ridge Networks, and Sierra Nevada Corp.

BHE spokesperson Jessi Strawn said BHE hopes to use NREL's rigorous testing to find technology solutions and effective fast-track technologies to improve cyber defenses. BHE Security and Resilience Director Jeffrey Baumgartner added in a statement that CECA will allow utilities and solution providers to stress-test disruptive security technologies and give defenders the opportunity to stay ahead of threat actors.

Duke Energy spokesperson Caroline Portillo said Duke Energy frequently engages with vendors with innovative technologies, and CECA is a way to test those technologies in a non-real-time environment. She added that this opportunity is especially valuable because testing will be conducted at scale in a sandbox environment, followed by technology performance evaluations by participating sponsoring utilities. Portillo said initial test results on authentication and authorization of distributed energy resources integrated into OT environments will be critical, as Duke and other utilities are adding these resources.

Xage CEO Greatwood said: "The significance of the NREL project is establishing a neutral platform for solution providers and utilities to collaborate on OT cybersecurity innovation. Technology companies have been frustrated with the slow pace of change in the utility industry." He added that if end-user utilities participate in CECA, technology companies will understand their needs, and utilities can gain technical validation of solutions. Greatwood said: "Xage already has utility customers," but this is an opportunity to demonstrate how automated, widely deployed grid defense like Xage Fabric can work in a zero-trust cybersecurity architecture for OT environments.

He said: "A system is only as secure as its weakest link, and a power system with millions of distributed resources has a weakest link that is not secure because it provides attackers with numerous entry points. A grid architecture that mirrors the distributed physical architecture can identify and isolate, or at least control, intruders without proper authorization and authentication."

Gartner observed in January 2022 that power system environments are evolving toward growing network, infrastructure, and architectural complexity, and vulnerabilities will persist. But Ibrahim says these vulnerabilities must be addressed, because limiting access to critical systems may be the biggest barrier to preventing cyber disruption. He added: "Building the best defenses may take time, money, and management process changes, but these costs are trivial compared to the billions of dollars in losses a successful intrusion could cause."