Cybersecurity for Critical Infrastructures: Attack and Defense Modeling

Abstract—Disruption of electric power operations can be catastrophic on national security and the economy. Due to the complexity of widely dispersed assets and the interdependences among computer, communication, and power infrastructures, the requirement to meet security and quality compliance on opera-tions is a challenging issue. In recent years, the North American Electric Reliability Corporation (NERC) established a cybersecu-rity standard that requires utilities ’ compliance on cybersecurity of control systems. This standard identifies several cyber-related vulnerabilities that exist in control systems and recommends several remedial actions (e.g., best practices). In this paper, a comprehensive survey on cybersecurity of critical infrastructures is reported. A supervisory control and data acquisition security framework with the following four major components is proposed: 1) real-time monitoring; 2) anomaly detection; 3) impact analy-sis; and 4) mitigation strategies. In addition, an attack-tree-based methodology for impact analysis is developed. The attack-tree formulation based on power system control networks is used to evaluate system-, scenario-, and leaf-level vulnerabilities by iden-tifying the system’s adversary objectives. The leaf vulnerability is fundamental to the methodology that involves port auditing or password strength evaluation. The measure of vulnerabilities in the power system control framework is determined based on ex-isting cybersecurity conditions, and then, the vulnerability indices are evaluated. Index Terms—Attack tree, cybersecurity, defense systems, power system control, security vulnerability