The benefits of renewable energy continue to grow, with wind generation supplying 9.2% of the generation in the US and up to 22.6% in other Western countries such as Germany. Solar power is in 2.8% in the US (for large-scale installations) and about 10% in Germany. Through diversification and greater integration of the distribution system, the application of renewable energies promises a greater resiliency of the power system against threats what includes damaging storms and cyber attacks.
While renewable energy offers communities the ability to meet critical load demand, distributed systems can ease the resiliency burden of transmission systems and large-scale generation providers to meet these needs. Diversifying generation assets can reduce the impact of individual threats, as compromise outages are likely to be smaller in scale and less likely to affect all assets, specifically from a cyber attack. Looking to the future and the potential impacts of climate change, distribution and diversification provide practical avenues for resilience and impact reduction.
However, the necessary control systems to integrate the distribution and diversification required to maintain the stability of the electrical system expand the attack surface through more communication interfaces. As a result, resistance to cyber attacks must rise to levels commensurate with rising threat levels to provide owners and operators with the reliability their mission demands. Advancing a reference architecture that enables safe design across all types of generation, large and small, is critical to the future of distributed energy system resiliency. (See other proposals here: https://sunspec.org/wp-content/uploads/2020/01/EPRI-Security-Architecture-for-the-Distributed-Energy-Resources-Integration-Network.pdf.)
A reference architecture for orchestrated response
The application of safe technologies and applications will support next-generation resilient designs for energy applications, informed by research and development (R&D) work, and applied by industry. To inform a reference architecture design and R&D gaps for the renewable energy industry, a the survey was conducted to assess the current state of the industry. The survey was sent to: cybersecurity providers and original equipment manufacturers (OEMs) in the solar energy, wind energy and electric vehicle (EV) sectors.
A security architecture requires several elements, including:
- Detect. Network traffic monitoring to recognize unwanted traffic.
- Analyze. Methods, including machine learning, to establish a baseline of normal traffic and recognize the abnormal.
- Decide/Visualize. Presentation of information to cyber defenders for their rapid recognition and response.
- Mitigate/Recover. Methods to stop a cyber attack and reverse any negative effects.
- Share. Provision of indicators of cyber attack that can be shared safely and benefit the defenses of other organizations.
The functions of these security architecture elements are provided through the following security tools (Figure 1), noting that many of the tools provide multiple functions. (Also note that the proposed architecture is structurally agnostic and is likely to be implemented in a hybrid fashion. Energy resource data flow is no longer strictly hierarchical, so functional safety is essential regardless of alignment with hierarchies of traditional data):
- Detect, Analyze. Host/network intrusion detection systems (HIDS/NIDS).
- Decide/Visualize. Information Security and Event Management (SIEM).
- Mitigate/Recover. Security Orchestration, Automation, and Response (SOAR).
- Share. Structured Threat Information Expression (STIX), Trusted Automated Intelligence Information Exchange (TAXII).
Respondents were asked about their integration of such tools, plus traditional access controls and perimeter defenses provided by encryption. The survey garnered insightful perspectives from both cybersecurity vendors and OEMs on the listed technologies. Full results can be found at: https://inlbox.app.box.com/s/oqy4x0r398fgd31of3ox53w00n36uuai.
As an example of the analysis of results, Figure 2 provides a summarized example of NIDS from cybersecurity vendors. Each table provides the company, the product, the renewable energy domains affected, and the common capabilities of each product. Additionally, for each capability (using the categories provided), it also shows how many respondents indicated the same capability support.
Many cybersecurity providers responded to the survey, but only a limited number of renewable energy OEM providers chose to do so (Figure 3). It is evident that cyber security vendors believe that their products can provide benefits in this domain. Less apparent is a similar level of commitment and enthusiasm for cyber security from OEMs in the renewable energy industry.
Clearly, further discussion of cybersecurity reference architectures, with more substantial industry participation, is warranted. Specifically, a better understanding of investment tools, benefits and costs would be helpful. While large asset owners have security built in, further discussion/assessment on the security of distributed renewables is needed to ensure high-level protection and resiliency is designed. The resulting discussion should illuminate the need for decision-making tools that align benefits with investments. Achieving and maintaining a common threat posture between large-scale utilities and renewables requires the integration of security capabilities that add seamlessly.
Planning a cyber power system
An integrated security reference architecture will establish a resilient foundation for countering threats through, among other things, comprehensive real-time awareness. Building on this foundation will include automated and autonomous responses, real-time triggering, and distributed mitigations to maintain system operations despite damaging storms and cyberattacks. Achieving comprehensive resiliency for the nation’s energy system requires not only a high-confidence correlation between malfunction and malicious attack, but also recognition that the power system lives in a continually contested space. By establishing distributed protection approaches, the ability to recognize/respond to threats localizes the impact and prevents catastrophic loss. It also reduces reconnaissance and response time, limiting the adversary’s ability to compromise the power system.
As we look to advance, if not accelerate, the integration of distributed renewables, it is important to ensure that the appropriate and tailored cybersecurity approach is applied consistently across all interfaces to establish the suggested secure reference architecture. As we move towards this goal, it is important to understand the positions and perspectives of the industry. By doing so, a more precise understanding of where government investments are required can help prioritisation.
The survey featured in this article provides some of this insight, but we’d like to hear from other industry representatives to ensure an accurate correlation of need. To that end, please take a moment to complete a brief Qualtrics Industry Survey. The results of the updated survey will be shared widely with the renewable energy industry.
—Craig Rieger, PhD, PE he is the chief research engineer for control systems and a member of the INL board; jake smooth is a senior power systems engineer at INL, where he is manager of the Infrastructure Security program, supervisor of Secure Power Systems and Controls, and laboratory relationship manager for the US Department of Energy’s Office of Wind Energy Technologies. USA; Andy Bochmann he is a main strategist for grid-Defensor at INL; and Jeremiah Miller is director of markets and storage policies of the Solar Energy Industries Association (SEIA).