Cyber Security of Power Grids

This course focuses on cyber security of Information Technology (IT), Operational Technologies (OT) networks used for power system operation. It starts with an overview of the smart grid and its industrial control systems (EMS/SCADA) and introduces computer networks and cyber security. Next, the course will introduce the cyber kill chain method for cyber security investigation and intelligence-driven defence. Kill chains are used to understand, anticipate, recognise, and combat cyber attacks and advanced persistent threats. The course uses the kill chains of the 2015/2016 cyber attacks on Ukrainian power grid as real-world study cases throughout the course. The main IT-OT system vulnerabilities and cyber threats are analysed. The course covers threats such as passive and active reconnaissance, social engineering, and malware. It investigates various threat vectors on host and network security and advanced cyber attacks targeting power grids. The impact on power system operation is analysed. The course discusses the state-of-the-art security controls to defend and mitigate cyber attacks on power grids such as access controls, authentication management, cryptography, firewalls, secure communication protocols, network segmentation, and intrusion detection and prevention systems. The best practices to improve power grid resilience to cyber attacks are discussed, i.e., threat intelligence management, incident response, and wide area monitoring, protection and control. This course provides a deep dive into core cyber security concepts for power grids such as cryptography (symmetric and asymmetric encryption), hash functions, digital signatures, and cyber-physical anomaly detection using machine learning techniques. Cyber security demonstrations on power grids will be conducted for students in Control Room of the Future (CRoF) technology centre.