Cyber-attack TTP analysis for EPES systems

2023-02-17

Energy Sources Part B Economics Planning and Policy

AI Summary

Power systems have long relied on the “air-gap isolation” assumption, but Industry 4.0–driven interconnectivity is exposing inherent cybersecurity vulnerabilities in critical electric power and energy systems (EPES). Method: This study systematically models and empirically validates advanced adversary tactics, techniques, and procedures (TTPs) targeting EPES, culminating in the first end-to-end attack chain demonstration within a real Greek Public Power Corporation (PPC) power plant—leveraging ICS protocol reverse engineering, PLC firmware exploitation, and protocol-level penetration of OPC UA and IEC 61850 to achieve remote PLC command injection and smart meter data manipulation. Contribution/Results: The work challenges the traditional air-gap security paradigm by revealing TTP-driven lateral movement and physical-layer disruption pathways even in non-internet-connected environments. It provides empirical evidence and a methodological foundation for EPES resilience assessment and defense architecture redesign.

Abstract

The electrical grid constitutes of legacy systems that were built with no security in mind. As we move towards the Industry 4.0 area though a high-degree of automation and connectivity provides: 1) fast and flexible configuration and updates as well as 2) easier maintenance and handling of misconfigurations and operational errors. Even though considerations are present about the security implications of the Industry 4.0 area in the electrical grid, electricity stakeholders deem their infrastructures as secure since they are isolated and allow no external connections. However, external connections are not the only security risk for electrical utilities. The Tactics, Techniques and Procedures (TTPs) that are employed by adversaries to perform cyber-attack towards the critical Electrical Power and Energy System (EPES) infrastructures are gradually becoming highly advanced and sophisticated. In this article we elaborate on these techniques and demonstrate them in a Power Plant of the Public Power Corporation (PPC). The demonstrated TTPs allow to exploit and execute remote commands in smart meters as well as Programmable Logic Controllers (PLCs) that are responsible for the power generator operation.

Problem

• Analyzing cyber-attack TTPs in EPES systems
• Addressing security risks in legacy electrical grids
• Demonstrating advanced TTPs in power plant infrastructure

Innovation

• Analyzing cyber-attack TTPs in EPES systems
• Demonstrating exploits in smart meters and PLCs
• Focusing on Industry 4.0 automation risks