Risk Analysis of Coordinated Cyber Attacks on Power Grid

Abstract

The supervisory control and data acquisition (SCADA) network providesadversaries with an opportunity to perform coordinated cyber attacks onpower system equipment as it presents an increased attack surface.Coordinated attacks, when smartly structured, can not only have severephysical impacts, but can also potentially nullify the effect of systemredundancy and other defense mechanisms. This chapter proposes avulnerability assessment framework to quantify risk due to intelligentcoordinated attacks, where risk is defined as the product of probabilityof successful cyber intrusion and resulting power system impact. Thecyber network is modeled using Stochastic Petri Nets and thesteady-state probability of successful intrusion into a substation isobtained using this. The model employs a SCADA network with firewallsand password protection schemes. The impact on the power system isestimated by load unserved after a successful attack. The New England39-bus system is used as a test model to run Optimal Power Flow (OPF)simulations to determine load unserved. We conduct experiments creatingcoordinated attacks from our attack template on the test system andevaluate the risk for every case. Our attack cases include combinationsof generation units and transmission lines that form coordinated attackpairs. Our integrated risk evaluation studies provide a methodology toassess risk from different cyber network configurations and substationcapabilities. Our studies identify scenarios, where generation capacity,cyber vulnerability, and the topology of the grid together could be usedby attackers to cause significant power system impact.