Framework configures, secures remote access to legacy and emerging energy devices for utilities

Due to a variety of attacks on the energy sector in the last decade, utilities are on high alert for possible infiltrations to their security. Having incorrect or inconsistent configuration of energy sector devices is just one of the areas attackers could leverage to thwart the security measures energy companies have set up.

Applying a uniform security policy across electric sector devices is one way that ITI’s Tim Yardley, along with co-PIs David Nicol, Bill Sanders and Klara Nahrstedt, have identified to help mitigate these attacks. Yardley and his team were recently awarded a three-year, $1.5 million grant by the U.S. Department of Energy, with collaborators from the Electric Power Research Institute (EPRI), Schweitzer Engineering Laboratories (SEL) and Ameren, called “Innovation for Increasing Cybersecurity for Energy Delivery Systems.” The grant will fund development of a framework, Secure Policy-Based Configuration Framework (PBCONF), which will support the secure configuration and remote access of energy devices from a variety of vendors.

“The basis of the project is to take away the complexity of manually configuring different heterogeneous devices to map to a global security policy. This is a procedure that’s traditionally plagued by human error, has a requirement for vendor specific product expertise and suffers from various other caveats,” Yardley said. “We’re looking into how to take a security policy that you want to apply systemically throughout your company, map that to device specific commands based on each device’s capabilities, apply that configuration to devices and have the flexibility to reason about that policy, regardless of which vendor makes them.”

Yardley is developing a framework that will interface with electric sector devices to consistently construct security related configuration controls, such as authentication, authorization, auditing and access control, and to provide secure remote access. The framework is being built with the flexibility and adaptability to accommodate both legacy and new devices via a plug-in model, which allows new devices and manufacturers to be supported by simply adding that device’s module.

Additionally, PBCONF will serve as an auditing mechanism, keeping track of the devices, monitoring and logging configuration changes. An additional feature is the capability to generate reports and analyze which devices are capable of meeting, or compliant with, a current or future-planned security policy.

“The power of this framework isn’t just that you can define global security policy that’s pushed down to the devices, but rather that you can see when the configuration changed, how many times it has been modified in the past six months and when it became non-compliant with policy,” Yardley said. “It provides a flexible tool for you to view and manage the change lifecycle of your devices.”

Yardley will be working closely with the EPRI, as well as getting support from SEL, who will advise and guide work on device configuration implementation, and Ameren, who will advise and assist in the demonstration of the framework in the utility environment.

The design of the framework will be finalized this summer, after which Yardley will begin developing and testing the framework in a demonstration environment at Ameren’s technology application center in Champaign, as well as the EPRI and Illinois testbeds. Upon completion of the project, the technology will be open-sourced and available for commercialization.

In addition to making it available to the public, the team will be working to create a community around this product through workshops and activities that engage utilities and vendors, as the product is being developed.

While the approach Yardley has taken to develop this product—using ontologies to do semantic reasoning about systems—isn’t novel, there are no known products with these powerful features. Yardley feels this tool can be incredibly useful to utility companies, in terms of providing more cohesive security and increased productivity.

“It becomes a labor saving, time saving and overall efficiency initiative,” Yardley said. “It could even be reactive, allowing one to respond to a security event in a matter of minutes rather than days or weeks, and make comprehensive and cohesive changes across entire infrastructures."