POWER September 2013 - 52

CYBERSECURITY
What You Need to Know
(and Don't) About the AURORA
Vulnerability
When most people think of the AURORA cybersecurity threat today, they recall
an image of an out-of-control generator during a 2007 demonstration
test. But the threat didn't end in 2007. Despite the widespread impact of
any AURORA attack and the relatively low cost of mitigating against such
attacks, virtually no utilities have taken action to protect the grid and its
users from potentially devastating consequences.
By Michael Swearingen, Tri-County Electric Cooperative; Steven Brunasso, Electric Utility, Joe Weiss, Applied Control
Solutions; and Dennis Huber, Booz Allen Hamilton
P
erhaps because the public has been more
obsessed in recent years by cybersecurity
breaches involving everything from
social media accounts to classified military
secrets, the amount of attention given to the
ongoing threat posed by the AURORA vulnerability
has been out of proportion to the extent
and severity of the threat. The AURORA
vulnerability affects much more than rotating
equipment inside power plants. It affects nearly
every electricity system worldwide and potentially
any rotating equipment-whether it
generates power or is essential to an industrial
or commercial facility.
If the threat is so widespread, why isn't
industry more concerned and active in seeking
solutions? There are a number of possible
reasons, from innocent lack of awareness to
fear of greater regulation to a desire to avoid
unnerving large customers (who may decide
they're better off developing a self-generation
plan, thus resulting in a lost customer).
New Systems Require New
Security
Reliable operation of the electric grid has
always been a primary goal of utilities and
other power generators as well as system operators
at all levels. To accomplish this goal,
utilities monitor system conditions, test system
equipment, and conduct system maintenance.
Ensuring the reliability and physical
security of generation facilities, transmission
interchanges, substations, office buildings,
and control centers is standard practice for
most utilities.
These operation and security practices
have worked well in the past; however, with
the advent of new communication technologies,
a new paradigm in security practices
52
has emerged. This new paradigm is known as
cybersecurity.
Cybersecurity encompasses the securing
of digital systems, communication systems,
and control systems from intentional and
unintentional cyber intrusion and physical
compromise. The potential for cybersecurity
intrusion on a system grid is proportional to
the amount of electronic communications to
and from control systems that operate on a
utility's networks.
by CNN. The results of this specific test
demonstrated that the threat associated with
rapidly disconnecting and reconnecting a
generator to the grid, but out of phase-via
physical or cyber intrusion of control systems
conducted maliciously or unintentionally-could
have serious effects on system
operation. Connecting AC equipment outof-phase
is a known vulnerability, but doing
it maliciously was brought to light by the
test conducted by INL.
The real concern is that the existing
protection in all substations worldwide
excludes the rapid response needed to
mitigate an AURORA-type event.
Sometimes the argument is made that isolation
of a utility's network from any external
communication makes it secure. However, it
is very difficult to " air gap " a system-keep
it electronically isolated-and even an air
gap does not make a system completely secure
from physical access and compromise.
There are many avenues for a cybersecurity
intrusion, and one is the vulnerability
known as AURORA.
What Is AURORA?
An AURORA attack results when a circuit
breaker or breakers are opened and closed,
resulting in an out-of-phase condition that
can damage alternating current (AC) equipment
connected to the grid. A demonstration
of this for the Department of Homeland
Security, conducted at the Idaho National
Laboratory (INL) in 2007, was broadcast
www.powermag.com
There has been confusion about what actually
occurred during the AURORA test at
INL. That test was planned by relay experts
to reflect real conditions with no equipment
such as synchronous check relays disabled.
Unfortunately, there has been little public
information to document what actually occurred;
consequently, misinformation about
the event has resulted.
The real concern is that the existing protection
in all substations worldwide excludes the
rapid response needed to mitigate an AURORAtype
event.
This means there is a gap in grid protection
that can only be mitigated by a hardware fix.
Cybersecurity and AURORA
Conditions
Control systems are designed for reliability,
safety, and functionality. Many of these sysPOWER
| September 2013

http://www.powermag.com

POWER September 2013

Table of Contents for the Digital Edition of POWER September 2013