sd Use_Case Third-Party Cyberhost Data Source SCADA Host Power-Grid Operator STEVE IT Database or IT Personnel Substation Engineer Vulnerabilities(). Sys_Maintenance() Cyber_Alarms_Summary() SCADA_Alarms_Summary() SCADA_Alarms_Summary() CPS_Study_Request() State_Estimation _Request() State_Estimation _Response() Network_Data_Request_1_&2() Network_Data_Request_Response() Local_Measurement_Request() Local_Measurement_Response() Security_Info_Request() CPS_Alarm_ Measurement() Security_Info _Response() CPS_Alarm_Cyber() figure 5. An interaction diagram: enhanced alarm processor message exchanges. table 2. A description of STEVE message exchanges. Message 100 DMTF TC57 CIM STIX SCADA_Alarms_Summary - X - Cyber_Alarms_Summary X - X Vulnerabilities_Notification X - X Sys_Maintenance - X - CPS_Study_Request - X - State_Estimation_Request - X - State_Estimation_Reply - X - Network_Data_Request_1 X X - Network_Data_Request_2 X - - Local_Measurement_Request - X - Security_Info_Request X - X CPS_Alarm_Measurements X X X CPS_Alarm_Cyber X X X ieee power & energy magazine the communication channels. Figure 4 shows the specific links between the IEC TC57 CIM and DMTF information model for improved modeling of the telecommunications and computers used in SCADA systems. Secure message exchanges to the enhanced alarm processor, named STEVE, are presented via an interaction diagram shown in Figure 5 and described in Table 1. Table 2 provides details on message exchanges in the enhanced alarm processing. Along with the message title, the table also identifies the data models used. We propose that enhanced alarm processing should be capable of processing messages from the DMTF, IEC TC57 CIM, and STIX. The DMTF provides information on SCADA network hardware and network configuration. The IEC TC57 CIM provides power system SCADA-specific data. STIX provides the capability to define cybersecurity-related information such as attack strategies. Some messages, as observed below, constitute data from more than one data model. The need for data model federation is further reinforced by such messages. january/february 2016