IEEE Power & Energy Magazine - September/October 2016 - 52

figure 1. The DHS Aurora vulnerability document.

The utility's procurement requirements specified "manual
intervention" for certain operating conditions; however, the
vendor configured an automatic-only execution process.
Consequently, during system testing, the process operated differently than expected, causing a large number of distribution
circuit breakers to be automatically and unexpectedly opened
by the SCADA control system. This incident was deemed a
nonmalicious event, yet the incident exemplifies the risk of
an unintentional cyberactor that can affect the operation of
critical operating facilities when broad encompassing cybersecurity practices are not implemented holistically.

Florida Power & Light Outage (2008)
In February 2008, a system disturbance initiated by a transmission system fault led to the loss of approximately
2,300 MW of load in South Florida. The disturbance further
caused the subsequent loss of approximately 4,300 MW of
generation within the region and additional load shedding.
An engineer was diagnosing a switch that had malfunctioned at Florida Power & Light's Flagami substation in west
Miami. The engineer disabled two layers of relay protection
and then conducted a diagnostic process that caused a fault
leading to cascading outages due to the disabled protection. The resulting outages led to loss of power to more than
5 million people throughout Florida. While the cause of the
fault was not deemed as intentional, the loss of protection
was not identified by the SCADA operator.
These examples demonstrate that while cyberincidents
may not appear to be intentional or malicious, they still pose
a risk that should be accounted for. In both the Florida and
Arizona cases, the only difference between the incidents
being malicious and unintentional was the motivation of the
individual involved.

Aurora Vulnerability Demonstration
The Idaho National Laboratory conducted a test in 2007 to
demonstrate that it is possible to damage an electric generator
52

ieee power & energy magazine

through improper synchronization to the electric grid. This
test was called the Aurora vulnerability demonstration.
An "Aurora event" refers to the consequential situation
whereby a substation circuit breaker or breakers are opened
and closed very quickly, resulting in an out-of-phase condition for the ac rotating equipment connected to the substation. When the breakers are closed out of phase, the torque
from the mis-synchronization transfers high forces upon the
generator, or induction motor, large enough to induce high
stresses, creating the risk of severe damage to the equipment.
The Aurora vulnerability specifically refers to a physical gap
in the substation relay protection to its associated electric
grid connection. Aurora was demonstrated and confirmed
as a real risk to electric generators and induction motors
connected to the grid during the test at the Idaho National
Laboratory. During the test, the system dispatcher reported
that he could not see any external effects until the generator
was effectively destroyed. The test indicated that substation
protection equipment could unknowingly become compromised if an actor successfully manipulates operating devices,
potentially resulting in significant damage without warning.
Following the Aurora test, specific hardware solutions
were developed to address the Aurora risk and thus to protect the generator against mis-synchronization induced by
substation circuit breakers, and these solutions were made
available to the industry along with industry guidance from
NERC in 2007. Unfortunately, this vulnerability remains
unmitigated at many substation and switchyard facilities, as
there is no requirement for operators to install the mitigating hardware. POWER Magazine, in September 2013, stated
that it's believed that very few substation facilities within the
U.S. electric industry, and almost none outside the United
States, have implemented a protective solution. Aurora can
affect all types of ac rotating electrical equipment connected
to an electric grid, as well as other interconnected equipment
such as transformers if they are not properly protected by
Aurora hardware mitigation.

The Story Hits the Street
In July 2014 the U.S. Department of Homeland Security
(DHS) declassified more than 800 pages on the Aurora
vulnerability, and, as a result, those details were also made
available to potential hackers through hacker websites.
With fewer than a handful of U.S. utilities that have confirmed installation of the Aurora hardware mitigation, this
leaves many facilities as unsecured. Well-coordinated and
executed attacks, exploiting vulnerabilities such as Aurora,
could damage portions of the electric system. Depending
on the depth of penetration, scale of attack, and the specific
equipment compromised, outages could range anywhere
from small (hours or days) upwards to months to a year for
larger, more critical facilities. Figure 1 demonstrates the
basic formula to create an Aurora event. The presentation
from which this figure was referenced, now declassified by
the DHS, in essence provides a road map for an attacker to
september/october 2016

Table of Contents for the Digital Edition of IEEE Power & Energy Magazine - September/October 2016