Global test beds for control, safety, security and dependability in ICT-Enabled Critical Infrastructures From SAFEGUARD Intrusion Detection Test Environment to IRRIIS Information Sharing Testing Environment Joint US-EU Workshop Washington D.C. 16-17 March, 2006 Sandro Bologna – ENEA bologna@casaccia.enea.it

Three Layers Model for the Critical Infrastructure Organisational Layer Intra-dependency Cyber Layer Inter-dependency Physical Layer

Three Layers Model for the Electrical Infrastructure Electrical Components generators, transformers, breakers, connecting cables etc Control and supervisory hardware/software components (Scada/EMS systems) Electrical Power Operators Independent System Operator for electricity planning and transmission Intra-dependency National Electrical Power Transmission Infrastructure Telecomunication Infrastructure Oil/Gas Transport System Infrastructure Foreign Electrical Transmission Infrastructure Inter-dependency

US CANADA BLACK-OUT Power System Outage Task Force Interim Report

SAFEGUARD vs. IRRIIS SAFEGUARD is a collection of Software Agents developed to detect anomalies on the Cyber Layer of a single LCCI. IRRIIS (MIT) is a system to support information coordination and information sharing between different LCCIs. These information regard all the three layers of a LCCI, with special emphasis to organisational and cyber layer. IRRIIS (MIT) could make use of some Safeguard Agents

SAFEGUARD ARCHITECTURE Network global protection Cyber Layer of Electricity Network Home LCCIs Topology agent Negotiation agent MMI agent Other LCCIs Foreign Electricity Networks Telecommunication Networks ------------------- Correlation agent Action agent Low-level agents High-level agents Diagnosis wrappers Intrusion Detection wrappers Hybrid Anomaly Detection agents Actuators Safeguard agent Architecture for Large Complex Critical Infrastructures (LCCIs) Commands and information Information only Network global protection Local nodes protection

Data management network General layout of typical control and supervisory infrastructure of the electrical grid Control and management layer (SCADA system) SIA-R CNC CC SIA-C Remote Units Control Centres Data management network WAN (Wide Area Network) Data Concentrator Area 1 Area 2 Area 3 Substations Loads Generator Physical Network Physical electrical layer (high-medium voltage)

SAFEGUARD Test Environment: distributed SCADA component emulation on a local network Load-flow electrical grid simulator(e-Agorà) “Broker” di messaggi Detector di riconoscimento di “invarianti” nei dati Detector di riconoscimento di sequenze di eventi Detector di anomalie sulle porte Alberi di attacco progettazione esecuzione logs Generatore di Attacchi RTU 1 Centro Controllo Regionale RTU 2 Data Base Regionale RTU 3 Piattaforma di esecuzione agenti SAFEGUARD Data Base Nazionale RTU n Centro Controllo Nazionale Local Network

SAFEGUARD Test Environment Objectives To test the funcionalities of the single Agents developed for reducing the vulnerabilities of a single infrastructure To test the overall architecture and information sharing among the different Agents for a single infrastructure To test the different algorithms implemented in low-level Agents (Neural-Network, Case Based Reasoning, Data Mining).

Physical Electric Grid Layer e-Agora Simulator Is simulated by the e-Agora electrical powerflow simulator (AIA). It provides editing capabilities to edit an electrical network model. It calculates the load flow of an electrical network model under all systems conditions. It can work in client-server mode: the algorithms to calculate the load flow reside on the server while the network model resides on the client application.

SCADA Emulator Architecture Control Center (CC) GUI DAC SIA-R-1 SIA-R-2 SIA-R-3 AD

Some examples of functionalities implemented in the SCADA emulator Polling of Tele-Measures (each 4 seconds) Sending of Tele-Commands (opening/closing breakers) Receiving of Tele-Signals All these functionalities generate EVENTS and DATA. They are monitored by the Safeguard System (Instrumentation). Sending malicious attacks to disable a SIA-R Data Sending message to re-start a SIA-R

SCADA Emulator Instrumentation SAFEGUARD System Communication BUS SCADA-SAFEGUARD Data/Events Instrumentation: SCADA  SAFEGUARD Recovery Actions: SAFEGUARD  SCADA

Attack Trees Editor and Scenarios Running Console Attacks/faults Console design attacks or faults in form of tree Generate from a tree all possible scenarios Run a scenario as a timed sequence of malicious actions or faults

COMMUNICATION PROTOCOL IRRIIS Infrastructure Information Sharing LCCI3 MIT 1 LCCI1 Application Server MIT 3 LCCI3 Application Server Interdependency LCCI1 Communication MIT LCCI Business Components COMMUNICATION PROTOCOL MIT IRRIIS MIT 2 LCCI2 Application Server LCCI2 LCCI4 MIT 4 LCCI4 Application Server

IRRIIS MIT Implementation

IRRIIS Test Environment Objectives To test the capabilities of the Middleware Improved Tecnology (MIT) components to exchange fast, reliable and secure information about the state of different infrastructure among the different operators To test information coordination and information sharing between different LCCIs.

IRRIIS Synthetic Simulation Environment

IRRIIS Synthetic Simulation Environment and Services Exchanging between two infrastructures (to study vulnerabilities and interdependency) Electrical Infrastructure Telecomunication Infrastructure Telec. Contr. Centres Telec. Traff. Simulator

IRRIIS Synthetic Simulation Environment Services Exchanging and MIT (to test and validate MIT components) Electrical Infrastructure Telecomunication Infrastructure Telec. Contr. Centres Telec. Traff. Simulator

POSSIBLE RESEARCH AREAS FOR A JOINT EU/US COLLABORATION IRRIIS - WP3.6: International cooperation for benchmarking Objectives Establish an international network for definition of benchmarks Definition of international benchmarks for at least two application areas Comparison of IRRIIS results with results from other projects Suggested Collaboration EU-IRRIIS Project, US-TRUST, US-TCIP works together to define common high quality benchmarks with high practical relevance Constraints to support an international adaptation and wide cooperation it is likely that the benchmarks definitions shall be platform independent.

International Workshop on Complex Network and Infrastructure Protection CNIP06 March 28-29, 2006 - Rome, Italy http://ciip.casaccia.enea.it/cnip06