Introduction to IRRIIS MIT Add-On Components IRRIIS, CRUTIAL & GRID Review Meeting 15 March 2007, Brussels Sandro Bologna

IRRIIS Three Layers Model for the Critical Infrastructure CyberLayer OrganisationalLayer Intra-dependency Inter-dependency PhysicalLayer

IRRIIS Three Layers Model for the Critical Infrastructure Electrical Components generators, transformers, breakers, connecting cables etc Control and supervisory hardware/software components ( Scada/EMS systems ) Electrical Power Operators Independent System Operator for electricity planning and transmission Intra-dependency National Electrical Power Transmission Infrastructure Telecomunication Infrastructure Oil/Gas Transport System Infrastructure Foreign Electrical Transmission Infrastructure Inter-dependency

IRRIIS MIT Introduction MIT is a software system aiming at enhancing the availability and survivability of LCCIs by mitigating dependency and interdependency effects. Communication Components. Add-On Components. Other software resources (Databases,GUI, Configuration Files, Run-Time Environment, etc.)

IRRIIS Control Room with MIT WorkStation LCCI 1 LCCI 2 MIT WorkStation Control Room

IRRIIS MIT integration with existing SCADA systems

IRRIIS MIT integration with existing SCADA systems IRRIIS Inter-LCCI Communication Highway LCCI 1 LCCI 2

IRRIIS Overall MIT architecture

IRRIIS MIT Add-On Components Internal Assessment – Tool to extract LCCI functional status Risk Assessment – Risk Estimator – Incident Knowledge Analyser Emergency Management – Assessment of cascading/escalating effects – Display of Emergency Management Procedures – Negotiator

IRRIIS Risk Estimator functions Reasoning about the states of processes and services, mainly focusing on the services to be exchanged with other LCCIs. Estimating the levels of risks associated to services exchanges with other LCCIs. Working on a service-process model of the LCCIs by making use of a fuzzy rules-based mechanism.

IRRIIS Visualisation of the levels of risks associated to the services LCCI internal state estimation After external & internal states correlation

IRRIIS Risk Estimator workflow and relations with other add-on components ISRIA INPUTS Internal status table External status table Rule Based Correlation Module Current State DB Expert Rules DB IKA Historical status facts GUI DEMP OUTPUTSINTELLIGENCE Rule Editor Maps of Risks Maps of Risks LEGEND IA: Internal Assesment ISR: Information Subscriber & Reader IKA: Incident Knowledge Analyser DEMP: Display of Emergency Management Procedures GUI: Graphical User Interface Estimated State DB

IRRIIS Risk Estimator Benefits Make operators more aware about the global LCCIs state, correlating local LCCI and external LCCIs states. Give to the LCCIs operators schematic pictures evidencing the potential risks to loss internal and external services. Improve coordination between the LCCI operator and the neighbouring LCCIs.

IRRIIS LAMPSSys RTI GUI Logger Tool 1 Electricity Simulator LCCI Data Tlc SCADA Emulator Tool 2 Agent / Scenario Behaviours Analysis 1Analysis 2 Fault / Attack Tool Analysis 3 MIT 1MIT 2 SimCIP Proposed DEMONSTRATION Logic Set up Ele SCADA Emulator Telco Simulator

IRRIIS GUI Logger LAMPSSys RTI Agent / Scenario Behaviours Electricity Simulator Com Simulator LCCI Data Fault / Attack Tool Tool 1 Tool 2 Analysis 1, 2, 3.. SimCIP MIT 1 Electrical LCCI MIT 2 TeleCommunication LCCI Proposed TESTBED Physical Configuration

IRRIIS Roma Mini TELCO Black-out January 2004 Pre-incident TELCO network in secure state Station continue working with decreased battery autonomy Many external Telco services go down, as the ACEA data links between control centers The normal power supply from ACEA was restarted Return to normal state AND Trip of main power supply Loss of power supply Damaged equipment replaced Telco services restart AND NETWORK STATE OVERVIEW & ROOT CAUSES 1 Flood on the apparatus room of the Telco SGT station. UPS start from batteries 2 The battery autonomy finished as Fire Brigate was not able to eliminate water in time. 3 The full functionality of the SGT station is restored 4 hours Safe network state Endangered network state Disturbed network state Collapsed network Event Root cause Legend 90 min.

IRRIIS ACEA Remote control system: an overview Distribution gridTLC toolsOwned byStatus High Voltage  Copper cables  Power line carrier  GSM service Acea Others Complete and working Medium Voltage  GSM  Copper cables Others Advanced, but non yet complete Low Voltage  Power line carrier (1)  GPRS (2) Acea Others Advanced 20% (1)From energy meter to secondary cabin (2)From secondary cabin to control room

IRRIIS Effects on the public telecom network Telecom inter district fixed traffic OFL Overall Failed Load ASR Answer Seizure Ratio

IRRIIS Effects on the ACEA tele-control Centers Data flux A Data flux B FLAMINIA Control Centre Electrical grid 1 Substations directly affected by Telco blackout OSTIENSE Control Centre Electrical grid 2 Substations not directly affected by Telco blackout 9:30:54 Out of service of data flux A 9.32: :00Few number of tele command failures 9.32:15Out of service of data flux B 9.32: :30General tele command failures 9.32: 32 Service restoration of data flux B 9.32: :59General tele command restoration 9.33:01Out of service of data flux B 9.33: :12General tele command failures 9.34: :00Total substations un visibility 9.44: :00Service restoration of some substations in backup mode 10.54:35Service restoration of data flux A 10.54: :29All substations reactivated, many of them in local command operation 10:57:56Service restoration of data flux B Sequence of Events ACEA Control Centers configuration

IRRIIS Roma Mini TELCO Black-out January 2004 Pre-incident TELCO network in secure state Station continue working with decreased battery autonomy Many external Telco services go down, as the ACEA data links between control centers The normal power supply from ACEA was restarted Return to normal state AND Trip of main power supply Loss of power supply Damaged equipment replaced Telco services restart AND NETWORK STATE OVERVIEW & ROOT CAUSES 1 Flood on the apparatus room of the Telco SGT station. UPS start from batteries 2 The battery autonomy finished as Fire Brigate was not able to eliminate water in time. 3 The full functionality of the SGT station is restored 4 hours Safe network state Endangered network state Disturbed network state Collapsed network Event Root cause Legend 90 min. Also before the crisis contingencies, MIT Add-on components could support different LCCIs operators to negotiate possibilities for short term black-outs in case of need.

IRRIIS Roma Mini TELCO Black-out January 2004 Pre-incident TELCO network in secure state Station continue working with decreased battery autonomy Many external Telco services go down, as the ACEA data links between control centers The normal power supply from ACEA was restarted Return to normal state AND Trip of main power supply Loss of power supply Damaged equipment replaced Telco services restart AND NETWORK STATE OVERVIEW & ROOT CAUSES 1 Flood on the apparatus room of the Telco SGT station. UPS start from batteries 2 The battery autonomy finished as Fire Brigate was not able to eliminate water in time. 3 The full functionality of the SGT station is restored 4 hours Safe network state Endangered network state Disturbed network state Collapsed network Event Root cause Legend 90 min. MIT Add-on components could estimate the internal risks associated to possible external services degradation.

IRRIIS Roma Mini TELCO Black-out January 2004 Pre-incident TELCO network in secure state Station continue working with decreased battery autonomy Many external Telco services go down, as the ACEA data links between control centers The normal power supply from ACEA was restarted Return to normal state AND Trip of main power supply Loss of power supply Damaged equipment replaced Telco services restart AND NETWORK STATE OVERVIEW & ROOT CAUSES 1 Flood on the apparatus room of the Telco SGT station. UPS start from batteries 2 The battery autonomy finished as Fire Brigate was not able to eliminate water in time. 3 The full functionality of the SGT station is restored 4 hours Safe network state Endangered network state Disturbed network state Collapsed network Event Root cause Legend 90 min. MIT Add-on components could help the LCCI operator to be more prepared during the black out contingencies.