![](bg3.png)
2.2 SCADA System
Figure 2 includes the picture of SCADA system.
From Wizcon SCADA Control Centre (SCC), the
operator remotely controls in real-time the electrical
grid of figure 1, by means of RTUs.
Particularly, the following devices belong to the
SCADA system:
– MCPT G.W gateway which converts a
proprietary Data Link Communication (DLC)
protocol to the TCP/IP protocol. DLC protocol is
designed for radio channels and allows multiple
logical communication channels per
communication medium. For DLC and TCP/IP
protocols, every transmission is automatically
accompanied by an ACK message, ensuring the
integrity of the transmission.
– Field Interface Unit (FIU MOSCAD), dedicated
to RTU interrogation and routing of data
messages to/from SCC. FIU MOSCAD
comprises a Radio Frequency (RF) Modem
Interface (RF Modem ND), that includes two
VHF radio units (F2, F3), that connect RTUs to
SCC throughout either F2 or F3 channel.
– Store & Forward (S&F) Repeater MOSCAD DN
which communicates upwards with the SCC (via
the RF Modem and FIU) and downwards with
the RTUs using the two RF channels (F1 and
F3).
– RTUs; there are 13 RTUs sites, of which 9
belong to Hanita (TF in figure 1) and 4 to Zuriel
(CB in figure 1).
SCADA system is fully redundant. In case of failure
of the main SCADA unit, the backup SCADA unit is
enabled.
The main communication path between SCC and
the RTUs traverses the main Gateway (MCPT G.W
PRIME) and the main FIU (MOSCAD ND). In case
of failure on the main path, data are rerouted on the
backup path that traverses the backup Gateway
(MCPT G.W SECOND), the backup FIU
(MOSCAD DN), the corporate network (from Point
of Presence ND to Local eXchange DN-VHF),
MOSCAD DN S&F Repeater and then reaches the
RTUs. In case the primary RF channel is not
available for any reason, the system switches to the
alternate RF channel.
2.3 Corporate Network
The portion of corporate network of reference
scenario is also shown in figure 2. It is composed by
three hierarchical layers.
– A Backbone layer, where Point of Presence
(PoP) devices are connected one each other in a
meshed topology (NA, NM and ND devices in
figure 2). Its application is transport, so its
primary concern is capacity. PoP is a
multiservice optical platform that integrates
several technologies including Synchronous
Digital Hierarchy, Synchronous Optical Network
(SDH/SONET) and Dense Wavelength Division
Multiplexing (DWDM) in a single platform.
– A Local eXchange layer (LeX) , the closest one
to customers at the edge of the Transit eXchange
layer, represents the point of access at lower
bandwidth of corporate network. In this layer, IP
traffic, with its inherently bursty, asymmetric,
and unpredictable nature, is predominant,
especially with real-time applications. In figure
2, the following LeX devices: CB, ML, TF, MT,
BL, DN-VHF.
– Between these two layers, lies the Transit
eXchange layer (TeX) that grants scalable traffic
in multi-ring topology. A TeX device is based on
SDH/SONET technology that aggregates data
flows at different bit rate and re transmit them
over long distances. It relies on optical rings
constituted by ADM (Add Drop Multiplexer) and
optical cables. ADMs perform signal
multiplation (they gather many tributary signals
and multiplex them into one signal at higher
rate), transmission over optical fibers and
protection (by rerouting over the SDH ring in
case of a single failure). In figure 2, the
following TeX devices: CR, CR area center, NA
area center.
3 SCADA CYBER SECURITY
Cyber vulnerabilities and attack vectors of SCADA
challenge, day by day, the reliability, resiliency and
safety of the electric grid. For such a reason, a cyber
security protection of SCADA & corporate network
cannot be neglected by electrical grid utilities.
3.1 Vulnerability and Attack Vectors
Vulnerabilities involve computer, communication
(SCADA & corporate networks) and in turn
electrical grids. Attacks can be targeted at specific
systems, subsystems, and multiple locations
simultaneously. Attacks can come from many
places, including indirectly through corporate
network. Possible vulnerabilities and attack vectors
ModellingSCADAandCorporateNetworkofaMediumVoltagePowerGridunderCyberAttacks
125