![](bgc.png)
Table 2: Threat Assessment (Part 2). Notice, the threat category and an exemplary threat are given in the first two columns.
Subsequent columns contain the quantitative and qualitative assessments results for (P)robability and (I)mpact on a scale from
1 to 5 for each threat and per domain.
Threat Category Threat Testpoints Transmission (High/Med.
Voltage)
Transmission (Med./Low
Voltage)
Grid Operation Metering
Authentication / au-
thorisation
Defective or miss-
ing authentication
or inappropri-
ate handling of
authentication data
No authentication between
Automation Front-end and
Testpoint, although the Front-
end authenticates towards the
Primary Subst. Node (PSN);
a spoofing attack could lead
to false data being sent to the
PSN; low impact (suboptimal
supply) (P: 2-3, I: 1)
Due to the relatively low
number of Primary Substation
Nodes accounts or parameters
can be configured and tested
manually, therefore the prob-
ability is lower than in lower
parts of the architecture model
(P: 1-2, I: 4)
Especially relevant for remote
maintenance access points;
Secondary Substation Node
and Concentrator can be easily
accessed mostly, which gives
a high probability; possibly
regional impacts in case of
unauthorized access (P: 4; I:
3)
Access rights management on
SCADA systems implemented
on an individual basis at util-
ities, standard IT technologies
are employed; ”identity spoof-
ing” of calls to EMS; main
threat is exploitation of inse-
cure remote access solutions
(P: 2, I: 4)
The connection between AMI
headend and Smart Meters is
encrypted by utilizing strong
cryptographic primitives
(ECDSA, AES); authenti-
cation and authorization is
realized through certificates;
thus, a high security standard
is expected (P: 1, I: 2)
Cryptography /
Confidentiality
Disclosure of sensi-
tive data
Does not apply since test data
(voltage, frequency) is not
confidential
Current supply data and con-
trol commands are probably
not confidential; consumption
data are aggregated, therefore
low impact (P: 2, I: 1)
Processing of confidential sup-
ply/consumpt. data in Con-
centrator and Secondary Sub-
station Node; medium prob-
ability due to little (physical)
protection (P: 3, I: 3)
For load estimation, consump-
tion and energy production
data is anonymized; power
grid plans and control data is
required to be protected ac-
cordingly (P: 1-2, I: 4)
Relevant since confidential
power consumption data is
processed and stored (P: 1, I:
3)
Integrity / Availabil-
ity
Tampering with de-
vices
Hardly relevant due to physi-
cal access control mechanisms
in place; manipulation via
the communication interface
could be feasible (e.g. chang-
ing the configuration on SD
card); low impact (P: 2, I: 1)
Tampering hardly relevant due
to high voltage, but this may
not hold for malicious insid-
ers; currently strong impact
(outage), but timely mitigation
can be expected (P: 2, I:3)
Tampering possible especially
with Concentrator; rather high
probability due to little (phys-
ical) protection measures; re-
gional impact (P: 3-4, I: 3)
Relevant if direct manipu-
lation by insiders; remote
manipulation over telecontrol
WAN possible; forged process
data may cause malfunction of
DMS and subsequently lead to
grid instability (P: 2, I: 4)
Low relevance due to physical
protection measures (P: 1, I: 3)
Missing / Inad-
equate Security
Controls
Defective or missing
security controls in
networks
Connected to Primary Sub-
station Node via telecontrol
WAN with IEC 60870-5-104
(unencrypted); low impact
(suboptimal supply) (P: 2-3, I:
1)
Especially relevant for the
communication via the tele-
control WAN; probability is
low since security controls in
place are more efficient than
for the components in the
lower parts of the architecture
model (P: 1, I: 1-2)
Especially relevant for Inter-
net/PLC connection to Mid-
dleware and Smart Grid Gate-
way (P: 2-3, I: 3)
Relevant for some interfaces
(telecontrol WAN, EMS link);
link to PSN secured with
IPSec; telecontrol WAN link
to Secondary Subst. Node
could include forged data
causing grid instability; (P: 2,
I: 4)
Especially relevant for the in-
terfaces to the outside world
(i.e. connection to concentra-
tors) (P: 1, I: 2)
Internal / External
Interfaces
Illegal logical inter-
faces
Relevant for unauthorized ac-
cess via telecontrol WAN; a
DoS-attack on the Primary
Substation Node could lead
to generation plants going
offline, resulting in voltage
drops (P: 2, I: 2-3)
Relevant for access via tele-
control WAN (P: 2, I: 4)
Relevant for access via tele-
control WAN (P: 2, I: 4)
Relevant due to unauthorized
access over external inter-
faces: telecontrol-WAN (Au-
tomation Headend), Webser-
vice (EMS), Remote Access
(SCADA) depending on de-
ployed technologies (P: 2, I: 4)
Due to illicit logical interface
(e.g. due to a successful at-
tack) a connection from the
metering system over the mid-
dleware to the grid operation
system is feasible (P: 1, I: 3)
Maintenance / Sys-
tem Status
Operation of unreg-
istered or insecure
components or com-
ponents with overly
broad range of func-
tions
Unregistered components
hardly relevant (physical ac-
cess control); an overly broad
range of functions possible
despite on-site maintenance
(mostly no remote mainte-
nance); low impact (P: 1-2, I:
1)
Unregistered components
hardly relevant due to physical
access control; an overly
broad range of functions
possible; low probability due
to highly specialized com-
ponents (compared to home
area) (P: 1, I: 2-3)
Due to easy accessibility of the
substations unregistered com-
ponents could be installed; re-
gional impacts (P: 3-4, I: 3-4)
Unregistered components are
of low relevance due to phys-
ical access protection; unused
but active system functional-
ities are relevant, especially
considering remote access or
support interfaces for manu-
facturers (P: 2-3, I: 4)
Unused but active system
functionalities in the AMI
headend lead to an increased
attack surface (P: 2, I: 2)
SMARTGREENS2014-3rdInternationalConferenceonSmartGridsandGreenITSystems
42