POWER September 2013 - 53

CYBERSECURITY
tems were originally designed before communication
networking was commonplace.
Consequently, cybersecurity was of little concern.
In the case of electro-mechanical relays
that still operate on some utilities' systems,
the only potential for system compromise results
from physical access to the relay. Many
design features of digital control systems
enable these systems to be more operatorfriendly
and functional. Digital communication
networking has become an important
cost-saving tool, with many features that allow
it to be used for remote monitoring and
control of critical systems. Consequently,
there is an opportunity where industrial control
systems that use digital communications
networks can be exploited, turning these features
into vulnerabilities.
The presence of control systems within a
system grid is vast and provides substantial
productivity improvements. However, it also
introduces a significant amount of exposure
concerning cyber intrusion and physical security.
Communication protocols used by control
systems and SCADA systems vary based
on the design practices of utilities. The most
common protocols are DNP, Modbus, IEC
60870-5-103, IEC 61850, Telnet, QUIC4/
QUIN, and Cooper 2179. Compromising any
of these protocols would allow the malicious
party to control these systems outside utility
operations.
It is understood that compromising the
protocol is not the only step in gaining control
of a utility's SCADA or control systems
because of the passwords associated with
each piece of equipment. However, compromise
of a communication protocol allows access
to devices and the ability to compromise
their associated passwords.
Such potential cyber intrusion may not call
to mind an AURORA condition, but the cyber
intrusion or physical compromise of control
systems allows for the virtual control of
the physical opening or closing of associated
protective devices that could contribute to an
AURORA condition. Many circuits of utilities
carry varying load profiles, from resistive
to inductive loads. These circuits may include
rotating equipment. This load profile allows
for an AURORA condition to take place, indicating
that AURORA is not as unique or
isolated an incident as might be suggested in
previous discussions or research.
One AURORA Attack Can Affect
Multiple Facilities
An electricity system comprises generation
resources, transmission facilities, distribution
facilities, and participation within an
energy marketplace. In order for marketplace
transactions to take place, a reliable
and secure grid is required for the transfer
September 2013 | POWER
1. One mitigation device. The iGR-933 rotating equipment isolation device (REID) can
be installed and integrated into existing or newer systems. The device is shown here with a
relay staged for installation on a 50-MW gas turbine generator. The REID provides AURORA
protection as the last line of defense for the generator. Courtesy: Steven Brunasso
of energy. If a utility's power grid becomes
compromised by a cybersecurity threat, then
the reliability of operation of that grid is in
question and the interconnection of resources
and execution of market transactions becomes
compromised.
This effect on generation resources, transmission
facilities, and the energy marketplace
goes beyond a utility's system grid to
having an effect on other systems through interconnections
such as flow gates and source/
sinks that make up market agreements and
transactions. Consequently, the cybersecurity
measures one utility takes can affect other
utilities through the various interconnections
that exist. If one utility has a less-robust cybersecurity
response plan than that of other
interconnected utilities, then the interconnected
utilities' cybersecurity response plan
effectiveness could be comprised due to a cyber
intrusion. Therefore, if a cyber intrusion
of one generator or utility's control systems
takes place, then a potential AURORA event
could have an effect on other interconnected
facilities.
How the AURORA Vulnerability
Affects End Users
An AURORA event can affect electricity
customers directly and indirectly. The indirect
impact is AURORA damaging generators,
which can result in loss of load and a
potential grid collapse. The direct impact of
an AURORA event on end users is seldom
understood.
An AURORA event consists of the outof-sync
reconnecting of three-phase rotating
www.powermag.com
equipment. Three-phase equipment includes
not only generators but also synchronous
induction motors. This means that customer
loads in manufacturing facilities, pipelines,
refineries, electrified mass transit, and even
data centers and power plants are directly at
risk from AURORA.
As AURORA can damage or destroy large
equipment, the potential impact on end users
can be extremely large, and the resulting risk
to the utilities that serve these customers can
be significant.
Mitigating AURORA
Mitigation is relatively inexpensive and
straightforward. It entails placing a hardware
device between each substation and its loads.
That device monitors for the rapid out-ofphase
condition associated with an AUORA
event and isolates the substation from its
loads before the torque of the grid can be applied
to the equipment loads.
To date, only two relay protection suppliers
provide an AURORA mitigation device:
Cooper Power Systems, which offers the
iGR-933 Rotating Equipment Isolation Device
(REID, Figure 1), and Schweitzer Engineering
Laboratories, which offers its SEL
751A feeder protection relay (Figure 2).
Implementing the AURORA hardware
mitigation devices should not be a major
undertaking. The devices are the same size
and form factor as many other relay devices.
They are relatively inexpensive (less than a
few thousand dollars each) and have wiring
configurations similar to other relays, minimizing
installation issues. Typically, there
53

http://www.powermag.com

POWER September 2013

Table of Contents for the Digital Edition of POWER September 2013