Segmentation protects from cyberattacks

Abstract—Network segmentation of a power grid’s communication system is one way to make the grid more resilient to cyber attacks. We develop a novel trilevel programming model to optimally segment a grid communication system, taking into account the actions of an information technolology (IT) administrator, attacker, and grid operator. The IT administrator is given an allowance to segment existing networks, and the attacker is given a fixed budget to attack the segmented communication system in an attempt to inflict damage on the grid. Finally, the grid operator is allowed to redispatch the grid after the attack in order to minimize damage. The resulting problem is a trilevel interdiction problem, which we solve by leveraging current research in bilevel branch and bound. We demonstrate the benefits of optimal network segmentation through case studies on the 9-bus WSCC system and the 30-bus IEEE system. These examples illustrate that network segmentation can significantly reduce the threat posed by a cyber attacker with perfect knowledge of the grid.

INTRODUCTION The electric grid, like many infrastructure systems, historically relied on air-gapped and specialized control networks for security. For convenience and cost savings, grid/utility owners are increasingly integrating traditional information technologies (IT) into their control systems. This shift has increased the attack surface for electric grids and has made them more vulnerable to cyber attacks. This was illustrated in the December 2015 cyber attack against the Ukrainian power grid [1]. According to [2], nation-state actors in particular pose a significant threat to cyber-physical systems and also possess the ability to gather the necessary information in advance of attacks. Criminal organizations, terrorists, hackers, and hackivists may also pose a threat to these systems [3].

Network segmentation is one strategy that has been proposed to improve cyber network security [4]. Dividing networks into small segments and restricting communications between segments can limit the scope of attacks and the attackers’ ability to pivot within a network. Several governmental and regulatory agencies have provided guidance that motivates segmentation and offer strategies for implementing it [5], [6], [7], [8]. However, as noted in [9], this guidance tends to provide general design principles and architectures, but not specific recommendations or tools for cyber network designers.

Designing segmentation strategies for cyber-physical systems presents a particularly difficult challenge as it requires consideration of two complex interconnected systems. In an IT setting, segmentation decisions can be made based on business functions and the expected consequences of disruptions to these functions (e.g. interruption to payment systems, loss of customer data). In a grid setting, the cyber and physical layers are connected and distributed over wide areas; coordinated attacks create the potential for consequences that are greater than the sum of their parts. A key recommendation in [3] is the need to “evaluate the potential risk of a coordinated cyberattack on geographically distributed targets.”

In this paper, we explore the use of optimization to identify strategies for segmenting cyber networks. We use an explicit representation of the cyber and grid network layers to capture the interconnected nature of these systems and the resulting impacts of attacks. We also employ trilevel optimization techniques to capture the adaptive nature of and interactions between cyber defenders, attackers, and infrastructure operators. Finally, given the potential capabilities of the attacker, we assume that the attacker has full knowledge of the system when crafting attacks.