Advanced Persistent Threats (APTs) are stealthy, multi-step attacks tailored to a specific target. Often described as ’low and slow’, APTs remain undetected until the consequences of the cyber-attack become evident, usually in the form of damage to the physical world, as seen with the Stuxnet attack, or manipulation of an industrial process, as was the case in the Ukraine Power Grid attacks. Given the increasing sophistication and targeted nature of cyber-attacks, especially APTs, this paper delves into the substantial threats APTs pose to critical infrastructures, focusing on power grid substations. Through a detailed case study, we present and explore a 2-stage APT attack on an IEC 61850 power grid substation, employing a Hardware-in-the-Loop (HIL) testbed to simulate real-world conditions. More specifically, this paper discusses two significant experiments conducted to assess vulnerabilities in the control protocols used in IEC 61850 substations: IEC 60870-5-104 and IEC 61850. The integration of findings from these experiments revealed a number of previously undiscussed potential threats to power grid infrastructure that could arise from attacking one or more substations. To better address these potential threats, the paper proposes an extension to the Industrial Control System (ICS) kill chain that explicitly accounts for the consequences of attacks on the physical aspects of Cyber-Physical Systems (CPSs).

Advanced Persistent Threats (APT) are stealthy multi-step attacks, often executed over an extensive time period and tailored for a specific attack target. APTs represent a “low and slow” type of cyberattack, meaning that they most often remain undetected until the consequence of the attack becomes evident. Energy infrastructure, including power grids, oil and gas infrastructure, offshore wind installations, etc., form the basis of a modern digital nation. In addition to loss of power, financial systems, banking systems, digital national services, etc., become non-operational without electricity. Loss of power from an APT cyberattack could result in loss of life and the possibility of creating digital chaos. Digital payments becomes unavailable, digital identification is affected, and even POS terminals need to run on emergency power, which is limited in time, resulting in challenges in paying for food and beverages. Examples of Advanced Persistent Threats (APTs) targeting energy infrastructures include Triton, which in 2017 aimed to manipulate the safety systems of a petrochemical plant in Saudi Arabia, potentially leading to catastrophic physical consequences. Another significant incident is the Industroyer2 malware attack in 2022, which targeted a Ukrainian energy provider in an attempt to disrupt operations. The paper combines APT knowledge with energy infrastructure domain expertise, focusing on technical aspects while at the same time providing perspectives on societal consequences that could result from APTs.

Digital substations, also referred to as modern power grid substations, utilize the IEC 61850 station and process bus in conjunction with IP-based communication. This includes communication with switch yard equipment within the substation as well as the dispatch center. IEC 61850 is a global standard developed to standardize power grid communications, covering multiple communication needs related to modern power grid substations or digital substations. Unlike the legacy communication standards, IEC 60870-5-104 and DNP3, IEC 61850 is specifically designed for IP-based communication. It comprises several communication models and supports real-time communication by introducing the process bus to replace traditional peer-to-peer communication with standard network communication between substation equipment and the switch yard. The process bus, especially Sampled Measured Values (SMV) communication, in modern power grid substations relies on extremely accurate and synchronized time to prevent equipment damage, maintain power grid system balance, and ensure safety. In IEC 61850, time synchronization is provided by the Precision Time Protocol (PTP). This paper discusses the significance and challenges of time synchronization in IEC 61850 substations, particularly those associated with PTP. It presents the results of a controlled experiment that subjects time synchronization and PTP to cyber-attacks and discusses the potential consequences of such attacks. The paper also provides recommendations for potential mitigation strategies. The contribution of this paper is to provide insights and recommendations for enhancing the security of IEC 61850-based substations against cyber-attacks targeting time synchronization. The paper also explores the potential consequences of cyber-attacks and provides recommendations for potential mitigation strategies.

The increasing integration of Industrial Control Systems (ICS) and Cyber-Physical Systems (CPS) with the Internet of Things (IoT) has significantly enhanced their operational efficiency but also exposed them to advanced cyber threats. Traditional cybersecurity approaches, often tailored for IT systems, must address the unique complexities of ICS and CPS environments. This paper systematically reviews the integration of three critical areas: context-based modeling, digital twins, and machine learning (ML), to enhance cybersecurity for ICS and CPS. Context-based modeling provides dynamic, situational awareness; digital twins offer real-time system replicas for monitoring and simulation; and ML delivers predictive and adaptive threat detection and response capabilities. The review synthesizes findings from recent literature to answer four research questions focusing on methodologies in context-based modeling, applications of digital twins and ML in attack detection, and integrating these approaches for improved cyber resilience. The results demonstrate the synergistic potential of combining these technologies, enabling real-time anomaly detection, predictive threat analysis, and adaptive response mechanisms. Challenges such as data limitations, scalability, and verification complexities are vital areas requiring further research. This integrated framework offers a robust pathway for securing critical infrastructure and advancing cybersecurity practices in increasingly interconnected ICS and CPS environments.

Industrial Control Systems (ICS) are increasingly integrated with Information Technology (IT) systems, blending Operational Technology (OT) and IT components. This evolution introduces new cyber-attack risks, necessitating specialized security measures like Intrusion Detection Systems (IDS). This paper presents our work on both developing an experimental protocol and conducting tests of various IDS types in a digital substation hardware in the loop (HIL) testbed, offering insights into their performance in realistic scenarios. Our findings reveal significant variations in IDS effectiveness against industrial-specific cyber-attacks, with IT-specific IDSs struggling to detect certain attacks and changing testlab conditions affecting the assessment of ICS-specific IDSs. The challenges faced in creating valid and reliable evaluation metrics underscore the complexities of replicating operational ICS conditions. This research enhances our understanding of IDS effectiveness in ICS settings and underscores the importance of further experimental research in HIL testlab environments.

Summary: Intelligent automated industrial process control, enabled by IR 4.0 technology, requires increased system integration and connectedness. With such development comes a heightened risk of cyberattack for operational technology (OT) systems, including industrial control systems (ICS) and industrial automation and control systems (IACS), historically shielded from cyberspace. Cyberattacks on OT systems can also impact the physical world. The recent attack on the US Colonial Pipeline interrupted delivery of oil along the US West coast for several days, resulting in a declaration of a state of emergency, while the Ukraine power grid attacks interrupted electrical power supply in Kyiv, impacting thousands of consumers. In 2021, an Equinor-operated platform on the Norwegian Continental shelf was hit by malware. The incident had the potential to affect the drilling control system (DCS). For ICS, the concern is ensuring a safe process, as opposed to the more traditional concern with data protection for information technology (IT) system management. To ensure safe implementation of advanced industrial systems control, while avoiding unnecessary operational downtime, there is a need for cybersecurity solutions that account for risk for the whole cyberphysical system (CPS), including the ICS, the work environment, the product, and the physical surroundings. Diagnostic models and methods must therefore be developed that cover the functionality of the whole CPS. Further, to account for process dynamics and evolving cyberattack threats, adaptability is required with respect to both process state and new types of attacks. For this purpose, knowledge-based awareness monitoring combined with existing cyberattack detection tools for ICS, known as ICS intrusion detection systems (IDS), is proposed, providing an element of artificial intelligence. Results from studies in a DCS environment indicate that existing monitoring applications can be used to detect and discern between different types of cyberattacks on CPSs. This indicates feasibility with respect to monitoring the control and IT components of the ICS system for building risk-based cybersecurity decision support solutions. The key challenge and novelty of the proposed approach is to extend the capability of cybermonitoring in systems control to automated evaluation of process risk, including risk to the physical environment. Such capability will enable appropriate decision support with respect to both process risk and operational downtime.