Question below.

Question

Infrastructure Security Scenario 1

You are in charge of planning and implementing a security system for a new electrical substation that will be built next to a new housing development. The substation is equipped with high-voltage electrical switching gear for the surrounding community. It is not manned on a full-time basis but does have a control building that houses instrumentation and communication equipment, as shown in Figure 1.1.

Diagram of an electrical substation with a control building that houses instrumentation and communication equipment, and is equipped with high-voltage electrical switching gear for the surrounding community.

FIGURE 1.1 The Electrical Substation

The high-voltage switch gear accepts electrical power from different sources, which it then conditions and routes to the community users as needed. The energy arrives on a set of different high-voltage supply lines and leaves the facility via different sets of distribution lines.

The monitoring devices and control systems in the substation communicate with different parts of the utility’s transmission and distribution system to route electrical power where and when it is needed. These communication channels include wireless radio signals, signals transmitted across the power lines, and traditional network communications media.

Risk Assessment 1

From the information provided in this first scenario, consider the National Institute of Standards and Technology (NIST) functions detailed in this section and then record your observations as they relate to each category.

Identify

Create an inventory of physical assets (devices and systems) within the substation (NIST ID.AM-1).

Protect

Describe in general how you might go about protecting the physical assets identified in the previous point (NIST PR.AC-2).

Detect

How would you know if someone or something was attempting to access, disable, degrade, or destroy one or more of the devices and/or systems in the substation? How could you detect anomalies and events that might impact the operation of the substation (NIST DE.CM-2, 8)?

Respond

How would you need to respond to the anomalies and events you’ve identified through the devices, systems, and steps you would implement in the previous point (NIST RS.AN-1, 2, 3)?

Recover

Which steps could be put in place to recover from actions intended to access, disable, degrade, or destroy the assets you previously identified (NIST RC.RP-1)?

Answer 1

IDENTIFY — ID.AM-1: Physical Asset Inventory

High-voltage switching gear and associated bus infrastructure; power line carrier communication equipment; wireless radio transceivers; SCADA/ICS instrumentation and sensors; control building servers and workstations; network switches, routers, and communication media terminations; uninterruptible power supplies and backup generation; physical access control hardware (locks, gates, fencing); metering equipment; and environmental monitoring devices (temperature, humidity, intrusion sensors).

PROTECT — PR.AC-2: Physical Access Protection

The substation perimeter should be secured with chain-link or anti-climb fencing topped with barbed wire, with a single controlled vehicle entry point. The control building requires keycard or key-fob access with audit logging. High-value equipment enclosures should have secondary locks. Lighting covering all perimeter and entry points deters opportunistic access. Warning signage (high voltage, no trespassing) establishes legal standing and deters casual intrusion. Cable conduits and communication lines should be buried or armored where exposed. Tamper-evident seals on critical equipment enclosures provide physical evidence of interference.

DETECT — DE.CM-2, DE.CM-8

Perimeter intrusion detection via motion-activated cameras with remote monitoring feeds to the utility's operations center. Door and gate contact sensors on all entry points with alarms tied to a central monitoring system. Vibration or shock sensors on equipment enclosures to flag tampering. Power line carrier and wireless communication channels should be monitored for anomalous signal patterns that could indicate jamming or spoofing. Network traffic monitoring on the control system LAN for unexpected connections or protocol anomalies. Environmental sensors (smoke, temperature spikes) that could indicate equipment damage or fire resulting from sabotage.

RESPOND — RS.AN-1, 2, 3

Upon alert, the operations center verifies the event through camera feeds before dispatching. A tiered response protocol applies: low-priority alerts (single sensor trigger, no visual confirmation) generate a logged ticket and scheduled inspection; high-priority alerts (confirmed visual intrusion, multiple sensor triggers, or communication anomaly) generate an immediate dispatch of security personnel and notification to the utility's incident response team. Law enforcement is contacted for confirmed physical intrusion. For communication or SCADA anomalies, the network segment is isolated and manual control procedures are activated. All events are logged with timestamps, sensor data, and personnel actions for post-incident analysis.

RECOVER — RC.RP-1

A documented recovery plan should include: pre-positioned spare components for critical instrumentation (fuses, communication cards, sensors); vendor support contacts and SLAs for switching gear repair; backup communication paths (if primary wireless is disrupted, fall back to landline or cellular); manual switching procedures that allow operators to restore power routing without SCADA if control systems are compromised; and a tested backup configuration for control building servers so systems can be restored from a known-good state. After any incident, a lessons-learned review updates the recovery plan and asset inventory as needed.

Answer 2

Identify

NIST ID.AM-1 – Inventory of physical assets (devices and systems)

To create an inventory of physical assets in the substation, list and categorize all components by type and function:

Physical Assets Inventory:

1. High-voltage electrical switching gear
2. High-voltage supply and distribution lines
3. Transformers and circuit breakers
4. Control building
5. Instrumentation panels
6. Programmable Logic Controllers (PLCs)
7. Communication equipment:
8. Radio antennas and wireless transmitters
9. Power line communication modules
10. Ethernet/network switches
11. Video surveillance (if present)
12. Physical access control systems (locks, gates, badge readers)
13. Backup power systems (generators, batteries)
14. Environmental systems (HVAC, smoke detectors)

Each asset should be tagged with location, function, connectivity (if applicable), and criticality to operations.

Protect

NIST PR.AC-2 – Physical access control management

To protect these assets:

Physical Security Measures:

1. Fencing and Perimeter Control: Install a secure perimeter with anti-climb fencing, motion-detecting floodlights, and signage indicating restricted access.
2. Access Control: Use badge readers or biometric scanners at entry points to the control building. Maintain logs of all personnel entries.
3. Locks and Secured Enclosures: Lock all cabinets, breaker panels, and communication hubs.
4. Surveillance: Deploy CCTV cameras at key points (entry gates, control room, switchgear area).
5. Visitor Management: Require visitor sign-ins and escorts. Keep logs for auditing.
6. Cybersecurity Protections:
7. Configure firewalls on all network-connected devices.
8. Implement role-based access control (RBAC) on SCADA systems and PLCs.
9. Regularly patch and update all software/firmware.

Detect

NIST DE.CM-2, DE.CM-8 – Detection of anomalies and events

To identify unauthorized access or damage to systems:

Detection Strategies:

1. Intrusion Detection Systems (IDS): Deploy both physical intrusion detection (motion sensors, contact alarms) and network-based IDS to monitor communication traffic.
2. Log Monitoring:
3. Monitor logs from physical access systems.
4. Monitor authentication logs for communication/control systems.
5. Environmental Sensors: Use temperature and smoke detectors to identify signs of fire or equipment failure.
6. Anomaly Detection Software:
7. Monitor traffic across the substation’s network and power lines for irregular patterns.
8. Use AI-based monitoring to flag abnormal control commands or data reporting from field devices.
9. Visual Surveillance Monitoring: Use AI-assisted camera analytics to detect unusual movements.

Respond

NIST RS.AN-1, RS.AN-2, RS.AN-3 – Response analysis and coordination

Response Measures:

1. Incident Response Plan (IRP):
2. Establish predefined steps for power system operators and IT/cybersecurity teams.
3. Assign roles and communication lines for emergencies (e.g., contacting local law enforcement, internal response team).
4. Containment Actions:
5. Physically isolate affected systems (e.g., disable switchgear remotely).
6. Isolate compromised network segments or communication channels.
7. Analysis Tools:
8. Perform forensics on logs, surveillance footage, and network captures.
9. Communication:
10. Notify utility leadership and regulatory bodies as required.
11. Update the public only if necessary (e.g., outage or safety risk).

Recover

NIST RC.RP-1 – Recovery planning

Recovery Steps:

1. Disaster Recovery Plan (DRP):
2. Restore communications and control systems from clean, validated backups.
3. Document step-by-step recovery for both cyber and physical failures.
4. Redundancy Planning:
5. Use redundant network paths and backup control systems to minimize downtime.
6. Physical Repairs:
7. Maintain spare parts inventory for key components (switches, breakers, PLCs).
8. Have pre-arranged contractor support for emergency physical repairs.
9. Post-Incident Review:
10. Conduct a lessons-learned session and update plans based on findings.
11. Adjust asset inventory and threat models as needed.