INFORMATION SECURITY IN POWER DISTRIBUTION:

A CASE STUDY

Dr. Vivek Chandra, Head IT, MPPKVVCL, Jabalpur

Dr. Ashok Kumar Tiwari, EE (RAPDRP) , MPPKVVCL, Jabalpur

“..the only reliable way to measure security is to examine how it fails”

--Bruce Schneider, Beyond Fear.

1. Introduction: With the launch by Remote access, Spoofing by

and advancement of R-APDRP Intruders and Defacement of Govt.
Program in the Distribution Companies Websites etc.
across the country, there has been a
creation of sizable amount of IT This paper aims at analyzing the
Infrastructure. Huge information is Information Security needs of the
being created and disseminated across Distribution Companies (Discoms) in
the organization and beyond, among its India and a case study how the same is
stakeholders. In creating and being adopted by MP Poorv Kshetra
maintaining such information store- Vidyut Vitaran Co. Ltd, Jabalpur
house within the organization, it is (MPPKVVCL), a discom which carries
absolutely essential to maintain and out Power Distribution in the eastern part
practice an effective Information of the state of MP, with headquarter at
Security Policy (ISP) to ensure stringent Jabalpur.
safety measures. The measures should
ensure confidentiality, integrity and 2. IT Architecture prior to R-APDRP:
availability of information so that each
piece of information is protected in a MPPKVVCL was formed after the
manner that is consistent with the value unbundling of erstwhile MP State
attributed to it, the risk the utility is Electricity Board) in July’02. The
willing to accept and the cost the utility Company has been using information
is willing to pay. In this regard the and communication (ICT) tools (most of
Govt. of India has also issued which have been inherited from the MP
instructions to PSUs to counter State Electricity Board) since its
vulnerabilities in Computer inception. The major applications
Systems/Networks based on the deployed include Consumer Bill
Intelligence Bureau Communiqué that Generation System, Financial
covers Physical Theft of Computer Accounting System, Stores Management
Hardware that contains sensitive data, System and Payroll System.
Data Compromise, Information Stealing

1
 Figure 1: Standalone IT Systems in
MPPKVVCL prior to R-APDRP

These systems are used within shall also pave way for vulnerability of
departments and in isolation and are the system to cyber attacks and other
based on de-centralized architecture, security issues.
therefore the information desired at the
Company level had to be further 3. Applications & Infrastructure in R-
compiled. Huge efforts were required APDRP:-
in punching and compilation of data.
This also resulted in delayed MIS and Applications:-
the system was also prone to manual
errors and manipulations. Part-A : Essentially Required by
most Utilities for setting up an IT
Table 1:- Details of the Applications backbone for collection of baseline
deployed, their architecture & data, Energy Accounting / Auditing
locations and establishment of Customer care
centers:-
Office No.
S Name of
N Application
Arch. where of  Meter Data Acquisition
deployed locs.
1 Billing Dist. RAO 6
 Energy Audit
System (HT) Nos.  New Connection
2 Billing Dist. Circle/Dn 29  Disconnection & Dismantling
System(LT) Nos.  GIS Based Consumer Indexing &
3 Stores Dist. Area 5 Asset Mapping
Management Stores Nos.
System
 Centralized Consumer Care
4 Financial Dist. RAO 6 Centre
Accounting Nos.  Management Information
System System.
5 Payroll Dist. RAO 6
System Nos. Part-B: Implementation of
Commercial Processes like Metering,
A shift to Centralized Architecture with Billing, Collection.
huge communication network would
help in getting rid of above issues but it
2
  Development of Commercial 4. Security Threats in a Centralized
Database of Consumers Architecture:
 Metering
 Billing 4.1 Origination of Threats:
 Collection Security threats can come from two
Part-C – Other Optional Application locations:
Packages
 External users
 Maintenance Management
 Asset Management  Internal Users
4.1.1 External users: An
Proposed Infrastructure: external security threat occurs when
someone outside your network creates
 The scope covers setting up of IT a security threat to your network. If one
infrastructure at data center & is using an intrusion-detection system
DR Center, Call centers and other (IDS), which detects attacks as they
offices of utility, which would occur, one will probably be mildly
form the platform for subsequent shocked at the number of probes and
development. attacks that occur against the
 Setup of LAN at datacenter, network daily.
Customer care centers, Sub
division, division, Circle, Head 4.1.2 Internal users: An
Quarter and any other office of internal security threat occurs when
the utility as per their someone from inside
requirement. your network creates a security threat to
 Creation of VPN/ MPLS based your network. The fact is that the biggest
WAN for connecting all offices threat to an organization lies within its
in the select 27 towns in the boundaries.
Discom.

An effective network security strategy

requires identifying threats and then
choosing the most effective set of tools
to combat them.

Figure 2: Network Topology with a

Centralized Architecture in R-APDRP
3
 In its 2006 survey, “Information person and asking for people's
Security Breaches,” the DTI and passwords.
PricewaterhouseCoopers found that 32%
of Information Security attacks 5. Security Features at various levels:-
originated from internal employees while
28% came from ex-employees and Security Features have been detailed at
partners[1]. three levels namely at Data Centre level,
Some of these security breaches were at Network level and at End User Level.
malicious in intent; others were
accidental. Therefore, one should not 5.1 Data Centre Security:
just be concerned about protecting the
perimeter of your network; one should A data center is a facility used to house
also aim to protect every key resource computer systems and associated
and service. components, such as telecommunications
and storage systems. It generally
4.2 Types of Threats: includes redundant or backup power
supplies, redundant data communications
4.21 Viruses: They are Computer connections, environmental controls
programs written by devious (e.g., air conditioning, fire suppression)
programmers and designed to replicate and security devices.
themselves and infect computers when IT operations are a crucial aspect of most
triggered by a specific event. organizational operations. One of the
main concerns is business continuity;
companies rely on their information
4.22 Trojan horse programs: Delivery systems to run their operations. If a
vehicles for destructive code, which system becomes unavailable, company
appear to be harmless or a useful operations may be impaired or stopped
software programs such as games. completely. It is necessary to provide a
reliable infrastructure for IT operations,
in order to minimize any chance of
4.23 Attacks: Including reconnaissance disruption. Information security is also a
attacks (information-gathering activities concern, and for this reason a data center
to collect data that is later used to has to offer a secure environment which
compromise networks); access attacks minimizes the chances of a security
(which exploit network vulnerabilities in breach. A data center must therefore
order to gain entry to e-mail, databases, keep high standards for assuring the
or the corporate network); and denial-of- integrity and functionality of its hosted
service attacks (which prevent access to computer environment. This is
part or all of a computer system) accomplished through redundancy of
Data interception : Involves both fiber optic cables and power, which
eavesdropping on communications or includes emergency backup power
altering data packets being transmitted. generation.
5.1.1 Redundant Power Supply:
4.24 Social Engineering: Obtaining Backup power consists of one or
confidential network security more uninterruptible power supplies,
information through nontechnical means, battery banks, and/or diesel generators.
such as posing as a technical support

4
To prevent single points of failure, all on networks running the IP protocol
elements of the electrical systems, suite. Data centers contain a set
including backup systems, are typically of routers and switches that transport
fully duplicated, and critical servers are traffic between the servers and the
connected to both the sides of power outside world. Redundancy of the
feeds. This arrangement is often made to Internet connection is often provided by
achieve N+1 redundancy in the systems. using two or more upstream service
Static switches are sometimes used to providers.
ensure instantaneous switchover from Some of the servers at the data center are
one supply to the other in the event of a used for running the
power failure. basic Internet and intranet services
5.1.2 Physical Security: Physical needed by internal users in the
security also plays a large role with data organization, e.g., e-mail servers, proxy
centers. Physical access to the site is servers, and DNS servers.
usually restricted to selected personnel.
Closed Circuit Camera, surveillance and Network security elements usually
permanent security guards have become deployed are: firewalls, VPN gateways,
a must. The use of Identity Access Cards intrusion detection systems, etc. Also
and biometric devices like finger print common are monitoring systems for the
recognition and iris identification network and some of the applications.
systems are fast gaining popularity. Additional off site monitoring systems
5.1.3 Protection from Fire & Smoke:- are also typical, in case of a failure of
communications inside the data center.
Data centers feature fire protection
systems, including passive and active 5.2 Network Security:
design elements, as well as
implementation of fire prevention In the field of networking, the area
programs in operations. Smoke detectors of network security [2] consists of the
are usually installed to provide early provisions and policies adopted by
warning of a developing fire by detecting the network administrator to prevent and
particles generated by smoldering monitor unauthorized access, misuse,
components prior to the development of modification, or denial of the computer
flame. This allows investigation, network and network-accessible
interruption of power, and manual fire resources. Network security involves the
suppression using hand held fire authorization of access to data in a
extinguishers before the fire grows to a network, which is controlled by the
large size. A fire sprinkler system is network administrator. Users choose or
often provided to control a full scale fire, are assigned an ID and password or other
if it develops. Passive fire protection authenticating information that allows
elements include the installation of fire them access to information and programs
walls around the data center, so a fire within their authority. Network security
can be restricted to a portion of the covers a variety of computer networks,
facility for a limited time in the event of both public and private, that are used in
the failure of the active fire protection everyday jobs conducting transactions
systems. and communications among businesses,
5.14 Communication in Data Centre: government agencies and individuals.
Communications in data centers today Networks can be private, such as within
are most often based a company, and others which might be

5
open to public access. It secures the Honeypots, essentially decoy network-
network, as well as protecting and accessible resources, may be deployed in
overseeing operations being done. The a network as surveillance and early-
most common and simple way of warning tools, as the honeypots are not
protecting a network resource is by normally accessed for legitimate
assigning it a unique name and a purposes. Techniques used by the
corresponding password. attackers that attempt to compromise
Network security starts these decoy resources are studied during
with authenticating the user, commonly and after an attack to keep an eye on
with a username and a password. Since new exploitation techniques. Such
this requires just one detail analysis may be used to further tighten
authenticating the user name — i.e. the security of the actual network being
password, which is something the user protected by the honeypot.[5]
'knows'— this is sometimes termed one-
factor authentication. With two-factor Provisions in R-APDRP
authentication, something the user 'has'
is also used (e.g. a security token or  A strong firewall and proxy to
'dongle', an ATM card, or a mobile keep unwanted people out.
phone); and with three-factor  Strong antivirus software and
authentication, something the user 'is' is Internet Security Software suites.
also used (e.g. a fingerprint or retinal
 Strong encryption.
scan).
 White list authorized wireless
Once authenticated, a firewall enforces connection, block all else.
access policies such as what services are  All network hardware is in secure
allowed to be accessed by the network zones.
users.[2] Though effective to prevent  All hosts should be on a private
unauthorized access, this component network that is invisible from the
may fail to check potentially harmful outside.
content such as computer  Host web servers in a DMZ, or a
worms or Trojans being transmitted over firewall from the outside and from
the network. Anti-virus software or the inside.
an intrusion prevention
[3]  Security fencing to mark
system (IPS) help detect and inhibit the
perimeter and set wireless range to
action of such malware. An anomaly-
this.
based intrusion detection system may
also monitor the network and traffic for
5.3 Security at End User Side:
unexpected (i.e. suspicious) content or
behavior and other anomalies to protect
Identity Access Management: These
resources, e.g. from denial of
services help to identify users and
service attacks or an employee accessing
control their activities and transactions
files at strange times. Individual events
on the network. Services include
occurring on the network may be logged
passwords, digital certificates, and
for audit purposes and for later high-
digital authentication keys. User ID is
level analysis.
being used as single point authentication
Communication between two hosts using target.
a network may be encrypted to maintain
privacy.

6
Blocking use of CD Drives and Pen 7. Reference
Drives: To minimize the likelihood of
Virus entering into system. 1. http://www.net-
security.org/article.php?id=959
Antivirus software packages: These 2. Simmonds, A; Sandilands, P; van
packages counter most virus threats if Ekert, L (2004). "An Ontology
regularly updated and correctly for Network Security Attacks".
maintained. Lecture Notes in Computer
Science. Lecture Notes in
6. Conclusion:- The analysis shows that Computer Science 3285: 317–
large measures have been taken by 323. doi:10.1007/978-3-540-
MPPKVVCL to ensure Information 30176-9_41. ISBN 978-3-540-
Security of the IT System. Although 23659-7.
management of the security tools would 3. A Role-Based Trusted Network
be a challenge keeping in view the Provides Pervasive Security and
limited resources and shortage of Compliance - interview with
manpower but if the same is attained, the Jayshree Ullal, senior VP of
Centralized Architecture established Cisco
through R-APDRP would prove to be a 4. Dave Dittrich, Network
panacea to most of the woes presently monitoring/Intrusion Detection
being faced by the Company because of Systems (IDS), University of
the distributed IT architecture it has at Washington
present. 5. "Honeypots, Honeynets".
Honeypots.net. 2007-05-26.
Retrieved 2011-12-09.

7
About the authors: National/International Journals and
Seminars.
Dr. VIVEK CHANDRA
Dr. ASHOK KUMAR TIWARI
Dr. Chandra is B.E. (Electricals),
M.Tech (IT) and Ph.D. in Computer Dr. Tiwari is B.E.(Electrical Engg.),
Science. He did EDP from IIM- MBA and Ph.D. in Energy Management.
Ahmedabad. He has around 22 years of He did EDP from IIT-Delhi and IIM-
experience in power distribution and Calcutta. He has around 22 years of
automation. He is currently posted at experience in power transmission and
M.P. Poorv Kshetra Vidyut Vitaran Co. distribution and is presently working at
Ltd., Jabalpur as Head (IT) and involved M.P. Poorv Kshetra Vidyut Vitaran Co.
in the planning and development of IT Ltd., Jabalpur as Executive Engineer. He
systems for Power Distribution has also acquired training in SCADA
automation and reforms. He has also and DMS systems at ESCI Hyderabad.
acquired training in GIS at ESCI He is presently looking after Distribution
Hyderabad. He is presently looking after SCADA Project being implemented in
implementation of the prestigious R- Jabalpur City. He has authored two
APDRP and ERP Projects in the books, one book chapter and more than
Discom. He has authored a book on 32 research papers in reputed Journals
Information Security and has over 30 and Seminars.
research papers published in reputed