Research Challenges for the Security of Control Systems

Alvaro A. Cárdenas Saurabh Amin Shankar Sastry

University of California, Berkeley

Abstract
In this paper we attempt to answer two questions: (1) Why
should we be interested in the security of control systems?
And (2) What are the new and fundamentally different re-
quirements and problems for the security of control systems?
We also propose a new mathematical framework to analyze
attacks against control systems. Within this framework we
formulate specific research problems to (1) detect attacks,
and (2) survive attacks.

1 Introduction Figure 1. Architecture of control systems.

Control systems are computer-based systems that moni-

tor and control physical processes. These systems represent the core of health-care devices, weapons systems, and trans-
a wide variety of networked information technology (IT) sys- portation management. The disruption of these control sys-
tems connected to the physical world. Depending on the ap- tems could have a significant impact on public health, safety
plication, these control systems are also called Process Con- and lead to large economic losses.
trol Systems (PCS), Supervisory Control and Data Aquisi-
tion (SCADA) systems (in industrial control or in the con- 2 Analysis of the Secure Control Problem
trol of the critical infrastructures), or Cyber-Physical Sys-
tems (CPS) (to refer to embedded sensor and actuator net- 2.1 New Vulnerabilities and New Threats
works).
Control systems are usually composed of a set of net- Control systems have been at the core of critical infras-
worked agents, consisting of: sensors, actuators, control pro- tructures and industrial plants for many decades, and yet,
cessing units, and communication devices. Most industrial there have been very few confirmed cases of cyberattacks.
control systems have a hierarchical structure. Control systems, however, are more vulnerable now than be-
Figure 1 shows a common network architecture: In the fore to computer vulnerabilities for many reasons:
first layer the physical infrastructure is instrumented with Controllers are computers. Most of the original physi-
sensors and actuators. These field devices are connected via a cal controls (traditionally conformed of a logic of electrome-
field area network to programmable logic controllers (PLCs) chanical relays) have been replaced by microprocessors and
or remote terminal units (RTUs), which in turn implement embedded operating systems. These controllers may provide
local control actions (regulatory control). A control network many functionalities, such as flexible configuration via a web
carries real-time data between process controllers and oper- server, and digital communication capabilities that allow re-
ator workstations. The workstations are used in area super- mote access and control. The increased complexity of the
visory control, planning the physical infrastructure setpoints. software base may also increase implementation flaws (soft-
The higher level is the site manufacturing operations, which ware bugs).
is in charge of production control, optimizing the process, Networked. Control systems are not only remotely acces-
and keeping a process history. sible, but increasingly –for efficiency reasons– they are be-
Several control applications can be labeled as safety- ing connected to corporate networks and the Internet. Even
critical: their failure can cause irreparable harm to the phys- control systems designed to be closed may, in practice, not
ical system being controlled and to the people who depend be perfectly isolated: connectivity through uncontrolled con-
on it. SCADA systems, in particular, perform vital functions nections can occur in many ways (e.g., via mobile devices).
in national critical infrastructures, such as electric power dis- Similarly, Internet-connected embedded devices (including
tribution, oil and natural gas distribution, water and waste- CPS) are expected to be the largest contributors to the growth
water treatment, and transportation systems. They are also at of the Internet in future years [18], and are expected to have
major technical, economic and societal impact. The security this attack was very slow and the attacker managed to launch
challenges of CPS will become more severe as the scale and 46 reported attacks until he was caught. At the beginning,
scope of the Internet grows. the sewage system operators thought there was a leak in the
Commodity IT solutions. Although in the past control pipes. Then they observed that valves were opening with-
systems were generally made up of proprietary software and out being commanded to do so, but they did not think it was
hardware components, today many control systems employ an attack. It was only after months of logging that they dis-
commodity IT systems; such as, off-the-shelf Windows com- covered that spoofed controllers were activating the valves,
puters, TCP/IP networking etc. Consequently, control sys- and it took even more time to find the culprit: a disgruntled
tems inherit the vulnerabilities of these components. ex-employee of the contractor company that had installed the
Open design. Increasingly, even protocols that are unique control system originally and who was trying to convince the
to control systems are now more open and more accessible, water treatment company to hire him to solve the problem.
therefore it is easier for an attacker to obtain the necessary There have been other recorded attacks to control systems.
knowledge to attack the system. This point is, however, con- For example, in 2000 the Interior Ministry of Russia reported
troversial: security professionals generally argue that open that hackers had seized temporary control of the system reg-
design is preferable because they can find and fix bugs more ulating gas flows in natural gas pipelines (it is not publicly
easily. The debate between open design and closed design is known if there was physical damage) [25]. The former So-
an active one [1]. viet Union was victim of another attack to their gas pipeline
Increasing size and functionality. Wireless sensor net- infrastructure in 1982 when a logic bomb caused an explo-
works and actuators are allowing industrial control systems sion in Siberia [26].
to instrument and monitor larger number of events and op- There are also several recent attacks. In 2008 a teenager
erations. Some infrastructures are also changing to provide in Poland used a modified TV remote control to control
new functionalities, such as the Smart Grid program [6]. It is the switch tracks of trams. There were four derailments
a standard security concern that new functionalities may give and twelve resultant injuries [21]. Also, in 2008, a senior
rise to new vulnerabilities. analyst for the CIA mentioned that there was evidence of
Large and highly skilled IT global workforce. Larger computer intrusions into some European power utilities fol-
groups of people can now find and generate attack vectors lowed by extortion demands [11]. Attacking SCADA sys-
for computer-based systems. tems for extortion is not new. Physical attacks –for extortion
Cybercrime. Less computer-skilled people also have ac- and terrorism– are a reality in some countries [24]. Cyber-
cess to a number attack tools and cybercrime networks. A attacks are a natural progression to physical attacks: they are
driving factor for the interest of cybercrime in control sys- cheaper, less risky for the attacker, are not constrained by
tems is extortion. distance, and are easier to replicate and to coordinate.
Besides attacks to deployed systems, there have been nu-
2.2 Vulnerabilities can be Exploited merous studies and experiments showing the vulnerabilities
In the previous section we presented a high-level descrip- of control systems. On March 2007, researchers at Idaho
tion of the reason why current control systems are now more National Laboratories investigated the results of a possible
vulnerable than before. In this section we discuss some spe- cyber attack directed against a power network. The “Aurora
cific events showing that the threat to control systems is real. Generator Test” demonstrated the ability of a cyber attack
While there has been some reported indirect attacks to con- to damage a power generator turbine [22]. Similarly, most
trol systems –mostly the side-effects of worms– in this sec- available penetration testing reports show how easy it is to
tion we concentrate on intentional attacks. obtain access to computers controlling our physical infras-
The most well-known computer security incident in tructures, [10, 12].
SCADA systems is the attack on Maroochy Shire Council’s Researchers also demonstrated the vulnerability of em-
sewage control system in Queensland, Australia [28]. On bedded CPS. In a recent example, Halperin et al. [13] showed
January 2000, almost immediately after the control system radio attacks to implantable cardioverter defibrillators. These
for the sewage plant was installed by a contractor company, attacks could compromise patient safety and privacy.
the plant experienced a series of problems. These problems Also, new security audits are starting to reveal the vulner-
continued for the next four months: pumps were not run- ability of major critical infrastructures. In a recent security
ning when needed, alarms were not being reported, and there audit, the Tennessee e Valley Authority (TVA), the nation’s
was a loss of communications between the control center and largest public power company, was found to be vulnerable to
the pumping stations. These problems caused the flooding cyber attacks that could sabotage their control systems [9].
of the grounds of a nearby hotel, a park, and a river with There is also an increase in awareness on the vulnerabil-
a million liters of sewage. One of the insights in analyz- ity of SCADA protocols. Security venues such as DEFCON,
ing this attack, is that cyberattacks may be unusually hard Blackhat, and RSA have recently included SCADA presen-
to detect (compared to physical attacks). The response to tations to discuss possible attack vectors. The presentations

2
have shown implementation vulnerabilities that allow attack- intrusion and implement response strategies; and (4) sustain
ers to execute arbitrary code in specific SCADA protocols. security improvements.
This new awareness prompted US-CERT and CERT/CC to The use of wireless sensor networks in SCADA systems
start processing and issuing vulnerabilities on SCADA sys- is becoming pervasive, and thus we also need to study their
tems beginning 2006. security. A number of companies have teamed up to bring
sensor networks in the field of process control systems, and
2.3 Consequences of an Attack currently, there are two working groups to standardize their
communications [14,17]. Their wireless communication pro-
To our knowledge there has not been a publicly-available posal has options to configure hop-by-hop and end-to-end
objective analysis of the possible consequences to attacks confidentiality and integrity mechanisms. Similarly they pro-
against critical infrastructures. In our view, while some of vide the necessary protocols for access control and key man-
the reports on SCADA security might appear overly alarmist agement.
(safety safeguards in most control systems might prevent ma- All these efforts have essentially three goals: (1) create
jor catastrophes), the fact that a user is able to obtain unau- awareness of security issues with control systems, (2) help
thorized privileges in a control system should be taken seri- control systems operators and IT security officers design a se-
ously. curity policy, and (3) recommend basic security mechanisms
The Maroochy Shire incident showed some of the effects for prevention (authentication, access controls, etc), detec-
that attacks can have. We believe that an important direc- tion, and response to security breaches. These recommenda-
tion for future research is on identifying the risks and conse- tions and standards have not considered technical details of
quences of a successful attack. the new research problems that arise when control systems
are under attack.
2.4 Efforts for securing control systems
2.5 Differences
Up to now, most of the effort for protecting control sys-
tems (and in particular SCADA) has focused on reliability While it is clear that the security of control systems has
(the protection of the system against random faults). There become an active area in recent years, we believe that, so far,
is, however, an urgent growing concern for protecting control no one has been able to articulate what is new and funda-
systems against malicious cyberattacks [2, 7, 8, 31, 32]. mentally different in this field from a research point of view
There are several industrial and government-led efforts to compared to traditional IT security.
improve the security of control systems. Several sectors – In this paper we would like to start this discussion by
including chemical, oil and gas, and water– are currently summarizing some previously identified differences and by
developing programs for securing their infrastructure. The proposing some new problems.
electric sector is leading the way with the North American The property of control systems that is most commonly
Electric Reliability Corporation (NERC) cybersecurity stan- brought up as a distinction with IT security is that software
dards for control systems [23]. NERC is authorized to en- patching and frequent updates, are not well suited for
force compliance to these standards, and it is expected that control systems. For example, upgrading a system may
all electric utilities are fully compliant with these standards require months of advance in planning of how to take the
by 2010. system offline; it is, therefore, economically difficult to jus-
NIST has also published a guideline for security best prac- tify suspending the operation of an industrial computer on a
tices for general IT in Special Publication 800-53. Federal regular basis to install new security patches. Some security
agencies must meet NIST SP800-53. To address the security patches may even violate the certification of control systems.
of control systems, NIST has also published a Guide to In- In a recent anecdote, on March 7 of 2008, a nuclear power
dustrial Control System (ICS) Security [29]. Although these plant was accidentally shutdown because a computer used to
recommendations are not enforceable, they can provide guid- monitor chemical and diagnostic data from the plant’s busi-
ance for analyzing the security of most utility companies. ness network rebooted after a software update. When the
ISA (a society of industrial automation and control sys- computer rebooted, it reset the data on the control system,
tems) is developing ISA-SP 99: a security standard to be used causing safety systems to errantly interpret the lack of data
in manufacturing and general industrial controls. as a drop in water reservoirs that cool the plant’s radioactive
The Department of Energy has also led security efforts nuclear fuel rods [20].
by establishing the national SCADA test bed program [16] Another property of control systems that is commonly
and by developing a 10-year outline for securing control sys- mentioned is the real-time requirements of control systems.
tems in the energy sector [7]. The report –released in January Control systems are autonomous decision making agents
2006– identifies four main goals: (1) measure current secu- which need to make decisions in real time. While availability
rity, (2) develop and integrate protective measures, (3) detect is a well studied problem in information security, real-time

3
availability provides a stricter operational environment than 3. Design new attack-resilient algorithms and architec-
most traditional IT systems. tures: if we detect an attack we may be able to change
Large industrial control systems also have a large amount the control commands to increase the resiliency of the
of legacy systems. Several research efforts have tried to pro- system.
vide lightweight cryptographic mechanisms to ensure data
integrity and confidentiality [30,33]. The recent IEEE P1711 3 Linear Systems
standard is designed for providing security in legacy serial
links [15]. Having some small level of security is better than The behavior of physical systems can generally be de-
having no security at all; however, we believe that most of scribed by a mathematical dynamical system. Linear dynam-
the efforts done for legacy systems should be considered as ical systems is one of the most common models for physical
short-term solutions. For properly securing critical control systems; they are described by the system of equations:
systems the underlying technology must satisfy some mini-
mum performance requirements to allow the implementation xk+1 = Axk + Buk + wk
of well tested security mechanisms and standards. yk = Cxk (1)
Not all operational differences are more severe in control
systems than in traditional IT systems. By comparison to en- where xk = (x1k , . . . , xnk ) ∈ Rn is the state of the system at
terprise systems, control systems exhibit comparatively sim- time k. A = (aij ) ∈ Rn×n models the physical dependence
pler network dynamics: Servers change rarely, there is a of state i on state j, B = (bij ) ∈ Rn× is the input matrix
fixed topology, a stable user population, regular communica- for state i from control input j. Furthermore, the controller
tion patterns, and a limited number of protocols. Therefore, signal is uk = (u1k , . . . , u1m ) ∈ Rm .
implementing network intrusion detection systems may be In general, it is very difficult to have an accurate model of
easier than in traditional enterprise systems [4]. the process being controlled; therefore, it is common to con-
sider an additional term wk , which is called the process noise,
and accounts for modeling errors, uncertainties or perturba-
2.5.1 New Security Problem in Control Systems tions to the system. It is common to assume that wk ∈ Rn is
While all these differences are important, we believe that the a Gaussian random sequence with covariance Q0 and mean
major distinction of control systems with respect to other IT 0.
systems is the interaction of the control system with the phys- The second equation in Eq.(1) assumes the system is mon-
ical world. itored by a sensor network with p sensors, where yk =
In general, information security has developed mature (y1k , . . . , ypk ) ∈ Rp , and ylk ∈ R is the measurement col-
technologies and design principles (authentication, access lected by sensor l at time k. Furthermore C ∈ Rp×n . The
control, message integrity, separation of privilege, etc.) that reason to include the observation equation is because some-
can help us prevent and react to attacks against control sys- times we do not have direct measurements of the state of the
tems. However, research in computer security has focused system xk .
traditionally on the protection of information. Researchers
have not considered how attacks affect the estimation and 4 System Requirements and Attack Models
control algorithms –and ultimately, how attacks affect the
physical world. The estimation and control algorithms used in control sys-
tems are designed to satisfy certain operational goals, such
We argue that while the current tools of information secu-
as, closed-loop stability, safety, liveness, or the optimization
rity can give necessary mechanisms for the security of con-
of a performance function. Intuitively, our security goal is
trol systems, these mechanisms alone are not sufficient for
to protect these operational goals from a malicious party at-
the defense-in-depth of control systems.
tacking our cyber infrastructure.
We believe that by understanding the interactions of the
In water tank example, we may want to maintain the water
control system with the physical world, we should be able to
levels x in some bounded set (e.g., for all i xmin ≤ xi (t) ≤
1. Better understand the consequences of an attack: so far xmax ), even if the system is under attack.
there is no research on how an adversary would select Motivated by our previous work [3], we consider DoS and
an strategy once it has obtained unauthorized access to deception attacks. In deception attacks (a compromise of
some control network devices. integrity), the adversary sends false information ỹ 6= y or
ũ 6= u from (one or more) sensors or controllers. The false
2. Design novel attack-detection algorithms: by under- information can include: an incorrect measurement, the in-
standing how the physical process should behave based correct time when the measurement was observed, or the in-
on our control commands and sensor measurements, we correct sender id. The adversary can launch these attacks by
can identify if an attacker is tampering with the control obtaining the secret key or by compromising some sensors or
or sensor data. controllers.

4
 In DoS attacks the adversary prevents the controller from can be defined as a bounded set such that xmin i ≤ xi (t) ≤
receiving sensor measurements or the actuators from receiv- xmax i . Let P be this safety set.
ing control commands. To launch a DoS the adversary can We want to analyze the behavior of the system from time
jam the communication channels, compromise devices and k = 0 to k = N . In particular, we want to study the follow-
prevent them from sending data, attack the routing protocols, ing problem: Does there exist a suitable control sequence uk
flood the network with data etc. such that the performance process x0 , . . . , xN lies in a cer-
We now present a general framework to model these at- tain safety set with a sufficiently high probability under DoS
tacks by using additive changes to Eq.(1): attacks?
Definition of Security Given a safety parameter set P and
xk+1 = Axk + Buk + wk + Γrk a given , we say that the dynamical system (A, B, C) is
yk = Cxk + Ψzk (2) (p, q, ) secure if for every (p,q)-Adversary there is a con-
trol sequence uk (Ik ) such that
For these examples we assume the attack starts at time k =
t0 . To model this assumption we use the unit step function ∀k ∈ {0, . . . , N } Pr [xk ∈ P] ≥ 1 −  (3)
1{k≥t0 } , a function that is zero before t0 and one after t0 .
Modeling a DoS attack on a subset U of control signals. and where Ik is the information available to the controller at
time k.
Γ=B The feasibility problem Given history Ik we would like
∀i ∈ U ri,k = −ui,k 1{k≥t0 } to answer two questions: (1) is the system secure? and if it
is, (2) how do we find a realization of uk that maintains the
∀j ∈
/ U rj,k = 0 system in the safe set?
Modeling a DoS attack on a subset Y of sensor nodes
6 Example 2: Detection of Attacks
Ψ=C
We argue that detecting attacks to control systems can
∀i ∈ Y zi,k = −xi,k 1{k≥t0 } be formulated as anomaly-based intrusion detection sys-
∀j ∈
/ Y zj,k = 0 tems [5]. The difference in control systems is that instead
of creating models of network traffic or software behavior,
Modeling a deception attack on a subset U of control sig- we use instead the model of the physical system (Eq.(1). Our
nals. argument is that if we know how the output of the physi-
cal system Y1 , Y2 , . . . should react to our control commands
Γ=B U1 , U2 , . . . , then any attack to the sensor measurements or
∀i ∈ U ri,k = (−ui,k + αi,k )1{k≥t0 } control system will exhibit an abnormal view of the physical
∀j ∈
/ U rj,k = 0 process (Eq.(2). Given a sequence of observations Y1 , Y2 , . . .
the anomaly detector should also be able to estimate the ex-
where αk is the arbitrary control signal sent by the attacker. pected control signals to detect if a controller has been com-
Modeling a deception attack on a subset Y of sensor nodes promised.
The most natural way to detect these attacks is to use se-
Ψ=C quential detection theory. Unlike previous work [19, 27], we
∀i ∈ Y zi,k = (−xi,k + βi,k )1{k≥t0 } cannot use a fixed model for the attack hypothesis (this is
known in statistics as a simple hypothesis testing problem)
∀j ∈
/ Y zj,k = 0
because for deception attacks, we do not know the attack se-
where βk is the arbitrary control signal sent by the attacker. quences αk or βk that an adversary will select. Therefore we
need to formulate a composite hypothesis testing problem.
5 Example 1:Control under DoS Attacks We plan to investigate the effectiveness of this approach
for detecting a wide range of attacks, and also to analyze
Adversary Model A (p,q)-Adversary can select p chan- the tradeoffs between the accuracy of detection, the number
nels (between the sensor and the controller or between the of false alarms, and the damage to the physical system of
controller and the actuator) and perform a DoS attack for q attacks that can go undetected in our system.
units of time on all of these channels.
Security Specification While in several control problems 7 Conclusions
we want to design algorithms to optimize certain perfor-
mance criteria, we believe that when a system is under at- We have presented the current status of the field of secure
tack the main objective should be to maintain the safety of control. We identified some unique properties that these sys-
the physical process. In most cases the safety of the system tems have in comparison to traditional IT systems and pro-

5
posed some new research challenges based on the physical [12] G REENE , T. Experts hack power grid in no time. Networkworld,
models of the process being controlled. Our research chal- http://www.networkworld.com/news/2008/040908-rsa-hack-power-
grid.html, May 9 2008.
lenges are mostly unsolved and we believe that future re-
[13] H ALPERIN , D., H EYDT-B ENJAMIN , T. S., R ANSFORD , B., C LARK ,
search in these areas can provide an additional level of se- S. S., D EFEND , B., M ORGAN , W., F U , K., KOHNO , T., AND
curity to control systems. M AISEL , W. H. Pacemakers and implantable cardiac defibrillators:
While we have not presented a model of a real system in Software radio attacks and zero-power defenses. In IEEE Symposium
this short paper, it is important to emphasize the need for on Security and Privacy (2008).
realistic models of physical systems. We are currently exper- [14] H ART. http://www.hartcomm2.org/frontpage/wirelesshart.html. Wire-
lessHart whitepaper (2007).
imenting our research directions with three systems: a water
[15] H URD , S., S MITH , R., AND L EISCHNER , G. Tutorial: Security in
canal system, a water distribution network, and a chemical electric utility control systems. In 61st Annual Conference for Protec-
reactor plant. Only by experimenting and simulating realis- tive Relay Engineers (April 2008), pp. 304–309.
tic infrastructures will our theoretical methods be validated. [16] INL. National SCADA Test Bed Program. Idaho National Laboratory,
http://www.inl.gov/scada.
8 Acknowledgments [17] ISA. http://isa.org/isasp100. Wireless Systems for Automation (2007).
[18] J OHN H. M ARBURGER , I., AND K VAMME , E. F. Leadership un-
This work was supported in part by TRUST (Team for Research in der challenge: Information technology R&D in a competitive world.
Ubiquitous Secure Technology), which receives support from the National An assessment of the federal networking and information technology
Science Foundation (NSF award number CCF-0424422) and the following R&D program. Tech. rep., President’s Council of Advisors on Science
organizations: AFOSR (#FA9550-06-1-0244) Cisco, British Telecom, ES- and Technology, August 2007.
CHER, HP, IBM, iCAST, Intel, Microsoft, ORNL, Pirelli, Qualcomm, Sun, [19] J UNG , J., PAXSON , V., B ERGER , A., AND BALAKRISHNAN , H. Fast
Symantec, Telecom Italia, and United Technologies. portscan detection using sequential hypothesis testing. Security and
Privacy, 2004. Proceedings. 2004 IEEE Symposium on (May 2004),
211–225.
References [20] K REBS , B. Cyber Incident Blamed for Nuclear Power Plant
Shutdown. Washington Post, http://www.washingtonpost.com/wp-
[1] A NDERSON , R. Security in open versus closed systems– the dance of dyn/content/article/2008/06/05/AR2008060501958.html, June 2008.
Boltzmann, Coase and Moore. In Open Source Software Economics [21] L EYDEN , J. Polish teen derails tram after hacking train network. The
(2002). Register (11th Jan 2008).
[22] M ESERVE , J. Sources: Staged Cyber At-
[2] B YRES , E., AND L OWE , J. The myths and facts behind cyber secu-
tack Reveals Vulnerability in Power Grid. CNN,
rity risks for industrial control systems. In Proceedings of the VDE
http://www.cnn.com/2007/US/09/26/power.at.risk/index.html,
Congress, VDE Association for Electrical Electronic & Information
September 26 2007.
Technologies (October 2004).
[23] NERC-CIP. Critical Infrastructure Protection. North American Elec-
[3] C ARDENAS , A. A., A MIN , S., AND S ASTRY, S. Secure control: To- tric Reliability Corporation, http://www.nerc.com/cip.html, 2008.
wards survivable cyber-physical systems. In Proceedings of the First
[24] N EWS , B. Colombia Rebels Blast Power Pylons. BBC,
International Workshop on Cyber-Physical Systems. (June 2008).
http://news.bbc.co.uk/2/hi/americas/607782.stm, January 2000.
[4] C HEUNG , S., D UTERTRE , B., F ONG , M., L INDQVIST, U., S KIN - [25] Q UINN -J UDGE , P. Cracks in the system. TIME Magazine (9th Jan
NER , K., AND VALDES , A. Using model-based intrusion detection 2002).
for SCADA networks. In Proceedings of the SCADA Security Scien-
[26] R EED , T. At the Abyss: An Insider’s History of the Cold War. Presidio
tific Symposium (Miami Beach, FL, USA, 2007 2007).
Press, March 2004.
[5] D ENNING , D. An intrusion-detection model. Software Engineering, [27] S CHECHTER , S., J UNG , J., AND B ERGER , A. Fast detection of scan-
IEEE Transactions on SE-13, 2 (Feb. 1987), 222–232. ning worm infections. In Recent Advances in Intrusion Detection (Oc-
[6] DOE. Smart Grid. Department of Energy, tober 2004), pp. 59–81.
http://www.oe.energy.gov/smartgrid.htm, Accessed July 14 2008. [28] S LAY, J., AND M ILLER , M. Lessons learned from the maroochy wa-
ter breach. In Critical Infrastructure Protection (November 2007),
[7] E ISENHAUER , J., D ONNELLY, P., E LLIS , M., AND O’B RIEN , M. vol. 253/2007, Springer Boston, pp. 73–82.
Roadmap to Secure Control Systems in the Energy Sector. Energetics
Incorporated. Sponsored by the U.S. Department of Energy and the [29] S TOUFFER , K., FALCO , J., AND K ENT, K. Guide to supervisory
U.S. Department of Homeland Security, January 2006. control and data acquisition (scada) and industrial control systems se-
curity. Sp800-82, NIST, September 2006.
[8] GAO. Critical infrastructure protection. Multiple efforts to secure con- [30] T SANG , P. P., AND S MITH , S. W. YASIR: A low-latency high-
trol systems are under way, but challenges remain. Tech. Rep. GAO- integrity security retrofit for lecacy SCADA systems. In 23rd Inter-
07-1036, Report to Congressional Requesters, September 2007. national Information Security Conference (IFIC SEC) (2008).
[9] GAO. Information security. TVA needs to address weaknesses in con- [31] T URK , R. J. Cyber incidents involving control systems. Tech. Rep.
trol systems and networks. Tech. Rep. GAO-08-526, Report to Con- INL/EXT-05-00671, Idao National Laboratory, October 2005.
gressional Requesters, May 2008. [32] US-CERT. Control Systems Security Program. US
[10] G REENBERG , A. America’s Hackable Backbone. Forbes, Department of Homeland Security, http://www.us-
http://www.forbes.com/logistics/2007/08/22/scada-hackers- cert.gov/control systems/index.html, 2008.
infrastructure-tech-security-cx ag 0822hack.html, August 2007. [33] W RIGHT, A. K., K INAST, J. A., AND M C C ARTY, J. Low-latency
cryptographic protection for SCADA communications. In Applied
[11] G REENBERG , A. Hackers cut cities’ power. In Forbes (Jaunuary
Cryptography and Network Security (ACNS) (2004), pp. 263–277.
2008).