Cyber Security Energia Progetti Europei RSE · Framework Cyber Security 3° Conferenza Nazionale,...

Cyber Security Energia

Progetti Europei RSE

3° Conferenza Nazionale, Centro Studi Americani, Roma 25 Ottobre 2016

Giovanna Dondossola

Agenda

2

•  CyberSecurityEnergia•  Esigenze•  Contestoa4vitàRSE

•  Proge4EuropeiRSE

•  EnergyExpertCyberSecurityPla<orm

•  Conclusioni


Cyber Security Energia – Esigenze


Cyber Security Energia – Rischi

>>Minacce

•  Topologiacomplessa:controlloridistribuiD,conne4vitàcapillare,

reDinterconnesse,piaFaformemulD-operatore

• MoltepliciscenaridiaFacco

•  SensibilitàstaDsDcheincidenD

>>ImpaFo

•  Effe4degliaFacchisullefunzionidicontrollo

•  ImpaFodeglieffe4sulservizioenergeDco

>>Rischio


FrameworkCyberSecurity


CyberSecurity:metodologie


CyberSecurity:tecnologieetool

•  Sicurezzaend2endcomunicazionieserciziorete–  ComunicazioniTSO,DSO,DER,UtenD

–  Applicazionestandardsicurezza(autenDcazione,canalicifraD)–  ValutazionisperimentaliKPI

•  Monitoraggiosicurezzacomunicazionidicontrollo•  Resilienzasistemidicontrollo

–  Strategierecovery,controlloada4vo

–  GesDonedelleemergenze

•  PolicyeRegula>on–  CybersecuritynelCodicediReteNazionale–  CentriOperaDvidellaSicurezza–  CERTNazionale


Cyber Security Energia – Riferimenti

IECTC57WG15

CEN/CENELEC/ETSIWGSEG-CSP

CEICT57–mirrorIECTC57CEICT313–mirrorCEN/CENELEC/ETSISG/SECG

G7-Energia,EECSP,UE,Entso-e,MiSE,MiAEEGSI

CigréSCD2WG40

Sicurezzadeida>edellecomunicazioni

MandatoEUM/490,WP2–CyberSecurityapplicata

DireUve,Decre>,Delibere,CodicidiRete

Osservatoriothreats,cloudcompu>ng,remoteaccesses,regula>ons3° Conferenza Nazionale, Centro Studi Americani, Roma 25 Ottobre 2016

Progetti

Europei

•  Program

•  Directorate-General

HomeAffairs

•  PrevenDon,Preparedness

andConsequence

Managementof

Terrorismandother

Security-relatedRisks

(CIPS)

•  OverallobjecDve

•  PrevenDonand

Preparednessofrisks

•  SDmulaDng,promoDng

andsupporDngrisk

assessmentonCriDcal

Infrastructures,inorder

toupgradesecurity


Policy Levels

UCInterfaceLevelPolicies

UCSystemLevelPolicies

GeneralPolicies


Network• Containallthepoliciesrelatedtonetworkengineering

Security

•  Includepolicieswherespecificsecuritymechanismsareindicated

inordertopreservedataintegrityandenDtyauthenDcaDon

Monitoring

•  PoliciesforthemonitoringoftheinformaDonflowsanduser

acDviDes

Policy categories


GeneralPolicies Descrip>on

P01 SpecificcommunicaDonperformancerequirementsshallbeidenDfiedandusedfor

thespecificaDonoftheneededqualityofservice

P02 NetworksegmentaDonshallbeemployedinordertoisolatecriDcalassets P03 Systems shall be configured in order to exclude unnecessary funcDons, ports,

protocolsand/orservices

P04 Standardtransportlayerprotocolsshallbeused P05 Defense-in-depthmethodsshallbeimplemented P06 Theintegrityofthedatashallbeensuredwithappropriatemechanisms P07 UseranddeviceauthenDcaDonshallbeimplemented P08 CriDcaldatashallbesecurelystored P09 OnlyauthorizedenDDesshallperformspecificoperaDons P10 Privacyofcustomerdatashallbeensured P11 Mechanismsformonitoringdatatrafficshallbeimplemented P12 Logicalaccesscontrolshallbeensured

General Policies


•  Program:FP7-ICT

•  Goal:robustsmartgrid

controluDlizing

heterogeneous(third-party)

communicaDon

infrastructures

•  Robustnessagainst

•  Variabilityofnetwork

performance

•  Securitythreatsdueto

addiDonalnetwork

interfacesanduseof

off-the-shelf

communicaDon

technology

MV CONTROL USE CASE & TECHNOLOGIES

EVALUATION TOOLS

http://www.smartc2net.eu

COMMUNICATION SECURITY AND RESILIENCE OF SMART DISTRIBUTION SYSTEMS

Testing and Demonstration of Medium Voltage Control

SCENARIO DEMOSTRATION - RESULTS

MORE INFORMATION

QoS EVALUATION - RESULTS

Medium Voltage Control Use Case

§  ProtocolspecificQoSperformanceindicatorsareusefultoassessthecommunicaDontechnologycapabilityofmeeDngthe

requirementsofdistribuDoncontrolapplicaDonsandtospecify

theServiceLevelAgreementofthirdpartytelecommunicaDon

services§  End-to-endcommunica>onsecurityisbeFerservedbyadvancedcommunicaDontechnologies

§  ResidualrisksareeffecDvelymanagedbyintegraDngICT

monitoring,faultmanagementandICTawarecontrol

applicaDons

KEY FINDINGS

Adaptive Control (No Fault

Management)

Recovered Attack (Fault

Management)

PCS – ResTest Lab

ReportDelay

ReportDelay

PCS – ResTest Lab

ReportDelay

PCS – ResTest Lab

SC D2, Paper D2-204 “Application of Monitoring Standards for

enhancing Energy System Security” RSE, Enel, Enel Produzione


EnergyExpertCyberSecurityPla_orm(EECSP-EG)

DL61/2011(Italianactua>onofDir114)

Na>onalStrategicFrameworkforCyberspaceSecurity/2013

[integrazionedafonteENISA,G7-EnergiaBerlinoNov.2015]

Cyber Security Energia – Strategie Europee

22

EnergyExpertCyberSecurityPla_orm

•  DefinireunastrategiadiCyberSecurityEnergiacomunealivelloEuropeo

–  FormalizzazionedistrumenDlegislaDvidiseFore,es.ECreccomandaDon

–  AvviareunprocessoconDnuodicondivisionedibestpracDceschepotrebbealimentarele

iniziaDvefuturedell’UnioneEnergia

•  Policydiriferimento

–  NetworkandInformaDonSecurity-NISDirecDve

–  GeneralDataProtecDonRegulaDonGDPR

–  EuropeanAgendaonSecurity2015-2020–Aprile2015–  DigitalSingleMarket-DSMCommunicaDon–Maggio2015

•  Organizzazione

–  Gruppodi15EsperDEECSP-CallforExpertslanciatadallaCommissioneEuropeaDG–EnergiaconscadenzaSeFembre2015

–  ForumEECSP–conferenzeannualiapartecipazioneaperta


23

EECSP-EG•  Compito:assisterelaCommissionenellapreparazionedipropostelegislaDve

einiziaDvedipolicy

•  Mandato:guidasullestrategieepolicyalivelloEuropeo,indirizzandoipunD

chiavedelseForeenergiaqualiaspe4infrastruFurali,sicurezzadella

fornitura,tecnologiesmartgridenucleari

•  Durata:2anniconpossibilitàdiestensione

•  D1

–  AnalisidelleesigenzespecifichedelseForeenergiainrelazioneallalegislazioneesistente

–  IdenDficazionediareecherichiedonounapprocciodiseForeperlacybersecurity

•  D2–sviluppodiunastrategiaabreve,medioelungotermine

•  D3–monitoraggiosubaseregolaredell’implementazionedellalegislazione

•  deFagliallink

hFp://ec.europa.eu/transparency/regexpert/index.cfm?

do=groupDetail.groupDetail&groupID=3341&Lang=IT


Conclusioni


•  IlseForeenergiapresentaesigenzespecifichedicybersecurity

•  Lea4vitàdiricercasupportanol’individuazionedelle

esigenzespecifichedelseForeenergiaecontribuisconoagli

sviluppitecnologicinecessariasoddisfarle

•  Losviluppodisoluzionistandarddicybersecuritydeveesseresostenutoelaloroadozioneraccomandata

•  IrisultaDdellaricercacontribuisconoallaevoluzionedellalegislazioneesistente

GiovannaDondossolaRSESpa,T&DTechologiesDpt

CEICT57,Segreteria

CEICT313,Membro

EECSP-EG,Esperto

[email protected]


CRUTIALhfp://cru>al.rse-web.it•  CRi>calUTilityInfrastructurALresilienceSoESwww.soes-project.eu

•  SecurityofEnergySystems-EPCIP•  VincitorePremioWSIS(ITU)2015CategoriaC5.BUILDINGCONFIDENCEANDSECURITYINTHEUSEOFICTS

SmartC2Net–www.smartc2net.eu•  SmartControlofEnergyDistribu>onGridsoverHeterogeneousCommunica>onNetworks–FP7ICT

ELECTRA–www.electrairp.eu•  Task4.4-cybersecuritynuovisistemicontrolloperre>ditrasmissioneeuropeeconmassimapenetrazionediDERemercatodellaflessibilità–FP7ENERGY

Progetti Europei


Date post:	20-Jul-2020
Category:	Documents
Upload:	others
View:	1 times
Download:	0 times

Cyber Security Energia Progetti Europei RSE · Framework Cyber Security 3° Conferenza Nazionale,...

Documents