GridSecCon GridEx II. Bill Lawrence Manager of CIP Awareness NERC

Transcription

1 GridSecCon 2013 GridEx II Bill Lawrence Manager of CIP Awareness NERC

2 What is GridEx II? Voluntary at all levels NERC s Critical Infrastructure Protection Committee (CIPC) created an industry-sme Grid Exercise Working Group (GEWG) Full Player vs. Monitor/Respond Open vs. Concealed asset identification ES-C2M2 worksheet utilization Robust threats based on realworld, open source incidents Scoped to the Bulk Power System Flexible enough to include some cross-sector interdependent play Distributed Play International Wide range of organizational participation Wide range of internal participation Organizations can achieve local objectives Rewarding Experience a very large exercise CEHs Education on ES-C2M2, etc. Lessons learned / after-action report Grid reliability is the overarching goal Fun for the entire family!

3 GridEx II objectives have evolved GridEx 2011 GridEx II (2013) Validate the current readiness of the electricity industry to respond to a cyber incident and provide input for security program improvements Exercise NERC and industry crisis response plans and identity gaps in plans, security programs, and skills Assess, exercise, and validate existing Command, Control and Communication Plans for key NERC stakeholders Exercise the current readiness of the electricity industry to respond to a security incident, incorporating lessons learned from GridEx 2011 Review existing command, control, and communication plans and tools for NERC and its stakeholders Identify potential improvements in physical and cybersecurity plans, programs, and responder skills 4 Explore senior leadership policy decisions and triggers in response to major grid reliability issues

4 GridEx II Basics Simplified Objectives Using volunteer participants, a flexible scenario narrative and the MSEL as a guideline, the objectives are: Communicate with each other Walk through crisis response Gather lessons learned

5 GridEx II Planning Timeline C&O Meeting (February) IPC (March 26) MPC (June 4) FPC (October 1) Conduct GridEx II (November 13-14) Deliver Final Report (December) Kick-Off Initial Planning Phase Mid-term Planning Phase Final Planning Phase Conduct After Action Confirm goal & objectives Finalize timeline Discuss outreach goals/plan Initiate outreach Shape scenario themes Confirm exercise mechanics Craft scenario narrative Develop materials Confirm participation Finalize MSEL Conduct training Distribute player materials Set up venue and logistics Oversee distributed play Facilitate senior TTX Capture player actions and findings Analyze findings and lessons learned Draft After Action Report and Briefing

6 Distributed Play vs. Executive Tabletop Distributed Play (1 ½ Days) Players across the stakeholder landscape will participate from their local geographies and exercise information sharing Regional Entities Utilities Federal Agencies Exercise Control Oversees exercise play and facilitates interactions between exercise modules Executive Tabletop (½ Day) Discussion-based construct engages senior decision makers in assessing distributed play and exploring policy triggers Executive TTX Control System Vendors ES-ISAC and BPSA

7 Designation Expectations Return on Investment Your Organization GridEx II Participant Matrix Full Player Organization Monitor/ Respond Organization Participate in planning conferences and training sessions Engage in dynamic internal exercise play and external information sharing and coordination Adapt scenario to suit organization objectives and play Exercise scenario internally Participate in training and orientation Complete After-Action forms Close interaction with other BPS entities and relevant government agencies Incident response training opportunity Influence in shaping scenario and after action findings CIP training opportunity Valuable internal training and community building opportunity Association with sector-wide exercise Your Organization s Participants Grid Exercise Working Group (selected by NERC CIPC) Lead Planner (one per organization) Planner Player Participate in all scenario planning calls and conferences Provide technical input to shape scenario Primary POC for all planning interactions Gathers and consolidates scenario feedback at entity level to be shared with Grid Exercise Working Group Participate in planning conferences Designate and orient players and controllers Provide after action feedback Participate in training and orientation Engage in 1.5 days of live exercise play and provide after action feedback to planners Major influence in shaping relevant scenario themes, featured attack vectors and exercise mechanics Seat in Exercise Control Edit rights to Grid Exercise Working Group scenario products ensures entity-level considerations are addressed Access to all updates and materials for player set Opportunity to provide input on key planning materials Influence in shaping scenario and mechanics Observe players responses and activities Realistic training opportunity with broad set of BPS entities Build and/or strengthen relationships CEH opportunities

8 GridEx II Participation Map (As of 10/16/2013) Total Registered Organizations: 205

9 GridEx II in the Wild

10 GridEx II in the Wild ican-blackout/videos/american-blackout-trailer/

11 GridEx II Utility Participation (As of 10/16/2013) Utilities 115 Full Players Alliant Energy Ameren American Electric Power Arkansas Electric Cooperative Corporation Atlantic City Electric (Pepco Holdings Inc) Brookfield Renewable Energy Partners Garland Power & Light Consolidated Edison Co of NY CPS Energy Delmarva Power Electric Cooperatives of Arkansas First Energy Hydro One Networks Inc Hydro Ottawa Idaho Power Integrys Energy Group JEA KCP&L Luminant Power Massachusetts Municipal Wholesale Electric Company National Grid New York Power Authority Northeast Utilities Northern Indiana Public Service Company NSTAR Oklahoma Gas & Electric Pacific Gas and Electric Company Pepco PHI Holdings Inc. DTE Energy PJM Interconnection Duke Energy Public Service Co of New Hampshire Entergy Public Service Electric & Gas Essential Power, LLC Sempra Energy Utilities Exelon Southern California Edison Florida Municipal Power Agency Southern Company FortisBC Inc. Tacoma Power Georgia Transmission Corporation Tampa Electric Great Lakes Power Transmission TECO Energy, Inc. Hetch Hetchy Water and Power Tennessee Valley Authority Hydro Quebec We Energies Iberdrola USA Western Area Power Administration ITC Holdings Wisconsin Public Service Corp Kansas City Board of Public Utilities Xcel Energy Lakeland Electric Monitor/Respond Players ACES AES NA Generation ALLETE / Minnesota Power Arizona Public Service Associated Electric Coop Avista Corporation BC Hydro Bonneville Power CenterPoint Energy Central Maine Power ComEd Comision Federal de Electricidad (CFE) CSG Dominion Louisville Gas & Electric-KU Lincoln Electric System Manitoba Hydro MAEG Power Memphis Light, Gas & Water Division MidAmerican Energy Company Nebraska Public Power District NextEra Energy Inc. Orlando Utilities Commission OUC PNM Resources PPL Corporation Rayburn Country Electric Cooperative RG&E Salt Lake CIty Corp EM SaskPower Sycamore Cogeneration Company Tenaska Westar Energy Western Farmers Electric Cooperative To Be Determined Bruce Power Calpine Cleveland Public Power Duquesne Light EDP Renewables Florida Power & Light Gas Ops GSO Wholesale Market NIST Orange & Rockland Utilities, Inc. Otter Tail Power Company Pacificorp Pacific Power PAS Pike Electric PMG, Inc. RGE Shrewsbury Electric and Cable Operations South Carolina Electric & Gas Co. Toronto Hydro TransCanada Vectren Verdigris Energy LLC Vermont Transco LLC

12 RC/ISO and Regional Participation (As of 10/16/2013) Regional Coordinators/ISOs Full Players CAISO (RC - WECC) ERCOT FRCC IESO MISO NYISO PJM Interconnection Southern Company Southwest Power Pool Tennessee Valley Authority WECC Monitor Respond Players ISO New England, Inc. SaskPower 14 Regional Entities 8 Full Players FRCC ReliabilityFirst SERC SPP WECC Monitor/Respond Players Midwest Reliability Texas RE NPCC

13 Government/Academia/Other GridEx II Additional Participation (As of 10/16/2013) 69 Full Players ABB, Inc Alstom Grid Inc. Computer Sciences Corporation Department of Energy Department of Homeland Security ICS-CERT FBI FERC Edison Electric Institute Electric Power Research Institute Florida - City of Garland LOFTY PERCH INC. MITRE NERC ES-ISAC Bulk Power System Awareness NiSource Corporation Pacific Northwest National Laboratory Public Safety Canada ReliabilityFirst Royal Canadian Mounted Police SANS Siemens Utility Services Ventyx Verizon W.W. Grainger, Inc. Monitor / Respond Players AlertEnterprise Burns & McDonnell Carnegie Mellon University Critical Intelligence Department of Defense NNSA US Army Reserve Cyber Operations Battalion US Army Corps of Engineers USCYBERCOM Department of Homeland Security Infrastructure Protection NCCIC Florida Hillsboro County Office of Emergency Management City of Leesburg Indiana State Government Juniper Networks Maryland EIS Council Emergency Management Agency Florida Energy Administration Dept. of Law Enforcement Massachusetts Department of Tampa Office of Emergency Public Utilities Management National Association of State Energy HEROUX GROUP Officials Illinois - Cook County Department of Naval Surface Warfare Center Homeland Security and Emergency Dahlgren Management Norwich University Applied Research Maine Air National Guard Institutes Missouri - Cyber Team, Missouri Utilities Telecom Council Army National Guard Wisconsin (National Guard & Emergency Management To Be Determined American Public Power Association California Gilroy Fire Department/OES Law Enforcement Coordination Center SD-LECC Department of Defense USNORTHCOM Department of Homeland Security Science & Technology NCCIC OPETIU Support Montana Disaster and Emergency Services New Jersey Board of Public Utilities Office of Homeland Security Preparedness OSIsoft, LLC Utah Div. of Emergency Mgt. TransCanada

14 GridEx II Participation (As of 10/16/2013) GridEx II Participation GridEx II Participating Organizations Utility RC/ISO Regional Entity Government/Academia/Other Monitor Respond 47% Full Player 53% 34% 56% 6% 4%

15 GridEx II schedule for Distributed Play 13 November 2013 Time (EST) Event Description 8:30-9:00 AM C/E Conference Call First call of the day to coordinate with Planners and ExCon 9:00-9:15 AM Opening Remarks NERC Leadership will open the exercise with a short brief 9:30 AM Official Exercise Start (StartEx) The exercise begins and a STARTEX will go to all Lead Planners 9:30-12:30 PM Move One Exercise Play Move One injects will begin to be distributed from ExCon 12:30-1:00 PM Working Lunch Get lunch and continue to participate from workstation 1:00 PM Start Move Two Move Two official starts 1:00-5:00 PM Move Two Exercise Play Move Two injects will begin to be distributed from ExCon 5:00-5:30 PM Controller/Evaluator Wrap-up Call End of day Hotwash call with Controller/Evaluators and ExCon 14 November 2013 Time (EST) Event Description 8:30-9:00 AM C/E Conference Call (Optional) Conference call held before the start of Day 2 exercise play 9:00-9:15 AM Final C/E Preparation C/Es will have the opportunity to prep before Move Three begins 9:15 AM Start Move Three The official start time of Move Three 9:15-1:00 PM Move Three Exercise Play Move Three injects will begin to be distributed from ExCon 1:00-2:00 PM Working Lunch/Internal Review Entities can gather all participants and conduct a internal Hotwash 2:00-3:00 PM GridEx II Hotwash Hotwash call with (Lead) Planners & C/Es and ExCon (no Players)

16 GridEx II Scenario Escalation Timeline Grid Reliability Level Day 1 9:30am- 12:30pm Day 1 1:00-5pm Day 2 9:15am-1pm Day 2 11am-4pm Real-time (EST) Normal New Normal Severe physical and cyber security attacks National security event Key scenario events Distributed Play Executive Tabletop Move 1 T=0 Move 2 T+12 hours Move 3 T hours Tabletop 30 days Scenario Time

17