The substation is a vital part of the power grid and serves to aid in the distribution of electricity by, for example, transforming from high to low voltage. It is essential to protect the substation as a loss of electricity would cause severe consequences for our society. The Substation Automation System (SAS) allows for remote management and automation of substations but also creates possibilities for cybersecurity threats. In this thesis efforts towards using threat modeling to assess the cybersecurity of SAS are presented. Threat modeling entails creating a model of the system that shows the possible cybersecurity threats against it. To reach this goal, previously used information sources for threat modeling in the power systems domain are found. The thesis also includes the creation of a Time-To-Compromise (TTC) estimate for cyber attacks against Industrial Control Systems. By estimating the TTC, it is possible to prioritize which attacks to defend against. One method of creating threat models is by using threat modeling languages in which the assets, associations, attacks, and defenses have been defined. In this thesis, a threat modeling language for creating threat models of SAS is presented. The threat models in this thesis are used to create attack graphs to show the possible paths an attacker could take throughout the system. The work of this thesis also consists of evaluation of threat modeling languages that have been created or used. As a result, accurate assessment of cybersecurity for SAS can be made that helps in the efforts to keep them secure against cyber attacks.

Transformatorstationen är en viktig del av elkraftnätet och dess roll är att hjälpa till med distributionen av el genom att som dess namn beskriver transformera om spänningen. Det är nödvändigt att skydda transformatorstationen eftersom ett elavbrott skulle skapa stora konsekvenser för vårt samhälle. Ett automatiserat transformatorstationssystem gör det möjligt att hantera den externt men det öppnar även upp möjligheterna för cybersäkerhetshot. I den här avhandlingen presenteras forskning kring användning av hotmodellering för att utvärdera cybersäkerheter för SAS. Hotmodellering innebär att man skapar en modell av systemet som visar möjliga cybersäkerhetshot mot det. För att nå det målet har informationskällor för hotmodeller inom kraftnätsdomänen sammanställts genom en systematisk litteraturstudie. I avhandlingen tas det också fram ett sätt att räkna ut tiden det tar för att framgångsrikt genomföra en cyberattack mot industriella kontrollsystem. Hotmodeller kan skapas genom att använda hotmodelleringsspråk inom vilket komponenterna, relationerna, attacker och försvar är definierade. I den här avhandlingen skapas ett hotmodelleringsspråk för att skapa hotmodeller av SAS. Hotmodellerna i detta arbete kan användas för att skapa attackgrafer som visar möjliga vägarna som en attackerare skulle kunna ta genom systemet. Arbetet utvärderar även hotmodelleringsspråken som har använts eller skapats. Som ett resultat av denna avhandling kan korrekta utvärderingar av cybersäkerhet för SAS göras vilket hjälper i arbetet av att hålla dom säkra mot cyberattacker.

The complexity of ICT infrastructures is continuously increasing, presenting a formidable challenge in safeguarding them against cyber attacks. In light of escalating cyber threats and limited availability of expert resources, organizations must explore more efficient approaches to assess their resilience and undertake proactive measures. Threat modeling is an effective approach for assessing the cyber resilience of ICT systems. One method is to utilize Attack Graphs, which visually represent the steps taken by adversaries during an attack. Previously, MAL (the Meta Attack Language) was proposed, which serves as a framework for developing Domain-Specific Languages (DSLs) and generating Attack Graphs for modeled infrastructures. coreLang is a MAL-based threat modeling language that utilizes such Attack Graphs to enable attack simulations and security assessments for the generic ICT domain. Developing domain-specific languages for threat modeling and attack simulations provides a powerful approach for conducting security assessments of infrastructures. However, ensuring the correctness of these modeling languages raises a separate research question. In this study we conduct an empirical experiment aiming to falsify such a domain-specific threat modeling language. The potential inability to falsify the language through our empirical testing would lead to its corroboration, strengthening our belief in its validity within the parameters of our study. The outcomes of this approach indicated that, on average, the assessments generated by attack simulations outperformed those of human experts. Additionally, both human experts and simulations exhibited significantly superior performance compared to random guessers in their assessments. While specific human experts occasionally achieved better assessments for particular questions in the experiments, the efficiency of simulation-generated assessments surpasses that of human domain experts.

The substation automation system consists of many different complex assets and data flows. The system is also often externally connected to allow for remote management. The complexity and remote access to the substation automation system makes it vulnerable to cyber attacks. It also makes it difficult to assess the overall security of the system. One method of assessing the potential threats against a system is threat modeling. In this paper we create a language for producing threat models specifically for the substation automation systems. We focus on the method used to create the language where we review industry designs, build the language based on existing languages and consider attack scenarios from a literature study. Finally we present the language, model two different attack scenarios and generate attack graphs from the threat models.

When protecting the Industrial Control Systems against cyber attacks, it is important to have as much information as possible to allocate defensive resources properly. In this paper we estimate the Time-To-Compromise of different Industrial Control Systems attack techniques by MITRE ATT&CK. The Time-To-Compromise is estimated using an equation that takes into consideration the vulnerability data that exists for a specific asset and category of vulnerability. The vulnerability data is derived from an Industrial Control Systems specific vulnerability dataset. As a result, we present the mapping of the attack techniques to assets and categories of vulnerability, which makes it possible to apply specific vulnerabilities to the technique. We also present the method of how to estimate the Time-To-Compromise of the techniques and finally the values of Time-To-Compromise. After mapping the attack techniques to assets and category of vulnerability we are able to estimate the Time-To-Compromise and discuss its trustworthiness.

The metric Time-To-Compromise (TTC) can be used for estimating the time taken for an attacker to compromise a component or a system. The TTC helps to identify the most critical attacks, which is useful when allocating resources for strengthening the cyber security of a system. In this paper we describe our updated version of the original definition of TTC. The updated version is specifically developed for the Industrial Control Systems domain. The Industrial Control Systems are essential for our society since they are a big part of producing, for example, electricity and clean water. Therefore, it is crucial that we keep these systems secure from cyberattacks. We align the method of estimating the TTC to Industrial Control Systems by updating the original definition’s parameters and use a vulnerability dataset specific for the domain. The new definition is evaluated by comparing estimated Time-To-Compromise values for Industrial Control System attack scenarios to previous research results. 

This paper investigates methods to secure Remote Terminal Units (RTUs) which are the building blocks of a smart grid systems - the next generation version to replace the power grid systems that are being used today. RTUs are identified as the heart of automation and control (SCADA) systems by the systems engineers. As such, security and maintaining nominal operability of such devices has prime importance, especially for the industrial automation networks such as the smart grid. A way of measuring the security of systems and networks is executing a series of cybersecurity weakness assessment tests called penetration testing. Another way of such an assessment is called vulnerability analysis by threat modelling which involves careful investigation and modelling of each and every component of a network/system under investigation. This article, aims at marrying these two methodologies for the vulnerability assessment of the RTUs in a methodological and scientific way.

Successfully developing domain-specific languages (DSLs) demands language engineers to consider their organizational context, which is challenging. Action design research (ADR) provides a conceptual framework to address this challenge. Since ADR’s application to the engineering of DSLs has not yet been examined, we investigate applying it to the development of threat modeling DSLs based on the Meta Attack Language (MAL), a metamodeling language for the specification of domain-specific threat modeling languages. To this end, we conducted a survey with experienced MAL developers on their development activities. We extract guidelines and align these, together with established DSL design guidelines, to the conceptual model of ADR. The research presented, aims to be the first step to investigate whether ADR can be used to systematically engineer DSLs.

Due to our dependency on electricity, it is vital to keep our powersystems secure from cyber attacks. However, because power sys-tems are being digitalized and the infrastructure is growing increasingly complicated, it is difficult to gain an overview and secure the entire system. An overview of the potential security vulnerabilities can be achieved with threat modeling. The Meta AttackLanguage (MAL) is a formalism that enables the development ofthreat modeling languages that can be used to automatically generate attack graphs and conduct simulations over them. In this article we present the MAL-based language SCL-Lang which has been created based on the System description Configuration Language (SCL) as defined in the IEC 61850 standard. With SCL-Lang one can create threat models of substations based on their SCL files and automatically find information regarding potential cyber attack paths in the substation automation system configuration. This enables structured cyber security analysis for evaluating various design scenarios before implementation

Power systems are one of the critical infrastructures that has seen an increase in cyber security threats due to digitalization. The digitalization also affects the size and complexity of the infrastructure and therefore makes it more difficult to gain an overview in order to secure the entire power system from attackers. One method of how to gain an overview of possible vulnerabilities and security threats is to use threat modeling. In threat modeling, information regarding the vulnerabilities and possible attacks of power systems is required to create an accurate and useful model. There are several different sources for this information. In this paper we conduct a systematic literature review to find which information sources that have been used in power system threat modeling research. Six different information sources were found: expert knowledge, logs & alerts, previous research, system's state, vulnerability scoring & databases, and vulnerability scanners.

Cyber-attacks these threats, the cyber security assessment of IT and OT infrastructures can foster a higher degree of safety and resilience against cyber-attacks. Therefore, the use of attack simulations based on system architecture models is proposed. To reduce the effort of creating new attack graphs for each system under assessment, domain-specific languages (DSLs) can be employed. DSLs codify the common attack logics of the considered domain.Previously, MAL (the Meta Attack Language) was proposed, which serves as a framework to develop DSLs and generate attack graphs for modeled infrastructures. In this article, powerLang as a MAL-based DSL for modeling IT and OT infrastructures in the power domain is proposed. Further, it allows analyzing weaknesses related to known attacks. To comprise powerLang, two existing MAL-based DSL are combined with a new language focusing on industrial control systems (ICS). Finally, this first version of the language was validated against a known cyber-attack.