Long Term (2025. On the long term, the challenge for vulnerability assessments will be to handle very large, complex, and dynamic environments. Machine learning techniques will probably play a key role in vulnerability assessments, for instance in dynamic gathering of threat intelligence, for continuous updating of the severity of individual vulnerabilities as well as their role in different attack vectors in different con- Research roadmap for vulnerabil- ity assessments: • Develop methods to feed analyti- cal vulnerability intelligence tools with data from vulnerability scan- ners or IDSs • Validate the analytical tools on Smart Grid systems • Develop vulnerability intelligence tools that can deal with large, complex, and dynamic networks (for instance using machine learn- ing) texts, for continuously identifying and updating models of the ICT infrastructure, and for identifying best prac- xxxx solutions in different domains. We also expect that the vulnerability intelligence tools will provide more and more support in choosing the right tactical actions in security operations: which vul- nerabilities need to be dealt with first, and what do we do to stop or contain an attack. Much like you would run optimal power flow analysis within the SCADA system before actual reconfiguring the power network, the security intelligence tools would estimate the result of tactical actions for the security operations teams. The tools may even be applied to implement self- healing capabilities. On the strategic level we expect an integration of the vulnerability intelligence tools with risk assess- ment tools (see also the risk assessment chapter). In this way long term decisions on security measures are always aligned with the latest security state of the network. SEGRID contributions: • Modelling of SCADA and Smart Metering systems in CySeMoL to determine if the analytical modelling approach works for Smart Grid systems (deliverables 3.1, 3.2, and 3.3) • Development of an active vulnerability assessment tool to feed the analytical tools with real-time network data (deliverables 3.1, 3.2, and 3.3)
Long Term (2025. On the long term we expect that the security monitoring systems and teams will have to deal with larger and larger volumes of events. On the one hand, the roll-out of the SIEM and intrusion detection systems will lead to data being gathered from more and more systems within the Smart Grid. On the other hand, the Smart Grid systems will become more complex, and generate more and more traffic and other data. Increased automation is needed to deal with this increase in data. One part to automate is the prioritization of security events. The prioritization should be risk-based. More advanced risk assessment models are expected to become available in the near future. To make sure that the scarce people available to analyze incidents work on the right things, these risks models should be used to guide their work. A lot of research is still needed to connect the models developed for risk assessments with the information from intrusion detection systems. Another part to automate is the sharing of threat information, such as indicators of compromise. A challenge here is the information sharing infrastructure. This infrastructure should be secure enough to be trusted by all parties involved. More and more stakeholders are getting involved in the Smart Grid. They need to find a trusted way to share information about vulnerabilities and incidents. Most organi- zations prefer not to make such information public. A possible solution may be to allow anonymous sharing of some information. Finally, some of the response may also have to be automated. Especially with the millions of devices placed in-home or in the field, it is not possible to have an analyst go to the device to analyze and fix it. It will be a challenge to find automated counter-measures that do not create a risk of disturbing the Smart Grid. Besides the increase automation, we also see an opportunity to use more of information on the physi- cal state of the grid, as collected by the SCADA system, for security monitoring. The most dangerous attacks are those that physically affect the grid. Detecting such attacks by their effect on the grid is already an active area of research. SEGRID contributions:
