Zeroska
  • 🐱Zeroska - The Bold
  • Computer/Cyber Security
    • ⭐Fresh off the boat - for new Blue Teamer/ SOC Analyst
    • 💀Necromancer (DFIR)
      • 🕵️DFIR and DFIR case
        • 🗃️Case Files
          • Misconfiguration 0x01
      • 📔My own DFIR notes
        • The Mark of The Web (MOTW)
        • LNK Shortcut
        • Prefetch, AmCache, ShimCache in Windows
        • Malicious Document (VBA, Office, PDF, ...)
        • SRUM (System Resource Usage Monitor)
        • Volatility notes
        • Understand Logon Session in Windows
        • "Very" Hidden sheets in Excel
        • Hidden Processes
      • 📔Notes
        • Useful Resources
        • Useful Resources DFIR
        • Saved Content (Backup for the OG content get deleted)
          • How to be best SOC analyst ever
    • 🧙‍♂️Defense Witchcraft
      • Data Analysis as a Defender
      • Active Directory
      • Windows Event Logs
        • Authentication (Windows Account Life Cycle Events)
      • MS Exchange
      • Windows
    • 💙My Current Blue Team Operation
      • VLAN Monitoring Template
      • Daily Monitoring Report
      • General Playbook
      • JupyterHub Configuration Guide
      • How to train your Blue Team
    • 🏭ICS/OT
      • Setup ICS/OT Simulation Learning Lab
      • Smart Grids
      • Learning Modbus TCP
      • Learning DNP3
      • Resources/Blogs/Links
    • 🥷Threat Intelligence
      • Small Cyber Threat Intelligence Program
      • Intelligence Analysis [VN]
      • OSINT Information Monitoring
        • Telegram Info-Stealer Monitoring
      • C2 Tracker
      • Fake Website Tracker
      • Dark Web Investigation Attempt
      • Threat Intelligence Quick Win
      • Resources/Blogs/Links
  • 😒Computer and Technology
    • My Home Lab Setup
    • 🐴ELK Stack
      • Useful Resources
      • ELK Stack - Container - Docker Compose - AWS ECS
      • ECS - Elastic Common Schema
      • Elasticsearch
      • Logstash
      • Troubleshooting and Problems
    • 🐧Linux
      • Setting up good SSH Authentication
      • Configure Auditd and how to leverage it
      • ELF Format
      • Useful Links
    • 📦Containers
      • Docker container logs is quite big
      • Worth Reading
    • 🪠Splunk Learning Experience
      • Splunk Test Lab
      • Data Collection Tier (How to get the data)
      • SC4S Custom Filter For Windows Event Log in Syslog Format (NXLog)
      • Useful Resources
  • Threat Hunting
    • Hunting for Implant
    • Using STRIDE and DREAD
    • 🐳Predators and Preys (Computing)
      • Tracks or Hunting Artifacts
    • 📦Network Packet Analysis
      • The Basic
      • Tshark | Zeek Copy & Paste
      • Network Analysis Resources
    • Grep | Powershell Search | Regex
    • Hunting Resources
  • 🎵In my remains
    • Choices
    • The Art of Facing Unknown Problems
    • Build the best DFIR team
    • Reverse Engineering - Đồ án hướng ngành A "Hụt" của tôi
Powered by GitBook
On this page
  • How to Secure a Smart Grid
  • Access control
  • Network Monitoring
  • PLC

Was this helpful?

  1. Computer/Cyber Security
  2. ICS/OT

Smart Grids

Just some notes about securing a smart grids

PreviousSetup ICS/OT Simulation Learning LabNextLearning Modbus TCP

Last updated 1 year ago

Was this helpful?

In America, there are 4 Grids that supply all the electricity (right now I'm only working with some small part of Texas interconnection)

How to Secure a Smart Grid

The Grid itself consists of 3 components: Power Generation, Transmission, and Distribution. Look exactly like the first picture

You need to identify what is the electric plant you are dealing with (there are a few of them) such as Fossil fuel, Solar, Wind,... Most of these types of plants have something called a controller which is a PLC to manage the turbine (hydro), the converter (solar), or the pump

In Order to reach this type of controller you have to go through a lot of layers, which might be an air gap environment

Without attacking the PLC, the threat could take control of the HMI and still wreak havoc (HMI as a C2)

Access control

Learn how many ways that your Grid can be access

  • Remote Access Gateway (VPN, ...)

  • Physical Access

Network Monitoring

PLC

🏭
Smart Grid Conceptual Model ()
https://ntnuopen.ntnu.no/ntnu-xmlui/bitstream/handle/11250/2781029/no.ntnu%3Ainspera%3A66462738%3A38097967.pdf?sequence=1
https://www.simplethread.com/a-tale-of-two-grids-a-brief-history-of-the-north-american-power-grid/