COM.3 Attacker injects Failed Integrity Check Events occur with a Theft of Electricity malformed packets discernible pattern related to in an attempt to billing or metering spoof the meter’s functions. energy usage COM.4 Attacker employs an Communications Lost A number of meters in the Denial of Service active RF jamming same physical locality report attack to disrupt a loss of communications meter communications COM.5 Attacker floods the Communications Lost Meter traffic flow Denial of Service communications monitoring tools report an Failed Communications channel with traffic abnormally large volume of Integrity Check in order to disrupt traffic meter Malformed PDU communications COM.6 Attacker exploits a Communications Lost Event occurs in the absence Denial of Service meter vulnerability of any additional situational to cause a permanent awareness data (e.g., natural denial of service event, tamper events) Software The following incident scenarios occur as a result of a software error on the meter. Table 24 Software Incident Scenarios – ID Incident Scenario Alarms and Events Situational Awareness Data Incident Classification LOG.1 Attacker injects Software Error Additional signs of Bypass of Security malicious code in suspicious behavior (e.g., Controls Malformed PDU order to bypass unauthorized remote security controls on disconnects) the meter LOG.2 Meter software flaw Software Error Incident occurs under Meter Malfunction causes software specific circumstances in errors to occur similarly configured meters Incident Remediation The next step in the incident management process is remediation. Remediation of AMI incident involves identifying the appropriate remediation strategy to employ. In most circumstances, Remediation of AMI incidents should be performed after the AMI incident scenario and incident classification has been identified. The following best practices have been identified for the remediation of AMI incidents.
COM.3 Attacker injects malformed packets in an attempt to spoof the meter’s energy usage Failed Integrity Check Events occur with a discernible pattern related to billing or metering functions. Theft of Electricity COM.4 Attacker employs an active RF jamming attack to disrupt meter communications Communications Lost A number of meters in the same physical locality report a loss of communications Denial of Service COM.5 Attacker floods the communications channel with traffic in order to disrupt meter communications Communications Lost Failed Communications Integrity Check Malformed PDU Meter traffic flow monitoring tools report an abnormally large volume of traffic Denial of Service COM.6 Attacker exploits a meter vulnerability to cause a permanent denial of service Communications Lost Event occurs in the absence of any additional situational awareness data (e.g., natural event, tamper events) Denial of Service Software The following incident scenarios occur as a result of a software error on the meter. Table 24 – Software Incident Scenarios ID Incident Scenario Alarms and Events Situational Awareness Data Incident Classification LOG.1 Attacker injects malicious code in order to bypass security controls on the meter Software Error Malformed PDU Additional signs of suspicious behavior (e.g., unauthorized remote disconnects) Bypass of Security Controls LOG.2 Meter software flaw causes software errors to occur Software Error Incident occurs under specific circumstances in similarly configured meters Meter Malfunction Incident Remediation The next step in the incident management process is remediation. Remediation of AMI incident involves identifying the appropriate remediation strategy to employ. In most circumstances, Remediation of AMI incidents should be performed after the AMI incident scenario and incident classification has been identified. The following best practices have been identified for the remediation of AMI incidents.
EPRI_AMI_Incident_Response_20120810.docx