meter housing to Reverse Rotation steal electricity Authentication The following incident scenarios occur as a result of an attacker attempting to bypass authentication controls on the meter. Table 22 Authentication Incident Scenarios – ID Incident Scenario Alarms and Events Situational Awareness Data Incident Classification AUTH.1 Attacker attempts to C12.18 Failed Login Event occurs in the absence Theft of C12.18 guess the login of any known maintenance Logon Credentials C12.18 Successful Login credentials to the activity C12.18 optical port interface AUTH.2 Attacker attempts to C12.22 Failed Inspection of packet Bypass of Meter bypass the meter’s Authentication captures to detect Security Controls security controls by maliciously modified injecting C12.22 packets messages with invalid credentials Communications The following incident scenarios occur as a result of a disruption of communications between the meter and the head end. Table 23 Communications Incident Scenarios – ID Incident Scenario Alarms and Events Situational Awareness Data Incident Classification COM.1 Poor Failed Communications Failed communications Poor communications Integrity Check integrity checks occur Communications between the AMI sporadically without any Link meter and the head discernible pattern (e.g., end causes integrity types of messages failing check failures integrity checks). COM.2 Attacker injects Failed Communications Events occur with a Bypass of Security fuzzed packets on Integrity Check discernible pattern (e.g., Controls the communications types of messages failing, Malformed PDU link in order to period in which events bypass security occur) controls
meter housing to steal electricity Reverse Rotation Authentication The following incident scenarios occur as a result of an attacker attempting to bypass authentication controls on the meter. Table 22 – Authentication Incident Scenarios ID Incident Scenario Alarms and Events Situational Awareness Data Incident Classification AUTH.1 Attacker attempts to guess the login credentials to the C12.18 optical port interface C12.18 Failed Login C12.18 Successful Login Event occurs in the absence of any known maintenance activity Theft of C12.18 Logon Credentials AUTH.2 Attacker attempts to bypass the meter’s security controls by injecting C12.22 messages with invalid credentials C12.22 Failed Authentication Inspection of packet captures to detect maliciously modified packets Bypass of Meter Security Controls Communications The following incident scenarios occur as a result of a disruption of communications between the meter and the head end. Table 23 – Communications Incident Scenarios ID Incident Scenario Alarms and Events Situational Awareness Data Incident Classification COM.1 Poor communications between the AMI meter and the head end causes integrity check failures Failed Communications Integrity Check Failed communications integrity checks occur sporadically without any discernible pattern (e.g., types of messages failing integrity checks). Poor Communications Link COM.2 Attacker injects fuzzed packets on the communications link in order to bypass security controls Failed Communications Integrity Check Malformed PDU Events occur with a discernible pattern (e.g., types of messages failing, period in which events occur) Bypass of Security Controls
EPRI_AMI_Incident_Response_20120810.docx