INTRODUCTION Purpose and Scope The Advanced Metering Infrastructure (AMI) Common Alarms and Events document is intended to provide a foundation on which AMI vendors and asset owners can develop a standard for AMI alarms and events. The standard will address electric utilities’ need for greater interoperability and standardization of security events and enable Security Information and Event Management (SIEM) vendors to provide better situational awareness and cyber event detection in their products. The scope of this document includes only alarms and events generated by the meter and not the supporting AMI components such as the collection engine, technician service tool, or other AMI equipment at the head end. Additionally, while this document attempts to begin codifying the meaning of alarms and events, it does not attempt to codify their interpretation. EPRI AMI Incident Response Project The goal of the EPRI AMI Incident Response Project is to address several challenges that confront utilities when they are designing systems for detecting and responding to AMI incidents: Lack of a standard set of alarms and events across AMI vendors How to design a scalable Intrusion Detection System (IDS) Guidelines for responding to AMI incidents If a utility deploys meters from multiple vendors, the different data formats and naming conventions for alarms and events can make it challenging and expensive to integrate the AMI systems into the utility's SIEM. A set of common security information objects is needed to standardize the AMI alarms and events across vendors. Codifying security information objects will reduce the resources necessary for a utility to deploy multiple AMI vendors and also reduce the customization that each AMI vendor must do for a specific utility. In the long run, this will also make it easier for third-party security appliance manufacturers to apply their technology to the AMI domain, helping utilities better manage their security. The effective design of an IDS in a utility's AMI environment has several characteristics that differentiate it from the traditional Information Technology (IT) environment. For example, simply deploying a perimeter IDS may not provide the coverage necessary for an AMI system. Since there tends to be mesh networks in addition to IP-based backhaul networks, positioning an IDS at the AMI head-end system could miss malicious activity in the mesh network. Additionally, there can be scalability issues as some utilities deploy millions of meters in their service territory. In addition to the challenges of integrating AMI systems into utility backend systems, it is also unclear what the best practices are for responding to AMI incidents. There is a need for clear
INTRODUCTION Purpose and Scope The Advanced Metering Infrastructure (AMI) Common Alarms and Events document is intended to provide a foundation on which AMI vendors and asset owners can develop a standard for AMI alarms and events. The standard will address electric utilities’ need for greater interoperability and standardization of security events and enable Security Information and Event Management (SIEM) vendors to provide better situational awareness and cyber event detection in their products. The scope of this document includes only alarms and events generated by the meter and not the supporting AMI components such as the collection engine, technician service tool, or other AMI equipment at the head end. Additionally, while this document attempts to begin codifying the meaning of alarms and events, it does not attempt to codify their interpretation. EPRI AMI Incident Response Project The goal of the EPRI AMI Incident Response Project is to address several challenges that confront utilities when they are designing systems for detecting and responding to AMI incidents: Lack of a standard set of alarms and events across AMI vendors How to design a scalable Intrusion Detection System (IDS) Guidelines for responding to AMI incidents If a utility deploys meters from multiple vendors, the different data formats and naming conventions for alarms and events can make it challenging and expensive to integrate the AMI systems into the utility's SIEM. A set of common security information objects is needed to standardize the AMI alarms and events across vendors. Codifying security information objects will reduce the resources necessary for a utility to deploy multiple AMI vendors and also reduce the customization that each AMI vendor must do for a specific utility. In the long run, this will also make it easier for third-party security appliance manufacturers to apply their technology to the AMI domain, helping utilities better manage their security. The effective design of an IDS in a utility's AMI environment has several characteristics that differentiate it from the traditional Information Technology (IT) environment. For example, simply deploying a perimeter IDS may not provide the coverage necessary for an AMI system. Since there tends to be mesh networks in addition to IP-based backhaul networks, positioning an IDS at the AMI head-end system could miss malicious activity in the mesh network. Additionally, there can be scalability issues as some utilities deploy millions of meters in their service territory. In addition to the challenges of integrating AMI systems into utility backend systems, it is also unclear what the best practices are for responding to AMI incidents. There is a need for clear
EPRI_AMI_Incident_Response_20120810.docx