Incident Scenarios [9 SG.IR-8] – This section provides guidance on how to identify specific AMI incidents. The following fields in are used to describe each of the incident scenarios listed in the sections below. After Table 20 the incident scenario has been determined, the incident classification field in is used to Table 25 determine the appropriate remediation strategy to employ. Table 20 Incident Scenario Description – ID Identifier for the incident scenario Incident Scenario Description of the incident scenario Alarms and Events Alarms and events associated with the incident scenario Situation Awareness Data Evidence to support that the incident has occurred Incident Classification Classification of the incident to allow the incident response team to determine an appropriate remediation strategy to employ Physical The following incident scenarios occur as a result of a physical action being taken upon the meter. Table 21 Physical Incident Scenarios – ID Incident Scenario Alarms and Events Situational Awareness Data Incident Classification PHY.1 Attacker installs Removal Tamper A physical bypass device Theft of Energy bypass device to has been installed. steal electricity PHY.2 Attacker tampers Removal Tamper Tamper seals on the meter Theft of Energy with meter to steal have been broken. electricity Signs of hardware modification present (e.g., wires or headers soldered onto board) PHY.3 Attacker vandalizes Removal Tamper Signs of physical damage to Theft of Energy meter to steal the meter. Communications Lost electricity PHY.4 A natural event (e.g., Device Outage Weather or news reports Power Outage earthquake, fire, or may indicate that a natural Communications Lost flood) causes the event has occurred. meter to lose power. PHY.5 Attacker removes Removal Tamper Physical inspection reveals Theft of Energy meter and inserts it meter is inserted backwards. backwards into the
Incident Scenarios [9 – SG.IR-8] This section provides guidance on how to identify specific AMI incidents. The following fields in Table 20 are used to describe each of the incident scenarios listed in the sections below. After the incident scenario has been determined, the incident classification field in Table 25 is used to determine the appropriate remediation strategy to employ. Table 20 – Incident Scenario Description ID Identifier for the incident scenario Incident Scenario Description of the incident scenario Alarms and Events Alarms and events associated with the incident scenario Situation Awareness Data Evidence to support that the incident has occurred Incident Classification Classification of the incident to allow the incident response team to determine an appropriate remediation strategy to employ Physical The following incident scenarios occur as a result of a physical action being taken upon the meter. Table 21 – Physical Incident Scenarios ID Incident Scenario Alarms and Events Situational Awareness Data Incident Classification PHY.1 Attacker installs bypass device to steal electricity Removal Tamper A physical bypass device has been installed. Theft of Energy PHY.2 Attacker tampers with meter to steal electricity Removal Tamper Tamper seals on the meter have been broken. Signs of hardware modification present (e.g., wires or headers soldered onto board) Theft of Energy PHY.3 Attacker vandalizes meter to steal electricity Removal Tamper Communications Lost Signs of physical damage to the meter. Theft of Energy PHY.4 A natural event (e.g., earthquake, fire, or flood) causes the meter to lose power. Device Outage Communications Lost Weather or news reports may indicate that a natural event has occurred. Power Outage PHY.5 Attacker removes meter and inserts it backwards into the Removal Tamper Physical inspection reveals meter is inserted backwards. Theft of Energy
EPRI_AMI_Incident_Response_20120810.docx