Towards Enabling Secure and Real-time Exchange of CTI data for EPES Infrastructures

According to the European Commission, critical infrastructures (CI) are all those physical or digital systems that provide essential functions and services to support the most basic social, economic, environmental, and political systems. Sectors such as health, transport or energy are examples of CI.

Regarding the energy sector, an attack can have a great impact in the society due to the dependency that we have in this sector. Some decades ago, the energy sector was characterized by its isolation from the rest of the economic components. With digitalization and the inclusion of Information and Communication Technology (ICT) in the different processes of Electrical Power and Energy Systems (EPES), together with the development of smart-cities and Industry 4.0, a new era has begun. We all agree that technology is designed to facilitate all aspects of our lives but sometimes it brings some problems with it.

Over the years we have observed that this modernization of EPES has increased the attack surface and malicious actors are continuously developing new threats against systems’ vulnerabilities[1],[2],[3].

As we have mentioned before, the energy sector is key in our society and an attack can trigger devastating consequences. Unfortunately, we have already experienced the negative impact of this kind of attacks. A great example is BlackEnergy, which targeted Ukrainian power plants in 2015 causing the disruption of electricity in half of the homes in the Ivano-Frankivsk region [4]. This kind of attacks are performed by a selected group of attackers that are enrolled in nation-sponsored groups called Advanced Persistent Threats (APT) [5]. They stand out for being stealthy and for targeting critical infrastructures that can cause high damage in their victims.

In a circular economy, everything that affects another entity will, sooner or later, affect you. That’s why it is critical to share cyber threat intelligence (CTI) information among different partners. Some of the benefits that can be listed are the obtention of refined intelligence on security incidents like feedback from other organizations, the evaluation of security measures and its effectiveness, and the mapping of threats through statistical analysis with telemetry. Refer for instance to the EU Cyber Information and Intelligence Sharing Initiative (CIISI-EU) [6] for collaborative information sharing of TI across CI sectors.

However, one of the barriers nowadays is that organizations are still reluctant to share data among other entities due to its sensitiveness, especially operators of highly sensitive infrastructures, such as EPES. They still face limitations or unwillingness to share CTI data either due to the price to use CTI platforms or due to security and privacy concerns in the open-source solutions [7], or due to the limited fine-grained control offered on what is shared and with whom.

It is important to note that any information leakage would be very risky, that’s why a carefully management of the data is unnegotiable, always in compliance with the data protection regulations, particularly the General Data Protection Regulation (GDPR) [8]. To overcome that, ELECTRON has designed a SharePoint platform (E-SP) that will be described in the following section.

The ELECTRON SharePoint Approach

The ELECTRON SharePoint (E-SP) is based on Malware Information Sharing Platform (MISP) [9] technology, offering additional features such as CTI data enrichment, finer-grained encryption and anonymization of the information published. It allows EPES end-users to communicate in a decentralized and anonymous manner. Figure 1 shows a view of the E-SP communications between different ELECTRON framework instances (per EPES operator). It allows stakeholders to share sensitive data with trusted entities by configuring privacy policies.