That may be for legacy machinery control systems (MCSs), but modern MSCs and increasingly wise to such threats as they monitor and archive all critical control system signals at the subsecond sample rates, such that sensor anomalies are detected in near real time and logged for future anaysis. You would not only need to hack the individual sensor signal, but you'd need to also know how to disrupt the MCS ladder logic that knows how to bypass a sensor putting out bad signals to keep the machinery system stable. Not an easy feat.
Personally, I mainly get involved in this data after the fact for energy optimization. However, the folks that design the systems complete Failure Mode and Effects Analysis (FMEA) in attempts to thwart failures and attacks at any concievable level. Still further, greater protection in terms of first line of defense firewalls and PKI certs between subsystems and components, making getting access to these bits int he first place increasingly difficult whereas these systems used to be virtually unprotected for any ding dong to tap into.
Sure, there are still holes, and probably always will be, but the efforts of MCS designers to protect their systems grows and the automation intelligence being developed to govern these control systems will provide an additional level of protection (and a known point of vulnerability).
The best way for a society to prepare is to have a few small incidents that put the safety systems to the test on a regular basis.
You can’t fake the system frequency like that. Anyone connected to the grid can observe/measure the system frequency trivially - you could do so right now at the nearest 10A socket. The attack you describe would require compromising large numbers of diverse, distributed generation and frequency response assets.
It would be like trying to fool everyone into thinking it’s a hot day by hacking every single thermometer!
That seems to be a quite different attack from something that causes a sudden outage.
... until the big disaster actually happens at which time at which point it's simply criminal that such things were allowed to happen.
When I was discussing the two interruptions (one on the 9nth and a smaller one on the 24th) with friends, I suggested that this could have been an attempt to map out UK's infrastructure/SCADAs, and they thought that my sandwich had too much consiracy sauce in it.
Remembering how Stuxnet interefered with Iran's nuclear centrifuges, this could very well be something similar. Just scratch it a bit, where it matters most, and let it sink on its own. No point blasting a huge hole in it.
But nothing is perfect, and whilst an edge case, space weather can and does wondrous things to pylons. It's planning for such outages and the layers of vulnerability in systems that such an event can expose in which you want top people on the case and planning around such exposures. After all, you don't want your fallback site all secure but nobody put the electric security doors on their own redundant power. Might end up with such doors opening automaticly and allowing anybody in, or not oipening and preventing access to the big red switch to failover onto some backup system. Things like that you just can't overlook.
But with power-grid distribution systems, their will always be a few weak points, case of if these three transformers suddenly went offline the cascade effect would be horrific. It's those cases you need to plan for. After all, 3 lorry accidents crashing into those transformers, whilst not very likely to happen at the same time - people win the lottery every week with much higher odds.
> The causes provided by RWE for the initiation of the trip of Little Barford steam turbine (ST1C) was due to discrepancies on three independent safety critical speed measurement signals to the generator control system.
A cyber attack would most likely, rather than directly take capacity offline, instead make the system less stable by attempting to make safety systems not work properly. That has the benefit that the attack will be triggered at th exact same time as another incident, increasing the impact.
Injecting false values for a sensor reading is a very good way to hide your tracks as an attacker - just inject a bunch of "0" values, and then uninstall whatever malware did it, and probably nobody will ever find out why that sensor randomly acted up.