SOAR4DER: Security Orchestration, Automation, and Response for Distributed Energy Resources

Monitoring data and control functionality presented by interoperable photovoltaic (PV) inverters and other Distributed Energy Resources (DER) can be used to improve site maintenance, prognostics, and grid operations. Unfortunately, DER communications present attack vectors which could lead to power systems impacts. Since adversary capabilities continually improve, avoiding catastrophic consequences requires intelligent intrusion detection and remediation systems that consider both physical and cyber features. New Security Orchestration, Automation, and Response (SOAR) technologies are equipping cyber-defenders with new capabilities to autonomously respond to network and host-based system alerts, threat hunting results, and cyber intelligence data streams. In this Chapter, we present a novel SOAR approach for DER systems, called SOAR4DER, that ingests data from multiple Intrusion Detection Systems (IDSs) to quickly block attacks and revert DER systems to known good states. Our implementation used a collection of IDS technologies on a Bump-in-the-Wire (BITW) device which incorporated physical and cyber data to detect abnormal and potential malicious behaviors. Multiple SOAR playbooks then used the IDS data streams to automatically defend the system. Laboratory testing of the SOAR4DER system showed detection and response times under 30 s for all adversary reconnaissance operations, denial-of-service attacks, malicious Modbus commands, brute force logins, and machine-in-the-middle attacks.