Cybersecurity and the Internet of Everything

On Aug. 14, 2003, an overloaded power line in Ohio caused blackouts in eight U.S. states and Ontario, Canada. Fifty million people were affected. In the worst hit areas, emergency generators struggled to maintain cell phone communication and keep water running, mass transit came to a halt and traffic lights malfunctioned in what would later be deemed one of the largest blackouts in U.S. history.

“When power is out, people notice,” said Brian Johnson, Schweitzer Engineering Laboratories (SEL) endowed chair in power engineering at the University of Idaho. “People are used to the idea that the power could go out from a storm or an earthquake, but people don’t think about a cyberattack, let alone something that could affect power on a statewide or national scale.”

When most people think of cybersecurity, they think of computer hackers, passwords and viruses. With the rise of smart devices and network-connected systems, the reality of cyber-physical attacks capable of taking control of computer systems operating cell phone towers, power plants, oil pipelines and other large operations are an increasing threat.

As one of the National Security Agency’s first seven National Centers of Academic Excellence in cyber defense education, U of I is a leader in advanced cybersecurity training, with its College of Engineering launching an undergraduate degree program within the next year and master’s and doctoral programs to follow — adding to the certificate already offered and comprehensive computer science programs that emphasize cyber defense.

Early Adopters

The number of internet-connected devices will reach more than 75 billion worldwide by 2025, quintupling over the last 10 years.

“We’ve gotten used to embracing new technology at a very fast pace, and the benefits of that technology have historically been more important than the security behind them,” said Wayne Austad, technical director of the recently established Cybercore Integration Center at Idaho National Laboratory (INL). INL employs more than 300 U of I graduates and about 20 student interns.

“We have to embrace cybersecurity the way we embrace safety,” he said.

According to the Center for Cyber Safety and Education, unfilled cybersecurity jobs are expected to reach 1.8 million by 2022.

U of I is one of 70 institutions participating in the national CyberCorps: Scholarship for Service (SFS) program, administered through the university’s Center for Secure and Dependable Systems. The SFS program provides tuition stipends of up to $25,000 for an undergraduate and $34,000 for a graduate student, funded through the National Science Foundation, for training to protect our government's computing systems, networks and critical infrastructures. As part of the program, students go on to work in positions at federal, state, local and tribal agencies.

“Cybersecurity is all about fighting crime and criminals,” said Isabel Hinkle, a computer science junior and current SFS student.

Hinkle said the SFS program provides a strong support system of faculty and undergraduate and graduate students who truly understand the importance of cybersecurity to protect the general public.

“The people out there who need protection are the ones who don’t know how to protect themselves,” she said. “People know how to hack you. There needs to be people out there who can see when an attack is happening and understand the process to combat it.”

Over the last 20 years, cybersecurity courses at U of I Idaho Falls, in partnership with INL, have grown extensively to include research-focused curriculum including cyber warfare, internet surveillance and privacy, with courses on elections security and other special topics in the works.

“U of I was part of a small group early on that recognized the need for cybersecurity in the late ’90s,” said Michael Haney, assistant professor for the U of I College of Engineering in Idaho Falls. “Over the years, that need has become more apparent, with cyberwarfare and massive internet disruptions. U of I has provided a national influence on curriculum and standards.”

A Powerful Threat

The first documented cyberattack on a power grid occurred in Ukraine in 2015. Three energy distribution companies were compromised and about 230,000 people were left without electricity for days.

Thanks to partnerships with industry leaders like Avista, INL, Idaho Power, POWER Engineers and SEL, as well as funding through the M.J. Murdock Charitable Trust, the U of I College of Engineering has developed a network of state-of-the-art equipment, labs and resources to give undergraduate and graduate students opportunities to engage in research aimed at strengthening cybersecurity with regard to cyber-physical systems.

Electrical engineering senior Christine Page has spent the last two years working on a U.S. Department of Energy-sponsored project involving the development of cyberattack detection and mitigation techniques for line-commutated-converter (LCC) multiterminal high voltage direct current (HVDC) transmission for large power grids.

HVDC is not widely used in most large power grids but is being looked at for its ability to prevent power lost in one area of the grid from affecting other areas, Page said, making it easier to control and protect. HVDC is also known for its ability to transmit power over long distances, especially for renewable energy platforms that are often not located near the cities that need them.

Protecting a large cyber-physical power system involves an insurmountable amount of testing against many variables, including grid layout, size, equipment and cyber structure. Since testing can’t be done on a live grid without disrupting power to consumers, the answer lies in simulation.

U of I is one of few universities nationwide that gives students access to a Real Time Digital Simulator (RTDS) capable of simulating any modern high voltage power grid configuration, including power from renewable sources like wind turbines. The RTDS in the Power Lab on the Moscow campus is also connected to a local control hub in the Integrated Research and Innovation Center, allowing students to mimic control operations and simulate what a cyberattack might look like as it occurs.

“Seeing something done in real time is a magical thing,” said Page, who is also a SMART Scholarship for Service recipient, working with the U.S. Department of Defense on several projects, including the cybersecurity behind satellite communication.

Simulation capabilities from the RTDS were paired with protective relays from SEL in a collaborative research effort between INL and Virginia Commonwealth University. U of I students were tasked with building a scalable system capable of determining how real equipment would be affected within a simulated power grid under simulated power fluctuations, or anomalies, that can be brought on by cyberattack and cause blackouts.

“We’re trying to bridge a very huge gap, to visualize effects of cyberattacks and human disturbances on physical equipment and also find vulnerabilities,” said U of I computer science master’s graduate Ibukun Oyewumi ’19, who was on the team project and now works as a security analyst for Facebook.

Using the developed model, research is continuing on an INL-sponsored research project in collaboration with Ohio State University to develop metrics to better understand the state of an electrical system from a power and cybersecurity standpoint in order to guide upgrades to the system.

U of I was part of a small group early on that recognized the need for cybersecurity in the late ’90s. Michael Haney, assistant professor

Meeting the Cybersecurity Education Need

• University of Idaho is working with leading industry partners to build the pipeline of professionals ready to protect Idaho’s information infrastructure.
• With an undergraduate program set to launch in the next year, U of I is the first institution in Idaho and one of the first in the country to provide undergraduate and graduate degrees in cybersecurity.
• U of I’s Center for Secure and Dependable Systems (CSDS) has secured nearly $9 million in funding to cover tuition and degree-related fees for students participating in the CyberCorps: Scholarship for Service program.
• With support from the Idaho Global Entrepreneurial Mission and M.J. Murdock Charitable Trust, the U of I College of Engineering developed a distributed testbed connecting cyberattack response research infrastructure in Moscow, Idaho Falls and Coeur d’Alene.
• U of I is part of a cybersecurity program partnership involving eight Idaho institutions. Idaho Governor Brad Little has recommended $1 million in one-time spending for this partnership.
• INL’s Cybercore Integration Center and the Collaborative Computing Center opened last fall and will serve as a collaborative research, education and training grounds for faculty and students from U of I and other universities to establish the next generation of cybersecurity professionals.
• Schweitzer Engineering Laboratories is partnering with the College of Engineering in a $2.5 million, five-year agreement to support cybersecurity education through contracted research funding and faculty and grad student assistance.

Article by Alexiss Turner, College of Engineering.

Photography by Joseph Pallen, University Communications and Marketing.

Published in the Spring 2020 issue of Here We Have Idaho.