Teaching Critical Infrastructure Cyber Security to Undergraduate Students using Real-Time Hardware-in-the-Loop Cyber-Power Testbed

This paper discusses efforts to develop a real time cyber-physical security testbed for hands-on training and education of undergraduate students. Developed cybersecurity testbed has been used for a course and senior capstone project. The testbed helps the students to specifically focus on cyber threats against critical electricity infrastructures and develop appropriate defense mechanisms by utilizing MITRE ATT&CK adversary emulation techniques, NERC CIP compliance and NIST Cybersecurity Framework. To mimic a realistic power substation network, we have developed a three-tier architecture through a mix of simulation, emulation, and actual hardware implementation, consisting of the power system substation, communication network, and control center layer. The substation layer enables the student to integrate components including generation, electric bus bars, switches, transformers and distributed energy resources such as solar, wind, and large scale battery. Here, multiple industry-graded sensors and actuators have been integrated to capture realtime voltage and current measurements and enable remote control and protection schemes. This helps students to get acquainted with different industrial automation standards and protocols such as IEC 61850, DNP3, and Modbus. The communication network layer, consisting of a combination of Software Defined Networking (SDN) and traditional networking, allows the student to focus on state-of-the-art network technology paradigms, features, and how they are involved in exchanging end-to-end power system data. At the control center layer, the students are able to capture and visualize the cyber and power data from multiple sources and develop machine learningbased anomaly detection, classification, and localization tools to improve cyber power resiliency. Industry-standard Security Information and Event Management (SIEM) tools such as Splunk and Intrusion Detection Systems (IDS) are used to train students to detect, defend and analyze coordinated cyber attacks. The hardware-in-the-loop learning ecosystem lets the students perform red-team, blue-team, and purple-team exercises for power systems following cybersecurity standards, guidelines, and related frameworks. As an outcome, the students develop an understanding of cyber security concepts such as digital forensics, incident response, and reverse engineering related to the smart grid, and design steps to keep it secured. Overall, our approach advances the cybersecurity profession and helps develop a robust talent pipeline to meet the increasing demand for cybersecurity jobs that affect national security.