Big Ideas Lab podcast spotlights how Skyfall defends the power grid from cyberattacks

A blackout spread across more than a hundred cities in Ukraine after malware infected the nation’s power grid. This sophisticated breach was the first of its kind, speaking the language of the industrial control systems to carry out a remote operation on physical infrastructure. The incident led U.S. Department of Energy national security experts to ask: what would happen if a similar cyberattack was carried out against California's energy system? Listen on Apple or Spotify.

Researchers at Lawrence Livermore National Laboratory (LLNL) created the Skyfall facility to defend our critical infrastructure against these types of threats. The latest episode of the Big Ideas Lab podcast takes listeners inside the cyber-physical testbed, where real-world equipment is connected to high-performance computers to safeguard the everyday systems on which our nation depends.

The modern world is increasingly interconnected and reliant on software, from public health, communication and transportation services to oil and gas pipelines. Small cyber intrusions in one part of the system can trigger broader consequences across the grid when combined with the potential for equipment failures and weather events.

“We play out these scenarios, we say: here's the stuff we think the adversary's thinking about and here's some of the capabilities we've seen out in the wild. What would it look like if those were on our system?” said Nate Gleason, cyber and infrastructure resilience (CIR) program lead.

Skyfall uses a hardware-in-the-loop model to authentically simulate these intricate systems, integrating devices and power grid infrastructure into its model simulations to replicate the complexity of a real-world system. In the controlled environment, the researchers can examine cyberattacks and more routine system stresses like physical damage on a piece of equipment.

“Certain threats are not obvious,” said Vaibhav Donde, associate program lead at CIR. “It's not a short circuit. It's not anything big that's happening. So why would I care about that? But if you take the long time series of events happening, you will see a small spike, another small spike, spike, spike and it goes boom.”

The episode explores how the team at Skyfall is using artificial intelligence and machine learning to become better at identifying those patterns and anticipating what might happen next.

“We can build AI technologies for the power systems specifically that help us to understand what might happen next,” said Colin Ponce, computer scientist at CIR. “It feels like magic sometimes, but they’re not. What they do is learn patterns in the data that you give them.”

At the same time, adversaries are using these tools to conduct cyberattacks that are more efficient, more difficult to detect and capable of operating at unprecedented scale. Recognizing that even well-defended systems may still be penetrated, Skyfall’s immune infrastructure approach is focused on building resilience in these systems.

“The idea that you can build a big, strong fence around your system and keep the adversaries out just isn’t realistic,” Gleason said. “Instead, immune infrastructure is a layered approach designed to make it as difficult as possible at every step for the adversary to achieve their objectives.”

Skyfall simulates the worst-case scenarios events before they unfold, helping to defend the nation’s critical infrastructure and keep essential services running when they matter most.

Learn more about the Skyfall laboratory by listening to the new episode of the Big Ideas Lab podcast, available now on Apple and Spotify.