Model Response: This is a DDoS attack (120K distributed IPs). The timing during an ice storm is strategically devastating because: (1) customers critically depend on the portal to report emergencies like downed power lines, turning a service disruption into a potential safety hazard; (2) the SOC is already stretched thin responding to the storm, reducing their capacity to handle a simultaneous cyberattack. Countermeasures: (1) Deploy a cloud-based DDoS scrubbing service (e.g., Cloudflare, Akamai) that filters malicious traffic before it reaches Meridian’s servers. (2) Implement rate limiting with geographic and behavioral analysis to distinguish legitimate storm-affected customers from bot traffic.

Model Response: This is ARP poisoning enabling a MitM position. Evidence: (1) The ARP table shows an unregistered MAC (FA:KE:DE:VI:CE:01) mapped to the substation’s IP — classic forged ARP reply signature. (2) The 200ms latency increase indicates traffic is being routed through an intermediary device (the attacker), not traveling directly. (3) The device is unregistered, confirming it is unauthorized. On a SCADA/OT network, this is far more dangerous than on a corporate IT network because the attacker could modify commands sent to the substation — potentially opening or closing breakers, altering voltage levels, or disabling safety systems. This could cause physical damage to equipment, trigger cascading power outages, or endanger lineworkers and the public.

Model Response: This is a DNS cache poisoning attack. HTTPS did not protect customers because the attacker obtained a valid TLS certificate for a different but similar-looking domain (pay-meridianenergy.com vs. pay.meridianenergy.com). HTTPS only verifies that the connection is encrypted to the domain in the certificate — it does not verify that the domain is the correct one. The padlock icon gave customers a false sense of security. DNS protection: Implement DNSSEC (DNS Security Extensions) to cryptographically sign DNS records, preventing cache poisoning. Customer protection: Deploy Extended Validation (EV) certificates on the real payment portal and educate customers to check for the full organization name in the certificate, or implement HSTS preloading to prevent browsers from ever connecting to the payment domain over an insecure channel.