Smart Grid Security: Is Trouble Coming?
Dan Lohrmann
Cybersecurity Leader | CxO Advisor | Bestselling Author | GT Blogger: 'Lohrmann on Cyber' | Global Keynote Speaker | CISO Mentor
The U.S. Department of Energy released an alarming report in January 2017, saying that the U.S. electric grid is in imminent danger from a cyberattack. So where have we been, where are we now, and where are we going regarding smart grid security?
Over the past several months, alarm bells have been going off regarding potential attacks against the U.S. electrical grid. Consider these recent media headlines:
The Wall Street Journal: Cyberattacks Raise Alarm for U.S. Power Grid — Excerpt: “Cyberattacks that have knocked out electric utilities in Ukraine, including one suspected hack earlier this month, have renewed concern that computer criminals could take down portions of the U.S. power grid.”
U.S. News & World Report: Cybersecurity of the Power Grid: A Growing Challenge — Excerpt: "Until 2015, the threat was hypothetical. But now we know cyberattacks can penetrate electricity grid control networks, shutting down power to large numbers of people. It happened in Ukraine in 2015 and again in 2016, and it could happen here in the U.S., too."
BuzzFeed News: Here’s Why Trump Takes The Blackout Doomsday Scenario Seriously — Excerpt: “The Obama administration’s Energy Department announced $3.9 billion in ‘smart grid’ funding available to the nation’s utilities in 2009, largely for upgrades to defeat normal blackouts and permit home meters to talk back to power companies, but these EMP hawks still warn the overall grid is vulnerable to a knockout punch. Now under President Trump, who is eager to build infrastructure and appear strong on national security, they may finally have an ally in the White House.”
Bloomberg News: U.S. Grid in ‘Imminent Danger’ From Cyber-Attack, Study Says — Excerpt: “The U.S. Energy Department says the electricity system ‘faces imminent danger’ from cyber-attacks, which are growing more frequent and sophisticated, but grid operators say they are already on top of the problem.
In the department’s landmark Quadrennial Energy Review, it warned that a widespread power outage caused by a cyberattack could undermine 'critical defense infrastructure' as well as much of the economy and place at risk the health and safety of millions of citizens. The report comes amid increased concern over cybersecurity risks as U.S. intelligence agencies say Russian hacking was aimed at influencing the 2016 presidential election.”
The U.S. Energy Department’s 494-page report was released during the final days of the Obama administration, and it offered this clear warning for 2017 and beyond: "Cyber threats to the electricity system are increasing in sophistication, magnitude, and frequency. The current cybersecurity landscape is characterized by rapidly evolving threats and vulnerabilities, juxtaposed against the slower-moving deployment of defense measures."
The new report offered a long list of key findings for policymakers, and here are a few:
- Advanced metering infrastructure has had a significant impact on the nature of interactions between the electricity consumer and the electric system, allowing two-way flow of both electricity and information and enabling the integration of assets behind the meter into the larger electric grid.
- Interconnection standards and interoperability are critical requirements for seamless integration of grid connected devices, appliances, and building energy management systems, without which grid modernization and further energy efficiency gains may be hindered.
- Evolving consumer preferences for electricity services are creating new opportunities.
- The convergence of the electric grid with information and communications technology creates a platform for value creation and the provision of new services beyond energy.
- There is enormous potential for electric end-use efficiency improvement based on (1) technical analyses, and (2) the differences in energy efficiency performance between states and utilities with and without ambitious electric end-use efficiency policies and programs.
- There are no commonly used metrics for measuring grid resilience. Several resilience metrics and measures have been proposed; however, there has been no coordinated industry or government initiative to develop a consensus on or implement standardized resilience metrics.
- Low-income and minority communities are disproportionately impacted by disaster-related damage to critical infrastructure. These communities with fewer resources may not have the means to mitigate or adapt to natural disasters and disproportionately rely on public services, including community shelters, during disasters.
How Did We Get Here? A Short Smart Grid History Lesson
Back in 2010, Scientific American, in an article on Securing the Smart Grid, articulated the new cybersecurity challenges posed by our 21st-century power distribution: “Unlike the traditional power grid, a 'smart' grid is designed to accommodate a two-way flow of both electricity and data. This creates great promise, including lower energy prices, increased use of renewable resources and, it is hoped, fewer brownouts and blackouts. But a smart grid also poses several potential security problems — networked meter data, power companies' computers and those of customers could all be vulnerable to tampering.”
Maintaining resilient electrical power generation and distribution are essential elements in protecting every critical infrastructure area. The Department of Homeland Security houses the national response plans for critical infrastructure protection, and all of the sector-specific plans are inter-related in some way with the use of electrical power.
I wrote a CSO Magazine blog on how the federal government promised smart grid security back in 2009, and the key questions still remain the same in 2017 — even if the hacker scope of challenges have evolved.
Eight years ago I wrote: “One central question remains: Will the ‘smart grid’ be smart enough to stop hackers? Or in pragmatic layman's terms, can those ‘smart customer meters’ conserve energy, eliminate the need for the ‘meter man’ to keep running around our neighborhoods, allow us to turn down the home air conditioning from work and allow us to remotely start our ovens to get casseroles ready for dinner — without creating any ‘back doors’ for the inevitable bad guys?"
While there are tremendous global opportunities for smart grid advances and smart city innovations, the hackers could derail progress very quickly causing a major setback in smart grid technology adoption.
An Industry Discussion on YouTube
Two weeks ago, I was given the honor and privilege of participating in an online discussion led by IBM on 'Keeping the Lights On — Cybersecurity and the Power Grid.' The questions discussed included:
What emerging technologies and factors make power grid security such a priority today?
What are some of the challenges utilities face when trying to secure the power grid and how can they overcome them?
As utilities incorporate sensors and data from outside their private supervisory control, how do they manage the trust factor?
How to best incorporate cybersecurity concerns into the overall security plan for energy and utility companies.
What’s the role of government in helping to secure our power grids?
Besides myself, the roundtable discussion participants included:
— Steven Collier, Director of Smart Grid Strategies, Milsoft Utility Solutions
— Morgan Wright, Cyberterrorism and Cybercrime Analyst, and Principal, Morgan Wright LLC
— Bob Stasio, Senior Product Manager of Cyber Analysis with IBM i2 Safer Planet
To read the rest of this blog, including closing thoughts on what's next by Dan Lohrmann, please visit: https://www.govtech.com/blogs/lohrmann-on-cybersecurity/how-secure-is-our-smart-grid.html
To Follow Dan on Twitter: @govcso
Please leave your comment. Do you think our electric grid is safe from cyberattack? Why or why not?
Enterprise Cloud Risk Manager | Financial Services
8 年The concern isn't so much about Smart Grid, as it is about SCADA, and "the Grid". As it stands, the U.S. electrical grid is highly-susceptible to cyber attack. Remember what an interruption to a power transmission line did to the North Eastern U.S. about 15 years back, and that was nature and system controls at work (or failure). [https://en.m.wikipedia.org/wiki/Northeast_blackout_of_2003] It is my expectation that nation-states have and continue to probe the grid for weaknesses and vulnerabilities, and already have strategic approaches planned. Having those and executing them are two radically different things. There would be great risk in executing such a scheme, so any attempts are likely to be minor by comparison. I'm actually more concerned over non-nation-states (independents, thrill-seekers, hacktivists) than foreign governments. Foreign governments, like the U.S. government, wish to have as many options available as possible. It's the nature of war and strategic planning. We know there are weaknesses and vulnerabilities. There are solutions. Time to implement, funding, focus, and the scale of the efforts are barriers that must be overcome. Until and when those are surpassed, the very real threat will persist.
I am part of a team at AMCyber.org addressing these topics of securing critical infrastructure of all types. Feel free to message me if you need help.
Interesting. There are also a number of attack vectors using the contracting that lead to real consumer loss, rather than utility loss. I believe that some of these have already been exploited in some jurisdictions, e.g.: - get paid by the govt. to build parallel, air-gapped network to increase security, take the money and then get the technical spec changed so that you can avoid building the parallel infrastructure - over-specify the smart meters to meet business need for reducing the cost of managing disconnections, and get the consumers to pay. - bypass smart meters and directly interfere with lots of internet connected end equipment at the same time, creating power outage and over-billing chaos.
Global CISO| Diverse Talent| Technology Partner| Security Maturity Strategist |
8 年Often overlooked and ignored
At home in the R&D Lab, the Board Room, and the Classroom.
8 年I wrote this in 2013: https://www.embedded.com/design/real-world-applications/4413576/1/Securing-the-smart-grid-and-SCADA Not much has changed since...