A look at the U.S. smart grid cyber security posture
The increasing reliance on software in the energy industry brings more smart grid cyber security issues, as well as a greater risk of cyber attacks.
There are three main components of any energy network: generation, transmission, and distribution. The modern energy industry has come a long way since it was a simple web of electrical devices. The system, now called a ‘smart grid,’ involves a highly integrated network of hardware and software components performing high-end computing and decision-making activities with minimal human involvement. The addition of such complex components to the basic energy grid attributes to the ‘smartness’ of the smart grid.
As such networks grow, there’s an increasing need for software that can make that network more efficient and robust. With the rise in software usage comes increased risk of cyber attacks on the smart grid. This can not only damage the energy industry’s reputation, but also the very basis of life in modern America.
Smart grid cyber security issues
When it comes to smart grid cyber security issues, it is not only the security of the hardware and software components that are important. Accurate security configuration and integration measures play a huge role in determining the overall security posture of the network. In other words, a defense-in-depth methodology must be implemented in the smart grid to protect the whole network.
Loopholes and improper practices in current and legacy implementations have paved the way for cyber attackers from around the world to get their hands on smart grids. On average, a physical or cyber attack occurs on the U.S. power infrastructure once every four days, based on reports submitted to the U.S. Department of Energy (DoE) by utility companies on power reliability.
A statement made to USA Today by Scott White, professor of homeland security and security management and director of the Computing Security and Technology program at Drexel University, sums up the security situation within the energy industry ideally:
“The potential for an adversary to disrupt, shut down (power systems), or worse … is real here today.”
Professor White’s statement is all too true. Sadly, this potential has been ‘real’ for some time now. The lack of spotlight on smart grid cyber security is an issue which should have been addressed decades ago. NATO has compiled a list of cyber attack incidents that illustrate that this has been an issue for some time. This is due to the general misconception that the importance of cyber security in the energy industry is minimal in comparison to other, more attractive targets such as the financial industry. This misconception leaves the energy sector as a lucrative target for cyber criminals.
Past attacks and their future implications
Attackers from around the globe have leveraged such misconceptions (and of course many other security issues in the smart grid energy network) to attempt hacks on information systems containing critical data about the nation’s power grid, nuclear weapons, and research in the U.S. According to USA Today, over 1,300 of these attack attempts were made between 2012 and 2014, with a success rate of over 10%. A reported 53 of these attacks were successful due to root compromise (resulting in the attacker having super user privileges on the host). Ninety of these attacks were aimed at gaining access to research conducted by the Office of Science within the Department of Energy.
Such numbers are alarming, to say the least, for anyone interested in smart grid cyber security.
One of these targeted attacks, taking place in 2013, provided unauthorized access to personally identifiable information (PII) of over 100,000 energy sector employees. The attack was attributed to the shortfall of awareness among officials responsible for sensitive information management in 41 servers and 14 workstations which had been configured to use default or easily guessable passwords.
Although initiatives have been implemented to prevent attacks such as this, throughout the years, the attention to detail with regard to security issues in the smart grid have proven insufficient and have many shortcomings. It will come as no surprise, if events such as large scale black outs or nuclear data compromise occur in the near future. Cyber attackers have proven to be many steps ahead of the infrastructure systems.
Proactive measures within the U.S. energy industry
Due to an increasing number of cyber security issues in the energy sector, cyber vulnerability assessment (CVA) is an annual requirement for electric utilities that must comply with the North American Electric Reliability Corporation Critical Infrastructure Protection (NERC CIP) plan. Securing assets within the energy industry should be one of the top priorities for the U.S. government through the creation of prescribed security policies to which the energy industry must abide. To tackle such situations, we need minds that can think like cyber attackers.
