Mariana Hentea - Building an Effective Security Program for Distributed Energy Resources and Systems

Overcome complex coordination and cooperation challenges, internally across governmental bodies and with nongovernmental stakeholders, both at the domestic and international levels

Develop and implement action plans according to their strategies in a variety of areas such as critical information infrastructure protection, research and development, skills and jobs, economic incentives, cybersecurity exercises, etc.

Although the protection of critical information infrastructures is generally included in the scope of cybersecurity strategies, the issue of cross‐border interdependencies is rarely addressed at a strategic level.

A national cybersecurity plan is not only a strategic framework for nation's approach to cybersecurity; it is also a tool to improve the security and resilience of national infrastructures and services. Although there are many – and considerably different – definitions, a cybersecurity strategy has proven to be an instrument that helps governments manage the efforts of all involved parties in order to tackle risks related to cyber issues at a national level [ENISA 2015a]. Therefore, international and regional cooperation is needed at strategic levels to include the development of contingency and response plans in advance as well as the importance of regional and international exercises.

The electric grid, as government and private experts describe it, is the glass jaw of American industry. Energy‐related risks to national security can broadly be categorized into physical, cyber, economic, and conflict related, though significant overlaps among these categories exist.

Cybersecurity and industry experts have expressed concern that, if not implemented securely, Smart Grid systems will be vulnerable to attacks that could result in widespread loss of electrical services essential to maintaining the national economy and security in the United States [GAO 2012]. Besides describing cyber threats to critical infrastructures, which include the electric grid, the report discusses key challenges to securing Smart Grid systems and networks.

Often, reports on cyber threats to electrical sector are published by media. A reporter describes a threat and the impacts of threat realization as follows:

If an adversary lands a knockout blow, it could black out vast areas of the continent for weeks; interrupt supplies of water, gasoline, diesel fuel and fresh food; shut down communications; and create disruptions of a scale that was only hinted at by Hurricane Sandy and the attacks of Sept. 11. [Wald 2013]

Although this scenario sounds like a piece of science fiction, the reporter is warning the public about the fragility of the electric system that is tightly integrated that a collapse in one spot, whether by error or intent, can set off a cascade of power failure.

Another warns about the electric utility industry lacking adequate protection, and a major cyber threat to critical infrastructures is from the electric utilities [Weiss 2013]. While facts and impacts are not yet encountered by the electrical sector as described in these publications, we need to understand the dangers of cyber threats including other issues. Energy technologies must be robust and resistant to these vulnerabilities.

At least we have to consider that in today's highly connected world, with an increasingly sophisticated cyber threat, it is unrealistic to assume energy delivery systems are isolated or immune from compromise [Hawk 2014]. The grid is essential for almost everything, but it is mostly controlled by investor‐owned companies or municipal or regional agencies. That expertise involves running 5 800 major power plants and 450 000 miles of high‐voltage transmission lines, monitored and controlled by a staggering mix of devices installed over decades.

Some utilities use their own antique computer protocols and are probably safe from hacking – what the industry calls security through obscurity [Hawk 2014]. Also, cybersecurity in the IT/OT systems for the Smart Grid continues to be a significant topic and has been made even more critical by the convergence of IT/OT [Meyers 2013]. This convergence has enabled an enabled a new range of consumer‐based OT, most of which is beyond the reach or control in the traditional utility. Therefore, an IT/OT‐converged approach allows utility personnel to deploy each grid modernization application project as a part of a connected whole.

Cybersecurity is a serious and ongoing security, safety, and economic challenge for the electricity sector. The critical role of cybersecurity in ensuring the effective operation of the Smart Grid is documented in legislation and in the DOE energy sector plans (e.g. [DOE 2011]).

Securing the grid is one pillar of the framework set forth in the policy of Energy Independence and Security Act of 2007, and the Recovery Act of the Federal Government [EISA 2007] states:

It is the policy of the United States to support the modernization of the Nation's electricity transmission and distribution system to maintain a reliable and secure electricity infrastructure that can meet future demand growth and to achieve each of the following, which together characterize a Smart Grid:

1 Increased use of digital information and controls technology to improve reliability, security, and efficiency of the electric grid

2 Dynamic optimization of grid operations and resources, with full cybersecurity.

Security of grid implies safety and protection of assets, organization, consumers, and public from threats (intentional and unintentional) including natural disasters. Cybersecurity for the Smart Grid needs to support both the reliability of the grid and the security (and privacy) of the information that is generated, processed, transmitted, stored, or disposed. Defined in broad terms, cybersecurity for the power industry covers all issues involving automation and communications that affect the operation of electric power systems, the functioning of the utilities that manage them, and the business processes that support the customer base [NISTIR 7628r1].

Cybersecurity solutions for energy infrastructure are imperative for reliable energy delivery. While reliability remains a fundamental principle of grid modernization efforts, reliability requires cybersecurity [Hawk 2014], [P2030 2011]. As the need for cybersecurity increases, this work [Hawk 2014] discusses energy sector partnerships that are designing cybersecurity for the Smart Grid with the vision of surviving a cyber incident while sustaining critical energy delivery functions.

A recently released document [DOE 2014b] provides guidance and requirements for cybersecurity features for the supply chain vendors and manufacturers of equipment, devices, and software used in power systems. Also, NIST's three‐volume document [NISTIR 7628r1] provides guidance to organizations for cybersecurity and privacy strategies, architecture, requirements, supportive analyses, and references.

Ensuring a resilient electric grid is particularly important since it is arguably the most complex and critical infrastructure that other sectors depend upon to deliver essential services. Figure 2.14is a schematic representation of electricity sector interdependencies with other sectors of the economy. Each infrastructure depends on other infrastructures to function successfully. The potential impact of the increasing threats in the electricity sector is amplified by the connectivity between information systems, the Internet, and other infrastructures, creating opportunities for attackers to disrupt the electricity sector and other critical services such as banks, government, transportation, etc. [GAO 2012].