Energy’s 10-year plan to protect the power grid from cyberattack

The Energy Department has released an updated cybersecurity road map for protecting the North American energy distribution and delivery system against increasingly sophisticated cyberattacks.

The road map is an international, interagency effort that sets a goal of making energy delivery systems resilient enough to withstand a cyberattack without interruption of critical functions by the year 2020. It lays out a risk management approach that builds on the industry’s track record of prioritizing and protecting critical assets.

“As cyber threats are fast-moving, multifaceted, well-resourced, and persistent, we need to ramp up efforts to effectively prepare and respond to them,” the document states.

Related stories:

Building an interoperable smart grid: IEEE weighs in

NIST, Europeans to collaborate on smart-grid standards

The effort was headed by the Energy Sector Control Systems Working Group, a government/industry collaboration that included the Homeland Security Department and its Canadian counterparts. It is an update of the "Roadmap to Secure Control Systems in the Energy Sector," published in 2006.

This is a separate effort from the standards-making process for the Smart Grid electricity distribution system now under way. The National Institute of Standards and Technology has been identified as the government led in that area and is working with industry and academia to identify technical standards that can be applied to new grid technology and to find gaps in the standards framework that need to be filled.

The Institute of Electrical and Electronics Engineers also has approved guidelines providing design characteristics for an interoperable smart grid.

Both versions of the working group’s energy system road map envision creating a secure system over a 10-year time span. The most recent release reflects developments in industrial technology and online threats in the last five years.

“Cybersecurity is a serious and ongoing challenge for the energy sector,” the 2011 road map states. “Although the ability of energy companies to assess and monitor cybersecurity posture has improved since the 2006 road map, real-time solutions are needed to keep pace with increasingly sophisticated cyber threats that are unpredictable and evolve faster than the sector’s ability to develop and deploy countermeasures.”

The document cites the Stuxnet worm, apparently designed to target specific industrial control equipment in a specific Iranian facility, as an example of a new type of threat to control systems used in the energy infrastructure.

The updated road map has a broader focus on energy delivery systems, including their industrial control systems, smart grid technologies, and the interface of cyber and physical security. New technologies being introduced into energy systems such as smart meters, as well as the increased use of mobile devices and new applications also introduce new vulnerabilities.

It also addresses needs for improved information sharing, vulnerability disclosure and cooperation among government, researchers and industry, and the need to develop a culture of security rather than compliance in the energy industry.

“Sustaining a secure and resilient energy infrastructure will not be possible without people trained in developing and implementing the best available security policies, procedures and technologies tailored to the energy delivery systems operational environment,” it states.

The road map outlines five strategies to achieve the vision of a secure, resilient infrastructure:

1. Build a culture of security.
2. Assess and monitor risk.
3. Develop and implement new protective measures to reduce risk.
4. Manage incidents.
5. Sustain security improvements over the long term.

One of the major challenges to achieving the goal is the difficulty of securing legacy systems, which can remain in the infrastructure for decades. Because a wholesale upgrade over the next decade is not feasible, securing these systems will require developing tools to monitor and control them, as well as patching them as updates become available.

“Hardening legacy systems requires the implementation of a patch management program to mitigate the risk of known vulnerabilities,” the road map states. It recommends developing a non-bootable hot patching capability that could be used across the entire system. “While some hot patching capabilities currently exist, they cannot be applied systemwide. To realize the full potential of this capability, hot patching techniques must be deployable throughout the system without harming operations.”

While the road map lays out a vision and strategies for achieving it, it does not come with any regulatory authority and will depend on the voluntary cooperation of the energy industry.

“Because the private sector owns and operates most of the energy sector’s critical assets and infrastructure, and governments are responsible for national security, securing energy delivery systems against cyber threats is a shared responsibility of both the public and private sectors,” it states. “We strongly encourage every stakeholder to take ownership of the vision and identify a goal or milestone to which they can contribute. Researchers, vendors, academia, policy-makers, and owners and operators need to join forces to confront the challenges we collectively face.”