NERC's Cyber Education Role

Online tech mag Ars Technica recently wrote up the results of two reports on US energy infrastructure, one from the North American Electrical Reliability Corporation (NERC), and the other from a small cyber security company named LogLogic. The sum, for me, was a reminder of how far we have to go on enterprise Smart Grid cyber protection policy and implementation, and how little time we have to get there.

Referenced within the Ars article, is NERC Chief Security Officer (CSO) Michael Assante's April 2009 memo to electrical industry players. His calls for increased attention to cyber risks are still at the basic education level, as many of the targets of his guidance are from operations, and are still relatively new to the IT and cyber security domains:

... as we consider cyber security, a host of new considerations arise. Rather than considering the unexpected failure of a digital protection and control device within a substation, for example, system planners and operators will need to consider the potential for the simultaneous manipulation of all devices in the substation or, worse yet, across multiple substations. I have intentionally used the word “manipulate” here, as it is very important to consider the misuse, not just loss or denial, of a cyber asset and the resulting consequences, to accurately identify CAs under this new “cyber security” paradigm.

Excellent here that Assante keys on manipulation, as cyber attackers oftentimes achieve greater effects through means that at first appear quite subtle ... or aren't visible at all. At some point he's going to have to point out that a precursor to manipulation or outright attack is monitoring, often done by placing apparently benign software agents on target systems to collect data and await further instructions.

Assante also attempts to update industry thinking on the current grid's design that can usually handle large single points of failure. Cyber threats are often targeted less like sniper rifles and more like shotguns:

One of the more significant elements of a cyber threat, contributing to the uniqueness of cyber risk, is the cross-cutting and horizontal nature of networked technology that provides the means for an intelligent cyber attacker to impact multiple assets at once, and from a distance. The majority of reliability risks that challenge the bulk power system today result in probabilistic failures that can be studied and accounted for in planning and operating assumptions. For cyber security, we must recognize the potential for simultaneous loss of assets and common modal failure in scale in identifying what needs to be protected. This is why protection planning requires additional, new thinking on top of sound operating and planning analysis.

Thinking? Excellent. New thinking ... even better !!!