Security (and other) Take-aways from GTM's Networked Grid 2010

I had the pleasure of attending and speaking at Greentech Media's annual Smart Grid conference in Palm Springs last week, and it was nothing less than a life affirming experience. One reason is because I finally got to see my first real wind farm and it was a doozy: thousands of turbines in one valley means you can drive at 70 mph for ten minutes and still find yourself surrounded by them. More on the San Gorgonio Pass Wind Farm can be found here.

But as with every good conference, it's the variety, depth of knowledge and generosity of the speakers and fellow participants that can make it a great experience. I had the privilege of moderating a strong panel on Smart Grid security topics that included:

• Saadat Malik, Cisco
• Rick Stephenson, Revere Security
• Tom Parker, Securicon
• Rilck Noel, Verizon Business

We began with this simultaneously humorous and cautionary anecdote from Smart Grid security guru, Massoud Amin of University of Minnesota, drawn from his most recent whitepaper:

Consider the following “sanitized” conversation showing the lack of awareness of inadvertent connection to the Internet for a power plant (200–250MW, gas-fired turbine, combined cycle, five years old, two operators, and typical multi-screen layout).

M.A.: Do you worry about cyber threats?

Operator: No, we are completely disconnected from the net.

M.A.: That’s great! This is a peaking unit, how do you know how much power to make?

Operator: The office receives an order from the ISO, then sends it over to us. We get the message here on this screen.

M.A.: Is that message coming in over the Internet?

Operator: Yes, we can see all the ISO to company traffic. Oh, that’s not good, is it?

The panelists then addressed a wide range of questions, some from me, and then some better ones from the attendees. The main message the panelists conveyed was that while the press loves to spread fears that Smart Grid vulnerabilities will create chaos, information on what's being done to secure the system in the trenches is the most effective counterbalance. These guys were good.

For me, though, the takeaways from this conference were several and often not directly related to security concerns. Here's three for you:

• In a Home Area Network (HAN) panel, after lots of discussion on new functionality for homeowners and their utilities and service providers, a man stood up, and, addressing CEOs from HAN start-ups, spoke with authority: "I see your focus is on new Smart Grid functionality and capabilities. But remember: reliability trumps everything. Don't forget it." He's right of course, and it was a sobering moment
• It was clear there was quite a bit of buzz about what microgrids might do to the industry, particularly from a business model point of view. Seemed to me that most of the utility pro's there might want to urge their orgs to get out in front of this movement before it goes around them
• Lastly ... Holy crap this Smart Grid thing is complicated and complex - so many moving parts - so much we don't know yet about its ultimate shape, size and function. Good luck to all of us !!!

Photo credit: Wikimedia Commons

The First Webcast is Up!

Ok, so it isn't as polished as Sixty Minutes, but think of it as Smart Grid Security cinema verite'.

Anyway, after much effort, a version of the recent webcast, "An Introduction to Smart Grid Security" is now available. We recommend you watch it in youtube HD (720p). It runs about 15 minutes in total, and and you can watch Part One here:

And you can watch Part Two here:


Because the slides look blurry in lower resolution video, and because you may want to use them yourselves at some point, we are making them available to you in their original form, here:

SGSB Webcast 1 Deck

While it is far from perfect, we finally decided just to get it out there because we wanted to get this one published without further delay. As this is our very first webcast for the blog, we are interested in your comments so that we can make the next one better, and more useful for you, our readers. Please hit the "What do you think?" feedback button, and let us know what you -do- think.

Thanks to all those who attended, and who asked questions during the session. We look forward to the next one, on May 26th, on "The Smart Grid and Data Security". See you (or you'll see us, I guess) then.

A Controlling Interest in Securing Utility Control Systems

Energy and utilities control system cyber security expert and firebrand Joe Weiss is making waves again, this time via an interview with CNET in which he describes the current state of progress (and its lack) in this most essential yet often overlooked Smart Grid domain. You see, when word got out that the previously tech-averse utilities were stirring thanks to this thing called the Smart Grid, IT and IT security professionals rushed to sell their services and wares to utilities' IT shops.

Little did they know (and some still don't) that they can market Intrusion Detection Systems (IDS), Intrusion Prevention Systems (IPS), Single Sign On (SSO), application firewalls, database security, pen testing and application security testing tools, not to mention NERC CIP compliance tracking and reporting systems and more ... till the cows come home, and still leave their utility customers, and their portion of the Smart Grid, woefully unprotected.

That's because of the other side of the house. You can call it field operations, or use an acronym like Operational Technology (OT); either way, it's a place where IT professionals fear to tread. And because of organizational culture reasons and the fact that SCADA-based operational systems are so unlike standard IT systems, the IT guys (vendors and utility employees alike) are generally unwelcome outside IT.

Weiss, a one man army, has been trying to get this message out to government and industry decision makers for years and is starting to make some significant inroads. Here's an excerpt from the CNET piece, though we highly recommend you read it all:

[A] utility's human resources network or their customer information networks are more cybersecure than any power plant, including nuclear, any substation, or any control center in the U.S. [Why?] Because the utilities got together and came up with a set of criteria, called the NERC critical infrastructure protection (CIP) standards. In those standards they input a number of exclusions and allowed them to self-define what would be "critical." NERC has put out emergency warnings on some of the areas that have been excluded, like telecommunications, but NERC CIPs specifically exclude them. Can you imagine doing a cyber assessment of your IT systems and being told "do not address telecom?" Because of the Energy Policy Act of 2005, electric distribution which is the heart of the smart grid is specifically excluded even though the electrons move from distribution to transmission and back. It simply doesn't make any sense.

Here's the full CNET Q&A. And while you're at it, you should read Forrester's take on the CNET-Weiss interview here. It's a little bit utopian in places, but it reminds us that we've been dealing with control systems security for years in other industries, and we like the emphasis on people vs. technology for a change, like here:

Deploying smart technologies is not enough. Take time to redefine existing processes and invest in people’s skills and education. You should invest the time and energy in marketing security and risk measures when deploying smart cities and smarter grids from day one.

Of course, the people Forrester is talking about dwell in both sides of the utility house. And if Joe Weiss had his way, there'd be more of an open floor plan, with security planning and implementation discussions reaching both IT and operations, and vendors and utility professionals alike understanding that their job's not done until they've secured the whole enchilada.

For more SGSB coverage of Joe's work, click here.

Photo Credit: George Campbell on Flickr.com

Calling all Energy Idealists, or: Where is Chris Davis?

For those of us immersed in energy matters in our day jobs, it may be hard to imagine that there's a virtual farm system out there where independent self-starters working in other fields imagine alternative uses of their energy. To whit, I wrote energy tech blogs for years before I had the good fortune of landing (via M&A) in a company that's staking its future on being an important part of our country's and the world's energy future. Now this has happened again, to a close friend of mine.

Not long ago my Air Force Academy classmate (1985) and Discovery Channel energy co-blogger Chris Davis wrote a post announcing my departure from Discovery, and the launch of two new blogs, one of which you're now reading. Well, the the tables are now turned and it's Chris who recently left his loyal readers wondering what became of him.

One of the last posts Chris did before wrapping up his Discovery Channel tech assignment was called "Visualizing the Electric Car 2015" and it gives you a feel for how forward-leaning his thinking is on renewables tech in general and Vehicles to Grid (V2G) in particular. Now, having transitioned from two decades of pure construction jobs to Dallas-based electric services co Facilities Solution Group (FSG), Chris is paid to pursue his passion.

Today he's active in North Central Texas Council of Governments (NCTCOG) future transportation initiatives, bridging his expertise and experience in the building industry with what he knows about electric cars, Smart and microgrids, to accelerate that organizations' great work. We talk all the time, and he's one of the happiest, most fulfilled people I know.

For anyone visiting this blog from a vocation far removed from Smart Grid, energy management and/or other renewables-enabling pursuits, and wishing they were closer to the action, please take courage from our examples. If Chris and I could make the leap, so could anyone. And the energy future needs many more talented, passionate people to get involved and make it happen.

Photo credit: Chris Davis on 4 Pass Loop Route, Snowmass, Colorado. Click on it for much larger version

Expectations, Communications, and Change

The introduction of the Smart Grid is about so much more than technology. The technology may make the data more accessible, the power more efficient, and the ecological impact more manageable, but the technology is only the catalyst or the capstone of a much more powerful underlying phenomenon. The Smart Grid represents a change to our earliest and most consistent and dependent relationship with technology, our consumption of electrical power.

In his April 9, 2010 remarks at the Brookings Institute, Author Peter Fox-Penner captured the essence of this very well when he said,

"...a technological revolution known as the smart grid will give all of us much more control over our own power use, enable the greater use of prices that vary by application and time, and allow the integration of dispersed generators in storage units. For the first time in the industry’s history, you and I will soon be able to see how much power we are using for each of our own applications and change our use in response to price signals and other grid controls."

This describes more than a means of improving the Grid's efficiency or reliability, it evokes a sea change in its approachability, in the intimacy and interactivity of our relationship with power, and this is really the make-it or break-it criteria for the Smart Grid as an evolutionary shift in our lives with electricity.

Some of us have probably had the experience of a similar change in a relationship: That individual for whom we have privately pined finally returns our interest. That car, so long a dream, can finally be owned, driven, and shown off. We finally put our names on the reservation list of a restaurant that we have only read about. Each of these represents a change in a relationship, like our changing relationship to electricity through the Smart Grid, and that change is not automatically smooth, because change is about expectation, distraction, disappointment, realization, and then hopefully, satisfaction.

Understanding the Cycle
There is a diagram that does a fine job of representing these various stages of a change in relationship, and it is called "Schneider's Classic Change Curve". It describes the path that our emotions run along as we finally achieve or acquire some end result that we have long hoped for. It is helpful, as we begin to see exuberance for the Smart Grid evolve into some cynicism or disappointment, to know these stages, and to understand the key role that communication will play in decreasing the depth and duration of the dips.

Schneider's Classic Change Curve

• Great Expectations for the Smart Grid
  When the Government forks over $3.4B in grant money to produce the very first steps in a new generation of infrastructure, it is natural to expect Bigger, and Better. Or Faster and Cheaper. Or More Open and Safer. These expectations have been building among the various constituents that have been on the receiving ends of the promotion and prototyping of the Smart Grid. Many other communities watch enviously, as dollars pour into making electricity more responsive, less expensive, and just as reliable. There is even a certain amount of panache that accompanies residency in a truly Smart City. Things are going to be great.
  
  
• Next Stop: Disappointment, Distrust, Despair
  The base element of such an enormous change is confusion. Motion and turbulence can create a very wide shadow, and the natural optimism of advocates makes some level of disappointment almost inevitable. When the first effort is smart metering, focused on optimizing time/capacity based rates, it is hard to see the actualization of the interactive dream. The realization that markedly more data and control is passing through the meter creates worries about the nature of the consumer's actual participation in the network. When bills go up, which they will naturally do without a dedicated campaign to change consumption behavior, all of those expectations and hopes are squandered against a backdrop of negative impacts, published risks, and rising costs.
  
  
• And Finally the Light at the End of the Tunnel
  Rational expectations, created through the painful collision of what is possible and what is happening, finally allow for an understanding of what is realistic to expect from the new grid. Pricing becomes comprehensible, delivery is understood, and people are much more capable of determining how they will participate: As simple Consumers or as Producers as well. There are no longer expectations based on communications: The survivors know what to expect because they have witnessed what is, and if it is sufficiently balanced, they will accept it.

In the Schneider diagram, there are two different paths through these changes, one "Typical", and one "Effective". It is obvious that "Effective" is less disruptive, drops less deeply into the pit of despair, and achieves a higher steady state. The difference between the two is communication. Clear communication is needed up front about timelines, functionality, tradeoffs, and priorities. By setting realistic expectations for outcomes, the risk of disappointment to the audience is very much reduced, because they know more clearly what they will be getting. During the course of actual deployments, more communication is needed on what is happening, what is changing, and what the resulting impacts will be on the consumer. This decreases both the depth and the duration of any dissatisfaction that might occur, and consistently level-sets the audience to a new family of expectations. During execution and roll-out, communication helps everyone to understand what activities are left, and what other activities might occur during the resolution of the project. By maintaining this open channel throughout the process, the path is much smoother, and there are many less surprises.

And Security?
Security requires perhaps the most attention of all. Unlike the roller coaster of experience that may typify the adoption of the general base of Smart Grid enablers, violations of security are often simply one-way tickets to the Pit of Despair regardless of the timing of their appearance. Communications on the various security concerns and new requirements must span customers, implementors, legislators, and enforcers, to achieve the common level of knowledge necessary to preclude a backlash. Recommended areas for clear communication and early exposure include:

• Full disclosure of all customer information to be collected, with rationales for collection
• Definition and assurances of protection for personal or private data and attributes
• Plans for incident response and communication in the event of a breach
• Opportunities for consumers to tailor or limit the information that they share, with any impact on services or pricing that they may receive.

In other industries, a lack of this type of transparency has led to long delays in adoption of more integrated technologies such as the federation of patient records in health care, or the broad adoption of electronic voting infrastructure. Understanding what will be shared, with whom, and with what protections, can alleviate both up front concerns and any sense of distrust or betrayal if accidental disclosure does occur. It can also surface, very early, when the public requires more protection or information in order to confidently participate.

We are already hearing voices of protest in the very young Smart Grid consumer community. Off-peak rates and AMI are seen as tools for increasing utility profits with little consumer value. The lion's share of grant money has gone to implementing technologies beneficial to running the Grid, and not to deploying cutting edge user-visible improvements. These early expectations for the grid were mis-set through the natural propensity of evangelists to expect the best and communicate that vision. There is still plenty of time to improve the honesty and realism of those communications, and utilities must be diligent in their efforts to present the reality of the solutions, the risks, and the benefits, and to dedicate themselves to educating their customers, and not simply to convincing them.

Schneider's Curve Image courtesy of iowalibrarian.com

Other Images courtesy of flickr

http://www.flickr.com/photos/roland/ / CC BY 2.0

http://www.flickr.com/photos/pagedooley/ / CC BY 2.0

Registration Now Open for the Smart Grid Security Blog (SGSB) Monthly Webcast Series Kickoff

We want to alert you of an upcoming series centered around topics from the Smart Grid Security Blog related to the roll-out of new Smart Grid and microgrid capabilities, particularly from a security point of view.

Brought to you courtesy of IBM, the 2010 Smart Grid Security Webcast Series is for anyone interested or involved in making the Smart Grid successful and secure. Our goal is to make actionable information available that will lead to better security, privacy & compliance decision making, and to do so in a way that entertains while it educates.

Webcast 1: Intro to Smart Grid Security and the SGSB webcast series (Apr 28, noon EST)

Agenda

-- Intro to webcast series
-- Current state description of the grid and the organizations who run and maintain it
-- Smart Grid Security intro:

• What is the smart grid and what are the compelling drivers for deploying it?
• What makes it smart?
• What new concerns arrive with smartness?
• How to plan to deal with these threats

Register to get Login and Dial-in information

Only your name and email are required to participate. REGISTER HERE

If clicking a link above does not work, please copy the entire link and paste it into your Web browser. For questions about this event, contact the host at: ashley.hodge@us.ibm.com

Hope to see you there!

Andy & Jack

Pushmi-pullyu: Utilities and Regulators Tussle over Forward-looking Projections vs. Backward-looking Reporting

What matters more for forecasting: imagining where you're going or describing where you've been?

We've had talks with utilities who, facing looming, life-altering technology, regulatory and business model changes, are trying to do more than merely recount the budgetary planning steps they've taken in previous years. We've also spoken with ones who aren't ready for this kind of change and don't want to hear about "future test years," for example.

But as the Washington Utilities and Transportation Commission (UTC) noted several years ago:

"... as imprecise as forecasting may be, projected test year data based on reasonable forecasts should consistently come closer to expressing future conditions than purely historic data will."

I'd say that's doubly and maybe triple-y true given the current and foreseeable state of major flux the industry is going to be in for the next bunch of years.

What has set this in motion, at least in part, is the Energy Independence and Security Act (EISA) of 2007, that lays out the requirement for utilities to get more future oriented in their thinking and planning. Here's the applicable part (Section 1307) that's causing some contention:

(a) Section 111(d) of the Public Utility Regulatory Policies Act of
1978 (16 U.S.C. 2621(d)) is amended by adding at the end the
following:

(16) CONSIDERATION OF SMART GRID INVESTMENTS-

A) IN GENERAL- Each State shall consider
requiring that, prior to undertaking investments in
non-advanced grid technologies, an electric utility of
the State demonstrate to the State that the electric
utility considered an investment in a qualified smart
grid system based on appropriate factors, including:

(i) total costs;
(ii) cost-effectiveness;
(iii) improved reliability;
(iv) security;
(v) system performance; and
(vi) societal benefit.

Sounds like a great idea to me, but of course I'm far removed from the operational trenches, not to mention the politics involved in these activities. As other language in the act stipulates, states don't have to play along with this guidance, and as this GTM article points out, North Carolina is just saying no. In the ensuing policy vaccuum, that leaves the state regulatory org, the NCUC, battling it out over what its utilities (Progress, Duke, Dominion) should be reporting on.

Fortunately, security reporting has survived in both the proposed NCUC guidance as well as in the counter proposals of two of the three utilities involved. But seems to me that in an industry where many of the constituents are embracing new information and energy technologies, new relationships with its customers and partners, and new ways of defining and monetizing its capabilities, stalling on EISA is a short-sighted rear-guard action.

In any sector, little, including security posture, is enhanced by clinging to outmoded planning and reporting practices. In battles between the past and the future, the future (almost) always wins. It'll be a great thing for all involved when the entire industry is moving in the same direction.

Imaginary animal credit: http://3dcadnews.blog.com/