Day Zero (Pre-Conference Work Shops) News from Smart Grid Security East

The conference hasn't started yet, but it's been a great day here in Knoxville nevertheless, as 3 concurrent workshops are keeping all the early birds busy:

• AMI Security
• NERC CIPs
• Control System Security

While most attendees are getting deep immersion in these subjects from 10 am - 5 pm today, with my short attention span and desire to get the broadest impression, I've jumped from session to session to session. In addition to getting some valuable updates to what's going on in these three domains, I'm getting to put faces to names of people only met online before.

Tomorrow the conference kicks off for real with opening remarks from Enernex's Erich Gunther and a NIST 7628 update from Marianne Swanson and Daniel Thanos.

FYI: Have been doing a little tweeting using the #smartgridsecurityeast tag and plan to continue tomorrow. HERE's the official site for the conference. Stay tuned for more ...

"How Stuxnet Spreads" and How to Slow it Down ... plus an Updated Stuxnet Dossier

If you've had enough of Stuxnet at this point, I wouldn't blame you. In fact, if your job has nothing to do with making sure your utility is operating with as little operational risk as possible ... or more specifically, protecting ICS/SCADA systems from present and future targeted attacks, you should probably just move on and do something else right now.

If you're still with me, however, you should read this just-released white paper: "How Stuxnet Spreads – A Study of Infection Paths in Best Practice Systems," written by a small cadre of highly capable subject matter experts. Here's where they pivot from describing the worm (which they do very well now that it is more fully understood) to articulating helpful remediation steps:

Is the situation hopeless? We certainly do not think so; we do believe that ICS/SCADA security best practices must improve significantly. First, the industry needs to accept that the complete prevention of control system infection is probably impossible. Determined worm developers have so many pathways available to them that some assets will be compromised over the life of a system. Instead of complete prevention, the industry must create a security architecture that can respond to the full life cycle of a cyber breach. One area that needs attention is in the early identification of potential attacks....

More goodness ensues. And if that leaves you hungry for more, you'll want to check out Symantec's recent update of their authoritative Stuxnet dossier, available HERE.

Job posting: Chief Scientist, Cyber Security Research, PNNL

Have you seen any idle Chief Cyber Scientists flipping burgers or hanging out at Starbucks lately? Perhaps there's one in your circle of family and friends. Well, you might ask them if they're ready to get back in the game. 

Please forward them this opening:

Chief Scientist, Cyber Security Research
Location: Richland, Washington
http://jobs.pnl.gov/ Job ID: 300553

Pacific Northwest National Laboratory is searching for a Chief Scientist to provide research leadership for emerging key elements within our Cyber Security portfolio. The goal of this portfolio (both initiatives and client driven research) is to extend PNNL's R&D capability to enhance the science of complex cyber-dependent infrastructures, supporting adaptive systems, enhancing attribution capability, and utilizing cyber analytic techniques. Large scale infrastructures are subject to change of many kinds: change in the type of attacks which are launched, newly discovered (or newly introduced) vulnerabilities, and modifications to purpose. This results in a highly dynamic system that is not amenable to traditional testing or validation approaches. The approach is to consider change from a strategic and tactical perspective, and support the design of systems capable of maintaining their integrity through automated or semi-automated adaptations. The result will be to enable persistent time-critical cyber infrastructure.

Our S&T agenda is focused on:

• Data Intensive Cyber Fusion - real-time analysis of high-disparate data sets to support attribution ability to fuse traditional cyber sensor data with video, social, cultural, and economic indicators.
• Robust Control System Security - Management and measurement of trust relationships with exponentially growing distributed control environment, while maintaining integrity of transactions and interoperability between devices.
• Continuity of Cyber Operations - enable the survivability of time-critical infrastructure in order to achieve mission objectives through capabilities in situational awareness, forensics, resilience, and reparation.
• Autonomous Cooperative Defense machine speed analytics that can detect, assess, and provide cooperative tipping and cueing regarding cyber threats to address the speed, frequency and volume of cyber attacks.

In addition to providing research leadership, the Chief Scientist will lead research, projects and proposals within our growing Cyber Security capability base. The Scientist will work with our other senior scientists, research leaders and management in developing strategies for advancing research within the National Security Directorate, lead proposal development, deliver new technologies and capabilities, and interact with key clients. Successful candidates would also be responsible for leading the transition of these concepts to be deployed within the national/international community.

Requirements:

• There will be a review of a candidate's academic and research credentials by an appropriate peer committee before an offer can be extended.
• Technical contributions must be recognized as having a substantial impact on advancing the current state of knowledge and understanding in scientific or technical disciplines. Demonstrated track record in devising innovative cyber security solutions and transitioning that research to industrial and/or government clients.
• Experience in technical leadership for software/hardware research and development.
• Demonstrated leadership, networking, organizational, negotiating, communications, and mentoring skills, coupled with the desire and ability to interact with clients, prepare successful research proposals, and define future research directions.
• An extensive publication record is required, as is a demonstrated track record of successful research proposals and/or industrial technology transfer.
• The ability to represent the Laboratory at national and international events is expected.
• Scientist Level V: Ph.D. with 5+ years of experience is required. Must be a national or international authority and be applying intensive and diversified knowledge of scientific or engineering principles in broad areas of assignments and related fields. Must have a widely recognized national or international reputation, proven research track record including demonstrated funding history.

The person they want to speak with is:

Jill Schroeder, Senior Recruiter, National Security Div.
Pacific Northwest National Laboratory
Tel: 509-375-6563
Jill.Schroeder@pnl.gov

Good luck!

2011 Smart Grid Security Summer School Announced

Summer school this year, so maybe there'll be an Outward Bound Smart Grid adventure camp in 2012? Here are the details:

With support from DOE and DHS, we are proud to present the "Cyber Security for Smart Energy Systems" Summer School organized by the Trustworthy Cyber Infrastructure for the Power Grid (TCIPG) Center. The summer school will be held in the Q Center, St. Charles, Illinois, which is less than an hour away from Chicago's O'Hare Airport, June 13-17. 

An overview of the objectives and topics for the summer school is provided in the attached document. Details on registration, the program, and travel logistics will be available soon HERE.

You may contact Rakesh Bobba (rbobba@illinois.edu) or Scott Pickard (spickard@illinois.edu) if you have questions, comments, or suggestions. We very much hope that you can join us, and we look forward to an exciting summer school.

Stuxnet Update: Anonymous Speaks Up

You'd think an international network of cyber activists (aka: attackers) with a name like Anonymous would want to keep as low a profile as possible. Not so, it seems.

In a post late last year I posited that we'd likely be seeing attackers go to school on Stuxnet and release their own modified and likely re-purposed versions. The post also cited a thoughtful and reasonable approach for dealing with these follow-on attacks.

Now (in case you missed it) comes Anonymous boasting that they've got Stuxnet code and threatening that they may use it to pursue their anarchic aims. Lovely.

So, I'd say it's long past time for sober minded utility cyber security professionals (and those who assist them) to get cracking on how they're going to:

1. Greatly limit the open doors in their networks, systems and apps through which Stuxnet-like attacks can enter, and, 
2. Be developing and testing their emergency response plans to ensure they can recover from successful Stuxnet-ish penetrations as rapidly as possible

Texas Rolling Black Outs and the Not-Yet-Smart Grid

Analyst Chet Geschickter of Greentech Media wrote a nice piece about the blackouts Texas experienced earlier this month. You might say, hey, weather-induced power outages aren't caused by security problems. To which I would reply, oh yeah? The brittleness of the grid is one of its most significant vulnerabilities ... one that we now have the means to repair, though not necessarily the will to do so in the short term.

So may we continue? Here's Chet:

Rolling blackouts are a last-resort load shed tool ... [but while] demand response provides more orderly demand cascading ... it is limited to a few businesses with discretionary power needs -- like refrigeration compressors in supermarkets. A hefty chunk of the business sector is more sensitive. 

Then he continues ...

The residential market has huge potential for both electricity and natural gas peak curtailment, especially if and when large-scale consumer Home Area Network (HAN) technology adoption occurs.

That's a big "if" ... and maybe even a bigger "when". Now let's turn to an actual official in the thick of this event in Texas, quoted in a piece from the Wall Street Journal:

Many users didn't know their power was coming down, and officials said they should have issued more alerts so customers could prepare."It is something we have never experienced before," said Trip Doggett, the grid operator's chief executive, adding that "dramatically more" plants shut at one time than ever before. 

The good news?

By turning to the use of rolling outages, the grid operator prevented a statewide blackout that could have lasted at least 50 hours, Mr. Doggett said.

The bad news? The detail that that grid operators either couldn't communicate with their customers en masse, or else forgot to. I'd bet on the former. The Smart Grid is, if nothing else, about improving efficiency of operations and customer experience via better communications throughout the system. Ahem (throat clearing sound) ... I said, better communications.

Photo credit: (Texas based) J-5 Electric

Software Security for Energy Sector Control Systems

John Cusimano has just written a great piece for anyone concerned with the software that runs energy (and other) sector control systems. It's called "Demanding Software Security Assurance" and you can read it HERE.

My own involvement in the software assurance domain is skewed towards IT and data center systems, but our work appears to intersect in a document referenced in the article. "Enhancing the Development Lifecycle to Produce Secure Software, version 2.0" was published in 2008 by the DoD's Data and Analysis Center. Here's an excerpt:

Software Assurance has emerged in response to the dramatic increases in business and mission risks that are now known to be attributable to exploitable software, including:

• Dependence on software components of systems despite their being the weakest link in those systems

• Size and complexity of software that obscures its intent and precludes exhaustive testing

• Outsourcing of software development and reliance on unvetted software supply chains

• Attack sophistication that eases exploitation of software weaknesses and vulnerabilities

• Reuse and interfacing of legacy software with newer applications in increasingly complex, disparate networked environments resulting in unintended consequences and the increase of vulnerable software targets

Asking utilities to detect and protect every weakness in every system they deploy is unrealistic. More manageable, is to ask (or better, demand) suppliers develop and deliver secure systems to their customers, especially those running components of critical national infrastructure. As Cusimano says:

It is refreshing to see a point of view that recognizes that industrial control system security is not just a problem that owners and operators of industrial facilities need to address. Of course, owners/operators are ultimately responsible for the safety and security of their facilities, but that responsibility needs to be shared with their automation equipment suppliers.

For a lighter treatment on a related subject, you can see and hear a webcast I did on Smart Grid software security last September by following this LINK.