Conference Alert: FERC Technical Conference - Taking a Measured Breath Before Resuming Smart Grid Standards March

As a standards development project, NIST and crew have moved with breathtaking speed. The time has come for the community to weigh in, and for FERC to see if "sufficient consensus" exists to begin to formalize these standards. Here are some of the details for you:

Title: Technical Conference on Smart Grid Interoperability Standards

To refresh: the five "foundational" standards and their functions are:

• IEC 61970 and IEC 61968: Providing a Common Information Model (CIM) necessary for exchanges of data between devices and networks, primarily in the transmission (IEC 61970) and distribution (IEC 61968) domains
• IEC 61850: Facilitating substation automation and communication as well as interoperability through a common data format
• IEC 60870-6: Facilitating exchanges of information between control centers
• IEC 62351: Addressing the cyber security of the communication protocols defined by the preceding IEC standards

Click HERE for the original NIST press release on "the five."

Conference Description: The purpose of the technical conference is to obtain further information to aid the Commission’s determination of whether there is “sufficient consensus” that the five families of standards posted by the National Institute of Standards and Technology and included in this proceeding are ready for Commission consideration in a rule making proceeding, as directed by section 1305(d) of the Energy Independence and Security Act of 2007.

Day/Time: Jan 31, 1-5 pm ET

Additional details, including live link: HERE. You're also free to attend in person in DC.

Zen and the Art of Smart Grid Security

I'm not sure how to say his last name, but there's a lot to like in  John Traenkenschuh's metaphor:

We bikers know that risk is something that can be mitigated, to a point. Risk remains, and it's our job as safety pro's to limit impact and help the organization, the rider, steer a reasonably secure, er, safe course. 

... and also this:

Nothing I can do can wash away all the security risks with all the IT systems we're paid to protect; in much the same way that no amount of training I might provide you will remove all risk from riding a motorcycle. Instead, let's focus on forcing a quick alert if, maybe WHEN the attack occurs? 

This short article is not specific to our industry, and is actually written more from a vendor's point of view than a technology user's, but because survivability is a crucial backstop to good security, and certainly adds to peace of mind, there's more HERE that applies.

Photo credit: Don DeBold on Flickr.com

Teaching the Old Grid New Tricks ...

... will require students versed in the art and science of engineering, including (but not limited to) electrical engineering. We used to say that in the future we'd need these folks. Well, with the recent passing of 2010, the future is beginning to look more and more like the present.

A present in which ...

A great deal depends on whether power companies can find and attract a sufficient number of engineers capable of designing, managing and maintaining the new systems the smart grid demands. And that’s by no means certain. The Center for Energy Workforce Development estimates that by 2015, 51 percent of the power-engineering workforce will need to be replaced because of retirement or attrition. And that’s just to maintain current levels. To drag our aging grid into the 21st century will require power engineers trained in the most sophisticated communications and control concepts.

Seems like the old immovable object about to be whacked by an irresistible force. In a tough job market, this much need can't and won't go unfulfilled for long.

This article quotes a manager at AEP as saying these vacant engineering roles will be filled by new personnel from one of three sources: re-trained internal folks, university programs and vendors. University investment in new teachers and courses has been constrained to say the least. Though the last word may belong to the DOE, which just slapped down a cool $100 million on the counter for Smart Grid training programs.

At the bottom of the article you may notice one reader asks "Just engineers?" The answer, of course, is of course not. Increasingly, folks with training in business and economics are called for as the old business models are poised for a most thorough revision.

And as for cyber security pro's to watch over the systems designed and built by the new crop of inspired engineers and business folks, they're going to likely come from vendors for a while longer, until organizations like SANS and the new NBISE can get a bunch more out the door with the requisite energy sector chops ... like a firm grounding in SCADA/ICS, for instance.

Photo credit: USAFA (my alma mater) graduation by Beverly & Pack on Flickr.com

Preview of 2011 Smart Grid Security Conferences

Happy New Years Eve Eve. As we say goodbye to 2010, here's a look at what's coming up next year, conference-wise.

NIST Smart Grid Cyber Security Conference
Northeastern University, Boston, MA
18 January, 2011
Details: HERE

Smart Grid Security East
Enernex
1-2 March 2011
Details: HERE

European Smart Grid Cyber Security Forum
London, UK
14-15 March 2011
Details: HERE

Also, be on the lookout for another European conference (in Amsterdam) from the same team that hosted the first 2-day conference on Smart Grid Security in August 2010 and that's running Smart Grid Security East. This page gives you a round-up of that first conference, and here's a write-up I did on the blog when it was over.

And as always, keep your eyes open for conference and workshop announcements from NIST, IEEE, DOE and others as the year progresses - I'll try to spot them early and list them here to give you as much advance notice as possible.

Meanwhile, please have a safe and fun night tomorrow night.

Photo credit: MoLeY2k on Flickr.com

The Counterintuitive Security Benefits of a Sub-Optimal Smart Grid

Even though I’d always take the worst form of government in the world except for all the others, over all the others, sometimes one might be forgiven for longing for a country with an omnipotent, benevolent, entrepreneurial, clear-thinking, decisive, dictator (see above). Perfect, centralized direction could crush cultural and bureaucratic inertia, and make sector modernization a lot simpler than it is in some places right now. Right?

Consider the situation in the US and other countries where power, particularly power over power systems, is distributed across many organizations. Earlier this month, Pike Research Smart Grid analyst Bob Lockhart responded to a few questions regarding the state of grid security ownership. You can read this exchange HERE.

Lockhart notes that in the US, the bulk of the electric system (not to be confused with the Bulk Electric System) falls outside the jurisdiction of Federal authorities. The burden for guiding and protecting the distribution system belongs to the utility regulatory offices in each state, each which sets its own policy. It should also be noted that in the absence of Federal policy on privacy, that too is left to each state.

It's Good to be King
In countries where the utilities are 100% owned and operated by the government (not normally a very effective or efficient approach I am compelled to mention), the guy(s) in charge can move directly to issues of how they want to develop and operate their grid, how fast they want to modernize, and how much security rigor they want to enforce ... or not. I mean, who's going to tell them "no"?

But Kingship has its Limits
Lest we envy other authoritarian countries' ability to orchestrate grid changes too much, even the world’s most powerful, best intentioned dictator could only do so much with the current slate of challenges that comprise the overall Smart Grid security challenge. Imagine you were this dictator and wanted to bring rapid, comprehensive security improvement to your nation's electric infrastructure ... what would you do with the following:

• Employee awareness and education. Email, web use, mobile, USB and other removable media safe use practices, etc. Would the death penalty for policy violations due the trick?
• Ensuring compliance with emerging interoperability and security standards, internal and international. Actually, if you're a real pariah state, who cares about international?
• Making sure new grid systems, those built by utilities themselves as well as by vendors in the supply chain, are developed with security baked in from the get-to, applying Secure by Design principals. This is important on both IT and operational technology (OT) systems like SCADA and Intelligent Control Systems (ICS). How to motivate the supply chain is a big issue. I mean, you can't kill your suppliers, right? 
• Devising rules and standards for comprehensive security controls for grid systems, from generation, transmission, distribution, consumption and edge. You're going to SMEs for this,and unless you've completely sealed your borders, many of these folks long since departed to countries where they were paid fairly for their expertise.

In these issues and others, the dictator may find his wickets just as sticky as those facing other governments. And there’s another aspect that levels the playing field on behalf of countries with multiple layers of jurisdiction and guidance that varies by region or state. Countries with government owned monopolies may establish large, country-wide sourcing contracts which tend to homogenize the equipment that gets deployed. This is great for interoperability, but makes in easier for an attacker who, once in, can potentially cause great and widespread harm via a single point of attack (note: Stuxnet's apparent success on systems sourced from just two suppliers) .

The Security Benefits of Variety
Lockhart sums it nicely:

... countries with a government monopoly grid can take a one-size-fits-all approach. On the down side for them, that implies that a single attack against their entire national grid could be successful and there is probably a single point of attack for that grid. Here in the USA we have over 3,200 utilities -- some with millions of customers, others with a few thousand. So obviously they are not going to all be running on the same infrastructure and therefore the same security approaches will not work for all. It is not unthinkable that some smaller utilities will end up clients of service providers running cloud computing environments. Those will probably be private clouds, but still a centralized, third-party cloud. Personally I think that’s a good thing because small enterprises cannot afford as sophisticated security as a large-scale integrator of clouds will implement.

Agreed. So maybe the takeaway is that as much as we rail against and lament the chaos, inefficiency and sub-optimality of our current approach, it is, from a security perspective and with apologies to Voltaire: the best of all possible worlds.

Photo credit: Allstar/Paramount/Allstar

A 2010 End-of-Year Glimpse Behind the SGSB Curtain

No, I'm not going to show you how this blog's sausage is made. Instead, wanted to give you an idea of who else is partaking on a regular basis as one indicator of which countries and organizations are taking grid security most seriously, or at least are most curious about it.

The following is a simple list, in order from most to least, of which countries read (in English only) the Smart Grid Security Blog the most often in 2010.

Top ten

USA, Canada, UK, Germany, India, France, EU, South Korea, Australia, Japan

The rest in order

Netherlands, Italy, Brazil, Belgium, Israel, Singapore, Spain, Sweden, Ukraine, Taiwan, Philippines, Iran, Switzerland, Ireland, Malaysia, Portugal, Finland, New Zealand, Denmark, Greece, Indonesia, Norway, Pakistan, South Africa, Russia, Mexico, Austria, Poland, Turkey, Hong Kong, Thailand, Czech Republic, Romania, China, Egypt, Chile, Columbia, UAE, Saudi Arabia ... and more.

A few other details while we're at it

In 2010, a typical day at the SGSB saw visitors from a 15-20 different countries read this blog, a third arriving via Google or Bing, another third via FeedBurner email subscriptions (over 600 now and counting), and the rest coming from links in articles and on other sites.

In terms of types of organizations these folks come from (which you can sometimes see and sometimes not), all or most of the larger US, Canadian and European utilities, Federal and State regulators, technology and services providers, and universities are all well represented.

While millions-of-hits per day sites like the Drudge Report and ESPN.com have little to fear from the SGSB, I'm expecting a slow and steady up-tick in readership next year as more Smart Grid initiatives roll out, as standards begin to mature, and as new business models emerge and evolve. Not to mention threats and responses.

Had a great 2010 - thanks for being a part of it. Looking forward to 2011 !!!

Photo credit: havankevin on Flickr.com

Looking Back and Looking Forward on Smart Grid Cyber Security at GridWise 2010

As Mark Twain (or Hemingway, Cicero, Voltaire, Blaise Pascal or George Bernard Shaw) once said "If I had more time, I would have made it shorter." That's true of the 25-min audio that accompanies  - feel free to fast forward. But believe you'll find the content here interesting, and depending on your line of work vis a vis the Smart Grid, maybe even helpful.

GridWise 2010 Cyber Security Update

View more webinars from Andy Bochman.

There were several good questions and comments during the Q&A session that followed, but the one I appreciated most was that this wasn't the typical doom and gloom message that typifies many energy sector security presentations.  I count that as good news as that is a design objective. As we've said before, no good work gets done by people in the fetal position. And we've got plenty of work to do.

For more from GridWise here's a LINK to the organization's cyber security resources page. These are great people moving mountains as they advocate for Smart Grid progress. Highly recommend you give them your support and/or get involved if you haven't already.