Austin's Amazing, Ambitious Pecan Street Project

In addition to its well deserved reputation as a mecca for technology and live music, Austin is a Smart Grid development hot bed, not doubt about it. Code named (non threateningly enough) after a street named after a nut, the Pecan Street Project is going to be fun to watch. It begins in a city that's already miles ahead of the competition, with intelligent meters deployed in large numbers since 2003. In case you're wondering, that's long before the term Smart Grid ever rolled off anyone's lips.

It's all captured simply in the project's four stated initiatives:

1. Austin will develop a clean energy public/private research and development consortium. Its mission will be to research and develop clean energy technologies and distributed generation systems on Austin’s grid.
2. The consortium will create an economically sustainable distributed generation system. Unlike any other “smart grid” project in America, the Pecan Street Project intends to develop a new distributed generation system that integrates clean energy into an economically sustainable business model. The Pecan Street Project will provide the consortium with access to Austin’s grid to test and develop this new system.
3. Austin Energy will open its grid to entrepreneurs and researchers to test prototype technologies in the real world. We aren’t just going to build a lab – the City of Austin will be the lab.
4. We will implement this model locally and system-wide. Once the consortium creates the new distributed generation system, Austin will show the world how it works. We will do that by using this system to develop the locally produced clean energy equivalent of a new power plant.

Can you imagine what would happen if this was going on in YOUR town? What are the security implications of going this far this fast? If it doesn't work out well can the project be unwound without too much pain and suffering? You can read more about it on the official PSP web site here, and check out IBM's take on it here.

Photo: Wikimedia Commons

Smart Grid Security at Black Hat

For those not familiar with Black Hat, it's mecca (in Vegas) for many on both sides of the cyber wars. This year the Smart Grid will be there too, with folks from security services firm IOActive describing their work uncovering vulnerabilities in some of the hardware and software used to build Smart Grid pilots.

From IOActive's EnergyPulse site, here's a piece of secure programming 101, adapted accordingly:

The challenge to building a secure smart grid power infrastructure is to quickly enact methods that support both asset owners and smart grid vendors. Typical of most emerging industries and first-to-market initiatives, the smart grid AMI community lacks a formal Secure Development Lifecycle (SDL) to guide and govern the release of sound quality technology and products.

Government Computer News has the conference heads-up here. And here's the Black Hat site itself, with everything you need to know about how to get the most out of the conference which runs 25-30 July.

Smart Grid Security and Some Timely Truths Re: Industrial Control Systems

Industrial Control System (ICS) expert Joe Weiss of Applied Control Solutions presented on the Cyber Security implications of control systems at a recent Air Force Cyber Security symposium. This is new ground for CIOs and cyber professionals reared on IT systems and networking and these findings are important on their own.

However, in the context of the emerging Smart Grid, they are a timely and necessary wake up call. Two categories speak clearly to visitors from the IT world: which haracteristics of typical ICS deployments differentiate them from IT, and some popular security misconceptions or myths many harbor about them:

General ICS Characteristics

• Management – Generally CIO not responsible
• Administration – Generally not centralized
• Patches – Generally not frequently applied (no patch Tuesday)
• Threats – Unintentional is very important
• Obsolescence – ICS replaced after 15-20 years
• Remote access – Often necessary
• Certifications – Not available yet
• Educations/training – Needs to be for ICS

ICS Security Myths

• Using Windows and TCP/IP “make it IT
• External malicious threats are always the biggest concerns
• Firewalls make you secure
• VPN / encryption use makes you secure
• IDS will always catch control system attacks
• Higher-to-lower security zone connections are always more secure
• Field devices can’t be hacked
• You are secure if hackers can’t get in

It's worth your while to see Weiss' full presentation if control systems are new territory for you ... and the odds are, they are.

Senate Energy Bill Love or Hate

The National Journal recently put out a question asking how folks liked the recently approved Senate Energy bill (details here). Good responses from energy company execs and other senior leaders came back, but I particularly liked the balance and focus on realism in the one submitted by Econ professor Paul Sullivan of NDU:

In many ways the bill is a set of first steps toward something much better, or at least one would hope. It does read like it was written by powerful people who see the problems of climate change and energy security not as nearer term crises, but as slow roll issues that are looming somewhere in a future horizon. It also shows some of the difficult tradeoffs between energy security and environmental security being handled in tough-minded political ways.

Challenge: Name a Company NOT Diving into Smart Grid Market

Ladies and Gentlemen, please welcome AT&T to the party. InformationWeek has the announcement here.

Danahy: New Metaphors Needed for Cyber Threats

A new post is just in from colleague Jack Danahy re: the ill fit of the timeworn "Cyber Pearl Harbor" call to security arms. The Pearl Harbor analogy, like similar recollections of Cold War diplomacy, recalls a simpler time when you knew who the enemy was and what his capabilities were. Alas, 21st century threats, including cyber threats to internet, communicaitons and now, energy networks, have proven resistant to similarly neat classification:

If an attack comes, we will not find ourselves face to face with an attacker ready to do battle, but with a dark and gauzy space where we can only strike at shadows and hope by luck to hit something. Protection against these threats will come only with awareness and responsibility, and a sense among all of us, that we are responsible for our own protection.

You can read the whole post here.

Microsoft Joins the Smart Grid Fray

Only question I can think of is: what took them so long? As with Bing, the Redmond company's long awaited response to Google's dominant search platform, it seems Microsoft is late to the party. Still, it's not clear that Google's early mover status in the nascent Smart Grid market buys it all that much.

Here's Microsoft's smart grid approach described by PCWorld. I wonder how the "blue screen of death" translates in the energy world? Or if we'll be ctl-alt-deleting our homes a few times per week?