Darknet Hackers Grok Smart Grid "Opportunities" for Badness

Darknet is where the cyber good guys explore the dark side, with an eye on rooting out risk and shoring up defenses. This post makes it clear that one of the first thoughts an ethical hacker thinks when they imagine the power grid becoming a giant computer network, is: "[this] is a hackers playground!"

Also this:

The scary part is there’s no encryption and many things are done without authentication, meaning with a little reverse engineering you can probably shut down the power to anyone on the not-so-smart grid.

Discover(y) the Smart Grid

If you don't feel you've mastered all Smart Grid fundamentals yet, the Discovery Channel always makes learning a very engaging and entertaining experience.  This week they're focusing on the Smart Grid, so check it out here if you want to get even smarter than you are now.

Security Thoughts on Microgrid Nation

It was pointed out that the recent SGS Blog post on microgrids as a potentially faster/cheaper/better way to get to a modernized, more efficient power system left out one key detail: security ramifications. Well, two come immediately to mind:

1. If all communities (define as you will) are on separate power network islands, a problem on any one of them will have a lesser chance of impacting the larger system of systems. And that's a good thing
2. Less good might come of reliance on the same application or infrastructure software across communities. Today, one of the things that gives Apple and Linux users a little more breathing room against viruses and common attacks is the fact that they are not Windows systems replete with a who's who list of easy attack vectors. This is security through diversity. While cost efficiency and systems integration drivers would impel us towards standard apps and systems, we might do well to remember the benefits of technology diversity 

The Easiest Smart Grid Security Question to Answer

In a recent CSO magazine blog post titled "Hacking Power: Feds Promise Smart Grid Security" the author ponders:

... it remains to be seen if the new [NIST and FERC] specifications will be secure enough to stop the bad guys.

I don't want to be rude and mean no offense to the writer of an otherwise reasonable article. Yet though I hold no security patents, nor have ever written more than a few lines of Pascal in college, I nevertheless have plenty of experience to say with certainty:

Nothing remains to be seen. Specifications do not stop determined bad actors, on the Smart Grid or elsewhere.

Yet even more to the point: the question posed is not a useful line of inquiry. A more immediately practical exercise would be built around this idea: Despite the best efforts of standards bodies and technology providers, some, if not many, adversaries will successfully breach different lines of defense built into and around Smart Grid systems. Two questions worth asking, then, are:

1. How will the Smart Grid react? and,
2. What kind of experience do we want these attackers to have?

I bet you know the answers already, but mine would likely include the following key words: for 1) "resiliency", "redundancy" ... and for 2) highly "constrained".

Microgrid Nation

Have you ever read an opinion piece and been won over by the time you finished the second paragraph? Anya Kamenetz's recent Fast Company article, "Why the Microgrid Could Be the Answer to Our Energy Crisis" certainly had that effect on me, by making the intractable tractable. Along the way, it bursts the "energy superhighway" balloons of cleantech celebs Al Gore and Nevada Senator Harry Reid, and touts IBM and GE as large co's that get the microgrid vision.

See for yourself here, and when you're sufficienctly foaming at the mouth and ready to make it happen, here's Kamenetz's DIY micrgrid how-to manual for homeowners.

Danahy on Smart Grid Security in Government Computer News

As power controls take on characteristics more akin to cyber systems, the numbers and types of threats go through the roof. This article in GCN makes the case that FERC's current Critical Infrastructure Protection (CIP) standards and audit practices may be ill-suited to ensure protection of an increasingly Internet-like power grid.

Here's Jack's 2 cents in context:

But some security experts say the standards do not go far enough. The technology of the electric grid was designed with the expectation that it would be a private network rather than an interconnected IP-addressable system, and the security standards focus largely on reliability rather than network integrity.

“I don’t think in today’s world that is even close to being adequate security,” said Jack Danahy, chief technology officer of Ounce Labs. “There has to be a more expansive understanding of what security means.”

The cyber security of the power system is taking on more urgency with development of a new interactive smart grid and recent reports that hackers have compromised the current grid.

Funniest Smart Grid Article So Far

A outburst like this (on the present state of the home area network (HAN) portion of the Smart Grid) can only come from Jesse Burst, of course:

There are only two things wrong with today's in-home displays for energy management: (1) they suck for utilities and (2) they suck for consumers.

Among the encyclopedic list of HAN vendors shortcomings is a failure to appreciate homeowners' security concerns, as in:

When they talk to utilities, most HAN vendors reveal their lack of understanding of the utility charter and mindset. They chatter about entrepreneurial opportunity, or pioneering new markets, or liberating consumer data. They fail to discuss maintaining reliability, or justifying technology to regulators, or safeguarding privacy and security.

For full article click here.