Cybersecurity issue

From Jones Oil in Ireland… a very good graphic description of the way hackers can get into the smart grid and how that can affect you:


How A Smart Meter Can Shut Off Your Home’s Power [Infographic] – By the team at Jones Oil
>John D. McDonald, P.E., IEEE Fellow, and Director, Technical Strategy & Policy Development, GE Energy Management – Digital Energy

The connected grid is more vulnerable today than 15 to 20 years ago. Previously, our communications was primarily serial, point-to-point, and our communications protocols were proprietary. If a hacker was able to penetrate this system, they would be limited to the grid between two communication points, and would be limited to what they were able to do, since the communications protocol (bit pattern) to operate a device (e.g., open a breaker to cause an outage) was proprietary and very difficult to obtain. Today, new installations have moved to network communications (TCP/IP) using industry standard communications protocols (e.g., DNP3 which is now IEEE 1815). If a hacker is able to penetrate this system, they would have extensive reach on the grid (the network) and be able to operate a device using an industry standard bit pattern to communicate. In other words, the advances in communications have brought significant benefits but have made the grid more vulnerable to cyber attack.  

>- 06 March 2014  Evidence collected by the US Department of Homeland Security (DHS) suggests that cyber-attacks on key energy infrastructure – and on the electricity system in particular – are increasing, both in frequency and sophistication. And worryingly, new research shows that the risk of a successful large-scale cyber-attack, or combined cyber and physical attack, on the electric power sector is “significant.” 

>Excerpted from: Planning Elements for Consideration in States’ Energy Assurance Plans

National Association of State Energy Officials 

As a precursor to the smart grid effort, it is important for States to understand the nature of the risk and the threat of cyber attacks. Examples of cyber attacks include the following:
         In 2001, hackers penetrated the California Independent System Operator, which oversees most of the State’s electricity transmission grid; attacks were routed through California, Oklahoma, and China.
 Ohio’s Davis-Besse nuclear power plant safety monitoring system was offline for five (5) hours due to the Slammer worm in January 2003.   In March 2005, security consultants within the electric industry reported that hackers were targeting the U.S. electric power grid and had gained access to
U.S. utilities electronic control systems.
         In April 2009, the Wall Street Journal reported that spies hacked into the U.S. electric grid and left behind computer programs that could allow them to disrupt service.


         The Stuxnet Worm was reported in an Industrial Control Systems Cyber Emergency Response Team Advisory on September 29, 2010. Stuxnet is a Malware Targeting Siemens Control Software. It can be used to infiltrate industrial control systems used in the power grid, power plants and other infrastructure. It is reported to have the ability to damage or possibly destroy control systems.
        Associated Press on August 4, 2010 reported “Hackers Try to Take over Power Plants.” In September 2010, cyber experts discovered for the first time a malicious computer code, called a worm, specifically created to take over systems that control the inner workings of industrial plants.
         The North American Electric Reliability Corporation (NERC) and DOE released a report titled High-Impact, Low-Frequency Event Risk to the North American Bulk Power System (June 2, 2010)16 that identifies a certain class of high-impact, low-frequency risk shown to have the potential to significantly affect the reliability of the North American bulk power system. The report examines three high-impacts, low-frequency risks in detail: coordinated cyber, physical, or blended attacks; pandemic illness; and geomagnetic disturbances and electromagnetic pulse (EMP) events.
Consider and address the human element of cyber security. While this is the final step, in many ways it is also one of the most important. It represents a serious ongoing vulnerability, and therefore it is critical to assure that it is properly addressed.

1                    Understand what the insider threat is and what policies and procedures are in place to prevent intrusion and manipulation.2                    Understand what social engineering is and how it can be used to access systems.3                    Understand that technical solutions to security should account for human behavior, which can be driven by both cultural and psychological factors.4                    Understand the nature of the threat from employees, contractors, consultants, or anyone with short or long term access to information technology systems, and know about system vulnerabilities.

5                    Understand that the effect of new systems on consumer behavior could be both a plus and a minus. It could strengthen security or incite actions to attack the system.


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s