April 15, 2009
Foreign intruders have entered the country. But they did so from the comfort of their living rooms or offices. The news that the Russians and the Chinese are alleged to have hacked their way into the nation's electrical grid and left behind secret codes that could later wreak havoc is distressing -- but not unpredictable.
The risks are greater now than ever before. The total interconnectivity of networks through the Internet has given hackers new ways to get critical information. That's why the North American Electric Reliability Corporation has developed standards for utilities when it comes to protection of their information systems. Indeed, power grids are susceptible to not just worms and viruses that can disrupt business but also to large-scale onslaughts intent on completely shutting down systems.
"Cyber security is an area of concern for the electric grid," says Rick Sergel, head of the reliability corporation. "Though we are not aware of any reports of cyber attacks that have directly impacted reliability of the power system in North America to date, it is an issue the industry is working to stay ahead of. There is definitely more to be done."
In this latest case, the attack caused no damage to the grid. But it could have and it shows vulnerability of the infrastructure. In fact, once the invaders find a way inside, they can just navigate to other and more salacious spots. At risk is not just the transmission system but also national defense.
Government officials say the culprits' intent is unknown. They could be deviants, who in the past have infiltrated other national grids for the purpose extorting money. Or, they may be part of a government-sponsored undertaking -- a proposition that both the Russians and the Chinese vehemently deny. It's a plausible position, given that the electricity network is the seed from which the America economy sprouts, which by extension helps to feed the global market place as well.
The issue has long been of concern to utility executives. The industry, in fact, is estimated to fend off hundreds -- if not thousands -- of cyber attacks each year. For its part, the U.S. government has allocated billions to safeguard the system. It's an endeavor that the Obama administration is likely to beef up now that the Pentagon has said it just spent $100 million repairing damages caused by hackers, all in the past six months.
"Over the past several years, we have seen cyber attacks against critical infrastructures abroad, and many of our own infrastructures are as vulnerable as their foreign counterparts," says Director of National Intelligence Dennis Blair, who testified before a congressional committee. "A number of nations, including Russia and China, can disrupt elements of the U.S. information infrastructure."
Changing World
In the post 9/11 environment, the U.S. Department of Energy designated NERC as the electricity sector coordinator for critical infrastructure protection. It now works closely with Homeland Security and Public Safety Canada to ensure integrity of every power plant and transmission line.
The organization adopted its cyber security standards in 2006, which have been incorporated into the nation's electric reliability standards. As such, each utility must now prioritize its facilities and assets as well as characterize potential risks based on historical accounts. Furthermore, emergency plans must be prepared and practiced.
More recently, a Democratically sponsored bill would shift responsibility for cyber security from the private sector to the federal government where a cyber czar would oversee the effort. Under any scenario, the Obama administration's investment in the smart grid sets out to replace older and less technically formidable technologies with advanced tools that could better detect and ward off attacks.
Utilities, meanwhile, are trying to adapt to this changing world. The evidence suggests that while no company has ignored earlier advisories, those entities have varied understandings of what is required of them. In fact, all of the utilities interviewed by government regulators are taking steps to mitigate or to stop such breaches.
Their strategies may differ. Some are wires companies while others are focused on generation. Each year, though, they are supposed to certify with the Federal Energy Regulatory Commission that they have developed robust systems that can continue to generate and deliver power if attacked. A failure to meet that target could result in being denied the privilege of participating in the wholesale market, or the right to buy and sell power as well as interface with systems that do transact commerce.
The specific steps that individual utilities are taking are highly secretive because they do not want any would-be intruder to learn their defense mechanisms. But it is a more coordinated effort, which contrasts sharply to the period prior to 9/11 when grid security was essentially a piecemeal approach. Indeed, the roughly 3,000 electric and gas utilities had all used proprietary methods to protect their systems. Now, though, things are changing. But more remains to be done.
"There now are a large number of pathways at most utilities and a determined hacker --particularly one backed by a less-than-benign government, such as China or Russia --likely will find one," says Warren Causey, vice president of the Sierra Energy Group, a division of Energy Central. "If cyber spies can, and have, breached networks at the Department of Defense in Washington, to assume they could not do so to the U.S. utility industry is naive to the extreme."
It's a menacing challenge. But information specialists must stay ahead of their would-be attackers. A major lapse could have far-reaching consequences. And that's why the public and private sectors are increasing their vigilance and trying to advance the technologies to shield utilities and other industrials from malfeasance.
More information is available from Energy Central:
Respond to the editor.
Ken Silverstein EnergyBiz Insider Editor-in-Chief
Read Ken's Blog
