The availability of spectrum for utility communications networks, heightened consumer protection and privacy concerns, cloud computing and its application to the smart grid, supply chain security – these are just some of the policy and regulatory issues that could have a significant impact on utilities as they integrate millions of data points for more efficient control of the modernized grid.  Attention has been focused on compliance with NERC-CIP mandates and passing audits, but what is their place in the broader security picture?  Will other policy developments change the landscape of grid security?

1. Security
of
the
Electric
Grid:
It’s
more
than
just
NERC-­‐CIP
Prudence
Parks
Director
of
Government
Affairs
and
Legisla've
Counsel
U?li?es
Telecom
Council
EnergySec
Summit
Portland,
Oregon
September
26,
2012
©
2012
U'li'es
Telecom
Council

2. What’s
on
the
Security
List
Besides
NERC-­‐CIP
• Spectrum
for
Communica'ons
• Standards
Development
• Security
of
Cloud
Compu'ng
• Privacy
&
Civil
Liber'es
• Supply
Chain
• Jurisdic'onal
Authority
Changes
©
2012
U'li'es
Telecom
Council

3. Spectrum:
It’s
in
Short
Supply
• U'li'es
and
other
CI
rely
on
private
internal
communica'ons
networks
to
support
core
services,
including
electric,
gas
&
water
• U'li'es
have
NO
spectrum
dedicated
to
their
exclusive
use
• Data
generated
by
SG
needs
bigger
pipes
• Diversity
of
terrain/remote
coverage
makes
lower
bands
preferable-­‐
but
also
eyed
by
commercial
service
providers
• U'li'es
auc'on
exempt
BUT
auc'on
revenue
aSrac've
to
Congress
©
2012
U'li'es
Telecom
Council

4. Spectrum:
The
Challenges
• Federal
spectrum:
PCAST
Report
– Commercial
wireless
compe'ng
for
access
to
spectrum
– Federal
incumbents
reluctant
to
share
or
relocate
• Public
safety
spectrum
– Sharing
700
MHz
requires
nego'a'on
and
may
take
considerable
'me
before
the
PSBN
is
available
– 4.9
GHz
spectrum
is
subject
to
loose
coordina'on
rules;
pushback
from
public
safety
• Outsourcing
to
Commercial
Service
Providers
– Meet
CI
requirements?
– Non-­‐mission
cri'cal
func'ons
– Mission
cri'cal:
Loss
of
control;
compliance
with
NERC/CIP
©
2012
U'li'es
Telecom
Council

5. Standards:
Na?onal
v.
Interna?onal
• Four
different
efforts
in
3
bodies
most
prominent
in
the
space
• IEC
62443-­‐2-­‐1
–
Industrial
communica'on
networks
-­‐
Network
and
system
security
-­‐
Part
2-­‐1:
(hSp://webstore.iec.ch/webstore/webstore.nsf/Artnum_PK/44613)
• IEEE
2030-­‐2011
-­‐
IEEE
Guide
for
Smart
Grid
Interoperability
of
Energy
Technology
and
Informa'on
Technology
Opera'on
with
the
Electric
Power
System
(EPS),
End-­‐
Use
Applica'ons,
and
Loads,
2011
(hSp://standards.ieee.org/findstds/standard/2030-­‐2011.html)
• IEEE
P2030.4
Drai
Guide
for
Control
and
Automa'on
Installa'ons
Applied
to
the
Electric
Power
Infrastructure
(under
development)
(
hSp://standards.ieee.org/develop/project/2030.4.html)
• ISO/IEC
JTC1
SC27
Study
Period
on
Smart
Grid
Environments
(in
progress)
• NIST
authorized
to
develop
SG
standards
in
the
US,
so
trumps
interna'onal
standards
• But
ISO
&
IEC
standards
recognized
by
WTO,
can
be
integrated
into
trade
agreements
©
2012
U'li'es
Telecom
Council

6. Cloud
Compu?ng
&
SG
–
Is
it
Secure?
• NIST
Publica'on
800-­‐146
by
the
Computer
Security
Division
of
the
Informa'on
Technology
Laboratory
(
hSp://www.thecre.com/fisma/wp-­‐content/uploads/2012/05/
sp800-­‐146.pdf)
• Security
issues
of
communica'ons
links
between
user
and
cloud
• SGIP
considering
whether
security
standard
for
cloud
compu'ng
as
it
pertains
to
SG
should
be
developed
• Issues
to
be
addressed:
– What
are
the
proper'es
of
the
SG
that
could
be
unique
to
cloud
compu'ng?
– Are
there
issues
that
prevent
cloud
compu'ng
for
SG
applica'ons,
such
as
latency?
– Are
other
cybersecurity
groups
looking
at
SG
cloud
compu'ng?
– Can
a
shared
cloud
be
created
for
u'lity
industry
with
hardened
security?
©
2012
U'li'es
Telecom
Council

7. Privacy
and
Civil
Liber?es
• NIST
SGIP
forming
privacy
subgroup
for
next
version
of
NISTR
7628
• Over
200
bills
in
Congress
dealing
with
privacy
• Inability
to
arrive
at
compromise
on
cybersecurity
bill
not
just
whether
should
include
CI
protec'ons,
but
how
protect
privacy
and
civil
liber'es
of
consumers
• Issues:
– What
can
u'li'es
do
with
Smart
meter
data
– Protec'on
of
informa'on
shared
with
exchanges
and
the
Government
– Length
of
'me
that
the
data
can
be
kept
– What
type
of
informa'on
can
be
collected
– No'fica'on
requirements
if
security
breaches
©
2012
U'li'es
Telecom
Council

8. Security
of
the
Supply
Chain
• Defini'on:
Informa'on
and
Communica'on
Technology
(ICT)
products
are
assembled,
built,
and
transported
by
mul'ple
vendors
around
the
world
before
they
are
acquired
without
the
knowledge
of
the
acquirer
• Abundant
opportuni'es
exist
for
malicious
actors
to
tamper
with
and
sabotage
products,
ul'mately
compromising
system
integrity
and
opera'ons
• Much
publicized
incidents
(counterfeit
hardware
sold
to
government
agencies)
• Organiza'ons
acquiring
hardware,
soiware,
and
services
are
not
able
to
fully
understand
and
appropriately
manage
the
security
risks
associated
with
the
use
of
these
products
and
services
• Challenges
range
from
poor
acquirer
prac'ces
to
lack
of
transparency
into
the
supply
chain
©
2012
U'li'es
Telecom
Council

9. This
is
how
Department
of
Defense
Depicts
This
Challenge
Scope
of
Supplier
Expansion
and
Foreign
Involvement”
graphic
in
DACS
www.soiwaretechnews.com
Secure
Soiware
Engineering,
July
2005
ar'cle
“Soiware
Development
Security:
A
Risk
Management
Perspec've”
synopsis
of
May
2004
GAO-­‐04-­‐678
report
“Defense
Acquisi'on:
Knowledge
of
Soiware
Suppliers
Needed
to
Manage
Risks”
©
2012
U'li'es
Telecom
Council

10. Who
will
be
in
Charge?
• Legisla'on
puts
DHS
in
charge
of
Na'onal
Cybersecurity
Council:
voluntary
or
mandatory
standards
for
CI
protec'on?
• DOE:
Guides
for
ARRA
recepients;
NARUC:
Regulators
guide
• Execu've
Order:
– DHS
in
charge
but
cannot
expand
on
exis'ng
authority
– Senator
Lieberman
to
WH:
:
“I
urge
you
to
explore
any
means
at
your
disposal
that
would
encourage
regulators
to
make
mandatory
the
standards
developed
by
the
Department
of
Homeland
Security
pursuant
to
your
execu've
order
so
we
can
guarantee
that
our
most
cri'cal
infrastructure
will
be
defended
against
aSacks
from
our
adversaries.”
• FERC
establishes
Office
of
Energy
Infrastructure
Security
– To
focus
on
poten'al
cyber
and
physical
security
risks
to
energy
facili'es
under
its
jurisdic'on,
including
EMP
©
2012
U'li'es
Telecom
Council

11. Conclusions
• Spectrum
is
key
to
Smart
Grid:
lack
of
spectrum
capacity
causes
patchwork
systems,
push
to
use
commercial
systems
outside
u'lity
control
• Standards
for
the
SG
are
s'll
being
developed
to
include
security
issues
• SG
means
terabytes
of
data
and
may
increase
use
of
cloud
compu'ng,
with
addi'onal
security
issues
• SG
means
Energy
Management
using
consumer
data
and
added
privacy
protec'on
and
data
security
• SG
means
applica'ons
manufactured
without
transparency
of
supplier
security
• Jurisdic'on
over
mandatory
cybersecurity
standards
may
reside
in
mul'ple
agencies
and
departments
with
mul'ple
audits
©
2012
U'li'es
Telecom
Council

12. Thank
you!
For
more
informa'on,
contact:
Prudence
Parks,
prudence.parks@utc.org
202-­‐833-­‐6806
©
2012
U'li'es
Telecom
Council