Presentation introduces Chief Security Officers (CSO's) and others with responsibility for protecting companies and their customers to what they need to know about the coming Smart Grid

1. Smart Grid for the CSO Jack Danahy Co-Author : The Smart Grid Security Blog October, 2009

3. Who would recognize their brainchild? Alexander Graham Bell Father of the Telephone Network Thomas Alva Edison Father of the Grid ( and snappy dresser ) ?

9. A Smarter Grid IS coming : market forces demand it Expectations of Financials Markets Regulatory & Policy Changes Technological Advancements Customer Expectations Aging Assets & Workforce Dynamics Volatile Energy / Fuel Costs Security Environment & Climate

11. What does a Smart Grid look like? Img courtesy: www.smartgrid.epri.com

12. The Smart Grid is NOT without risks Risk to Critical Infrastructure Inconsistent information sharing and collaboration among stakeholders Private sector controls over 90% of critical infrastructures High degree of social, economic dependence on digital systems Deperimeterization and new customer touch points into networks Uneven application of security engineering to increasingly complex systems Growing capability of adversaries and growing number of exploits

15. Thus there are multiple scenarios to plan for… External Threat Insider Threat Accidental Event Intentional Event Malware Denial of service Sophisticated, organized attacks Natural disasters Economic upheaval Changing Political Climate Unpatched systems Code vulnerability Lack of change control Human error or carelessness Undiscovered back doors Information theft Insider fraud

16. Issues and Items to Understand Terms, Technologies, and Tough Questions

24. Where to begin, a checklist. Manage Identities and Access: Create processes for ensuring appropriate access control to planned strategic energy management and monitoring systems Protect Data and Information: Ensure capability for granular protection of unstructured & structured data, data leak prevention and acceptable use policy monitoring Control Software and Application Releases: Process for assuring security, efficiency and integrity of any custom or contracted software development Manage Change and Configuration: Mandate regular process for routine, emergency and out-of-band changes that will minimize or prevent operational outages Understand and Address Threats and Vulnerabilities: Continually monitor systems and expert resources to remain informed on protection for enterprise infrastructure for new and emerging threats Implement Security Information and Event Management: Automate the process of auditing, monitoring and reporting on security and compliance posture across the enterprise Manage Problems and Incidents: Designate responsibility and ownership for any issues in security, reliability, or power quality, and their investigation. Maintain trained event forensics team or create relationship with expert provider Attain visibility into organizational power strategy: Develop and maintain risk profiles and lists of potential and planned partners and technology acquisitions Provide Security Training & Ensure Awareness: Ensure awareness of security issues in ppower and power facilities by providing consistent training to end users and operators

25. The Smart Grid IS coming … Get Ready

26. Questions? Jack Danahy Co-Author : The Smart Grid Security Blog smartgridsecurity.blogspot.com [email_address]