As Russians hack the U.S. grid, a look at what’s needed to protect it
optional.
U.S. federal rules, as well as those set by the agency that governs the North American grid – which also includes large parts of Canada – require companies operating elements of the bulk power system to follow certain basic cybersecurity measures, including monitoring their networks to detect intrusions and mandating two-factor authentication for user logins.
Many large utilities do even more, assessing their risks in standardized ways and practicing responses to computer intrusions. These exercises often include hundreds of companies and organizations rehearsing how to collaborate to detect and confine attacks and restore service to customers.
Smaller companies are more vulnerable
Because transmission grid utilities should already have some protections against network intrusions, it is likely that the Russian hackers looked elsewhere, infiltrating smaller distribution utilities. If that’s so, any potential power shutdown or other problems in those systems would be confined to smaller areas – like towns or cities. That, in turn, means fewer customers would be affected, with less work needed to get power back on.
But it highlights a worrying reality: Smaller and midsized companies that operate electricity distribution systems often have inadequate resources to invest in full cybersecurity protections. The more than 3,000 utilities in the U.S. have trouble finding sufficiently skilled workers who understand how the computerized and physical components of the grid work together and how to protect them.
In addition, utilities rely on complex supply chains to provide equipment, software, maintenance and other business functions. These external contractors and vendors may not implement protections as rigorous as the utilities. And their computer systems often have connections to the utilities’ networks, which may be considered trusted and safe, rather than potential avenues of attack.
Stepping up defenses
Fixing all these potential problems is complex. First, all utility companies – even the smallest – should adopt basic security protections like those required of large utilities. Some states are moving to require this of the power companies serving their residents, but many aren’t yet. Further, we recommend all companies that are part of the grid participate in coordinated grid exercises to improve cybersecurity preparedness and share best practices.
In addition, all utility companies need to take steps to ensure the hardware and software they use are from trustworthy sources and have not been tampered with or modified to allow unauthorized users in.
It won’t be enough to protect against today’s threats. Adversaries are likely to employ increasingly sophisticated techniques that exploit both computer and human vulnerabilities. Companies need to ensure they engage in what might be called sustainable cybersecurity – ongoing processes that let systems and staff adapt over time, to stay ahead of the threats.
Researchers have an important role too, exploring ways that emerging technologies like cloud computing, blockchain and big-data analytics could help reduce risks without introducing any additional weaknesses. Further, researchers should identify more advanced ways to secure the grid, and reduce these systems’ complexity, which would limit both current risks and future unknowns.
Manimaran Govindarasu is Professor of Electrical and Computer Engineering, Iowa State University. Adam Hahn is Assistant Professor of Electrical Engineering and Computer Science, Washington State University. This article is published courtesy of The Conversation.
