Actions needed to address cybersecurity risks facing the electric grid (2019) [pdf]

https://www.gao.gov/assets/710/701079.pdf

by notadog • 6 years ago

55 16 6 years ago

bransonf• 6 years ago

This is one of those things that I hear the security community talking about a lot, but it has very little mainstream traction.

This actually surprises me because I would intuit that people would be drawn to hysterics about massive grid failures. Look at what happened in New York City.

And there are many smaller things that get even less consideration. Like the Tesla Powerwall Hack [0]

Either some big incident is going to happen that makes us shape up real quick, or we’re going to have a little foresight and proactively upgrade the security of our critical infrastructure.

[0] https://news.ycombinator.com/item?id=21610981

arkadiyt• 6 years ago

The senate passed a bill to study moving various electrical digital systems back to analog/manual control:

https://www.utilitydive.com/news/senate-passes-cybersecurity...

Stierlitz• 6 years ago

Have they ever given consideration to not connecting the Electric Grid to the Internet?

generatorguy• 6 years ago

How would I turn the power back on when it goes out? It would be a 6 hour drive for me to the power plant. I’ll take my odds with the VPN and satellite internet connection! If someone wants to cause an outage they can drive their car in to a power pole, have an earthquake drop rocks off a bank and crush the pen stocks, have a river change its course and take out 10 poles, send little animals on to the insulators to cause short circuits, have branches fall on the power lines, have droughts make the power plant run out of water... all those things already happened. if some nerd hacks in to my PLC they can’t do anything worse than I’ve already done! Someone physically breaking in to the building could cause a lot more damage, they could just burn it down!!

cheunste2• 6 years ago

send little animals on to the insulators to cause short circuits

You don't even need to do that as it happens organically. At my company, we had a comms outage to a wind farm for several days (and the outage was wide enough where even surrounding wind farms outside of my company were affected) and just two days ago, the LEC (Frontier) discovered a bird build a nest in one of the junction boxes which links up to all the plants. All of this happened in a span of five days or so.

motohagiography• 6 years ago

Worked on this problem 10 years ago, power distribution companies were sleepy enterprise environments with workforces who were just not equipped to respond to internet technologies, let alone threats. Even the lightweight requirements of NERC/CIP were treated as alien. The best security was in the smart meter infrastructure, which was designed around redundancy and combating fraud, but certainly not national security.

I don't think this is something we fix, it's something we evolve and move on from. My impression was the only real future relative to a grid security crisis is in storage and renewables, with more localized generation. The alternative is basically nationalization.

dreamcompiler2• 6 years ago

I worked on it back then too. As you say, the power companies have neither the money, the talent, nor the will to fix the problem. Getting a private company to spend money to prevent a hypothetical bad thing is always a tough sell, and most of the US grid is operated by private companies.

javajosh• 6 years ago

This could be fixed by a dramatic demonstration. Pick a medium sized metropolitan area, and authorize pentesters to try and take down the grid to the point of a (short) blackout - and make sure people know how it happened, and that a foreign adversary could do it to us.

(Perhaps an occasional electrical blackout is good for a society in the same way an occasional fast is good for a human body).

cheunste2• 6 years ago

Even the lightweight requirements of NERC/CIP were treated as alien.

I work in ICS for a wind company and this is shocking...even when you're working with other entities (regional, ISO, etc) in the same industry. Some entities don't even bother reading the details of NERC CIP V and completely bans you from even accessing their meters.

basicplus2• 6 years ago

It is poor decision making putting power systems on the internet.

All power companies have end to end land access and already have scada etc physical links between all switchyards and can run their own microwave links where necessary so no need for ANY infrustructure to be accecible from the internet.

Its lazy cheap decision making.

gHosts• 6 years ago

Sadly it looks like they have won so comprehensively.... they have stopped boasting...

https://cybersquirrel1.com/

The cybersquirrels have won.

BLKNSLVR• 6 years ago

This is my favourite: https://web.archive.org/web/20150827145912/https://au.news.y...

I remember reading a commentary on the cybersquirrel1 site introducing this "event" along the lines of: "In one of our more unusual operations..."

What this site beautifully illustrates is the entirely lax physical security of power substations and other distribution infrastructure that hundreds or thousands of households depend on. A distributed, coordinated human effort could destroy enough infrastructure to cause multiple days if not weeks of no electricity for a significant area. The kind of damage that would require the infrastructure to need rebuilding from scratch, or close to it.

jamestimmins• 6 years ago

Somewhat related, but the book Countdown to Zero Day is about both the Stuxnet worm and the potential for digital attacks on infrastructure. Very good read and intro to the topic. https://www.amazon.com/dp/B00KEPLC08/

ideonode• 6 years ago

There's actually a more recent book, Sandworm, which is specifically about cyberattacks on the power grid (in Ukraine). Recommended.

Actions needed to address cybersecurity risks facing the electric grid (2019) [pdf]

Related Stories