Smart Grid for the CSO

5,336 views

Published on

Presentation introduces Chief Security Officers (CSO's) and others with responsibility for protecting companies and their customers to what they need to know about the coming Smart Grid

Published in: Business, Technology
  • Be the first to comment

Smart Grid for the CSO

  1. 1. Smart Grid for the CSO Jack Danahy Co-Author : The Smart Grid Security Blog October, 2009
  2. 2. <ul><li>Setting the Stage </li></ul><ul><li>Drivers for an Evolution in Grid infrastructure </li></ul><ul><li>Introducing the Smart Grid </li></ul><ul><li>Smart Grid Risks </li></ul><ul><li>Common Smart Grid Elements and Implications </li></ul><ul><li>Growing Resources for Smart Grid Content </li></ul><ul><li>A Simple Smart Grid Checklist </li></ul><ul><li>Conclusion and Questions </li></ul>Agenda
  3. 3. Who would recognize their brainchild? Alexander Graham Bell Father of the Telephone Network Thomas Alva Edison Father of the Grid ( and snappy dresser ) ?
  4. 4. Would today’s phone system ring a bell? <ul><li>Independent providers of services to individual consumers </li></ul><ul><ul><li>International, regional, national, and local carriers </li></ul></ul><ul><ul><li>Multiple devices/lines/types per household/business </li></ul></ul><ul><li>Configurable value-added services </li></ul><ul><ul><li>Voicemail </li></ul></ul><ul><ul><li>Text messaging </li></ul></ul><ul><ul><li>Variable pricing </li></ul></ul><ul><ul><li>Cell phone as multimedia content-delivery platform </li></ul></ul><ul><li>Heterogeneous transmission media </li></ul><ul><ul><li>Traditional copper </li></ul></ul><ul><ul><li>Cellular </li></ul></ul><ul><ul><li>VOIP </li></ul></ul><ul><ul><li>Fiber optic </li></ul></ul><ul><li>Market-based competition on rates/services/satisfaction </li></ul>Img courtesy mgraves.org then now
  5. 5. Grid changes would be much less shocking <ul><li>Major Generation Platforms </li></ul><ul><ul><li>Power producers </li></ul></ul><ul><li>Transmission and Distribution Networks and Infrastructure </li></ul><ul><ul><li>Power management </li></ul></ul><ul><ul><li>Load balancing and predicting </li></ul></ul><ul><ul><li>Outage and fail-over protections </li></ul></ul><ul><li>Regional Regulated Utilities </li></ul><ul><ul><li>Power to homes/businesses </li></ul></ul><ul><li>Technology-enabled </li></ul><ul><ul><li>Not technology-driven </li></ul></ul>img courtesy www.blackhillsenergy.com /customers/lingo/ then now same
  6. 6. While the usage profile has changed completely <ul><li>Consumption has risen drastically </li></ul><ul><li>Power quality has become a big issue </li></ul><ul><li>Power pricing has stabilized </li></ul><ul><li>A majority of new technologies require substantial additional power </li></ul><ul><li>There is no slackening of consumption in sight </li></ul>
  7. 7. What’s wrong with that? <ul><li>The Brittle Grid </li></ul><ul><ul><li>Grid element Interdependence produces cascading failures </li></ul></ul><ul><li>Volatility in Energy </li></ul><ul><ul><li>Costs vary widely for generation fuels </li></ul></ul><ul><ul><li>Regional conflicts impact fuel price and supply </li></ul></ul><ul><ul><li>Political pressure to decrease reliance on foreign sources </li></ul></ul><ul><li>Growing Environmental Impacts </li></ul><ul><ul><li>Carbon emissions facing public scrutiny and federal/international regulation </li></ul></ul><ul><ul><li>Increases in traditional generation facilities face local resistance </li></ul></ul><ul><li>Customer Dissatisfaction </li></ul><ul><ul><li>Seeking information and flexibility </li></ul></ul><ul><ul><li>Creating opportunities for new services, revenue, and products </li></ul></ul>img courtesy NOAA Northeast Blackout 2003
  8. 8. Who wants what? A Bidirectional Network A Smarter Infrastructure creates a new generation of Prosumers , producing and consuming energy in a balanced and equitable system to the benefit of customers and utilities alike Customers <ul><li>Demand more information about use and efficiency </li></ul><ul><li>Are more environmentally sensitized to energy use </li></ul><ul><li>Want more control over usage rates and schedule </li></ul><ul><li>Will generate power to sell back to the grid </li></ul><ul><li>Demand involvement in the evolution of the grid </li></ul>Utilities <ul><li>Must reduce the cost to serve and support customers </li></ul><ul><li>Are driven to adapt to new technologies </li></ul><ul><li>Must meet new expectations for services </li></ul><ul><li>Seek to monetize deployment of new energy services </li></ul><ul><li>Experiencing massive operations transformation </li></ul>
  9. 9. A Smarter Grid IS coming : market forces demand it Expectations of Financials Markets Regulatory & Policy Changes Technological Advancements Customer Expectations Aging Assets & Workforce Dynamics Volatile Energy / Fuel Costs Security Environment & Climate
  10. 10. So what is a Smart Grid? <ul><li>A future power delivery grid that meets the needs of the next generation of Americans: </li></ul><ul><li>Enable active participation by consumers </li></ul><ul><li>Accommodate all generation and storage options </li></ul><ul><li>Enable new products, services and markets </li></ul><ul><li>Provide power quality for the range of needs in a digital economy </li></ul><ul><li>Optimize asset utilization and operating efficiency </li></ul><ul><li>Anticipate and respond to system disturbances in a self-healing manner </li></ul><ul><li>Operate resiliently against physical and cyber attacks, and natural disasters </li></ul>
  11. 11. What does a Smart Grid look like? Img courtesy: www.smartgrid.epri.com
  12. 12. The Smart Grid is NOT without risks Risk to Critical Infrastructure Inconsistent information sharing and collaboration among stakeholders Private sector controls over 90% of critical infrastructures High degree of social, economic dependence on digital systems Deperimeterization and new customer touch points into networks Uneven application of security engineering to increasingly complex systems  Growing capability of adversaries and growing number of exploits
  13. 13. Security challenges from/for the new Smart Grid <ul><li>Complexity : As systems are added and increase functionality, security is more difficult to address </li></ul><ul><li>Connectivity : Increasing connection to previously isolated systems and networks expands the threat surface </li></ul><ul><li>Internetworking: Connections between networks permit more rapid spread of any corruption or breach </li></ul><ul><li>Communications Dependency : Reliance on networking technologies introduces new risk based on network stability </li></ul><ul><li>Confidentiality : Critical and sometimes private data drives the “smart” in Smart Grid, creating a new area of concern </li></ul>
  14. 14. Where are specific areas of concern? Img courtesy: www.smartgrid.epri.com <ul><li>System security </li></ul><ul><li>Vulnerable software </li></ul><ul><li>Lack of access control </li></ul><ul><li>Mis-configuration of options </li></ul><ul><li>Data Vulnerability </li></ul><ul><li>Weak/No encryption </li></ul><ul><li>Inappropriate storage </li></ul><ul><li>Installation of malcode </li></ul><ul><li>Potential Fraud </li></ul><ul><li>Invalid credentials </li></ul><ul><li>Weak authorization </li></ul><ul><li>Insufficient tamper protection </li></ul><ul><li>Downtime </li></ul><ul><li>Denial of service risk </li></ul><ul><li>System corruption </li></ul>o o o o o o o o o o o
  15. 15. Thus there are multiple scenarios to plan for… External Threat Insider Threat Accidental Event Intentional Event Malware Denial of service Sophisticated, organized attacks Natural disasters Economic upheaval Changing Political Climate Unpatched systems Code vulnerability Lack of change control Human error or carelessness Undiscovered back doors Information theft Insider fraud
  16. 16. Issues and Items to Understand Terms, Technologies, and Tough Questions
  17. 17. Smart Meters <ul><li>Legacy power meters were simple </li></ul><ul><ul><li>Mechanical devices </li></ul></ul><ul><ul><li>Displayed a rolling record of usage </li></ul></ul><ul><ul><li>Read by roaming utility personnel </li></ul></ul><ul><li>Smart meters are more functional </li></ul><ul><ul><li>Additional sensors monitor for outages, power quality, temperature, etc. notification </li></ul></ul><ul><ul><li>Tag readings with time/date/location </li></ul></ul><ul><ul><li>Can communicate wirelessly to aggregation pts or to remote readers </li></ul></ul><ul><ul><li>Ordinarily one-way communication outbound </li></ul></ul><ul><li>You should know where and how Smart Meters will be deployed </li></ul>
  18. 18. Advanced Metering Infrastructure (AMI) <ul><li>Advanced Metering Infrastructure (AMI) includes hardware, software, communications, customer associated systems and meter data management (MDM) software </li></ul><ul><li>AMI Meters support two-way communications and conforms to AMI standards </li></ul><ul><li>You must know: </li></ul><ul><ul><li>Where and how are you using AMI meters? </li></ul></ul><ul><ul><li>What kinds of data and/or control are you passing to and receiving from the utilities? </li></ul></ul><ul><ul><li>Which products and services companies are involved in this AMI implementation? </li></ul></ul><ul><ul><li>Have the components been tested for security? </li></ul></ul><ul><ul><li>Are you protected from eavesdropping and attack? </li></ul></ul>Img courtesy: http://seclab.uiuc.edu
  19. 19. Net Metering Img courtesy cr.middlebury.edu <ul><li>Net Metering refers to the “net” result of considering the production and consumption of electrical power by an organization or a building </li></ul><ul><ul><li>Meaning &quot;what remains after deductions&quot; ... the deduction of any energy outflows from metered energy inflows </li></ul></ul><ul><ul><li>Under net metering, system owners receive credit for the electricity they generate </li></ul></ul><ul><li>Home or small business power generation generally includes: solar, wind, fuel cell and micro co-generation (MCG) or Micro combined heat and power (MCHP) </li></ul><ul><li>You need to know whether your organization is going to invest in power generation to create positive net metering </li></ul>img courtesy of hilaroad.com Provided – Generated $$ COST
  20. 20. Demand Management <ul><li>Demand Management refers to the proactive reduction of power demand during periods when energy-supply systems are constrained </li></ul><ul><ul><li>This does not necessarily decrease total energy consumption, it time shifts it </li></ul></ul><ul><ul><li>Can reduce costs for participants </li></ul></ul><ul><ul><li>Reduces the need for addition power generation </li></ul></ul><ul><li>Companies participate in order to achieve savings through reduced consumption during mutually agreed periods </li></ul><ul><li>You must know: </li></ul><ul><ul><li>How will the systems be configured to comply with the expected reductions in service? </li></ul></ul><ul><ul><li>How have the management systems been secured against corruption or inadvertent reductions in power? </li></ul></ul><ul><ul><li>Who will be empowered to reduce available power? </li></ul></ul>Peak period Off Peak Off Peak
  21. 21. Energy Storage <ul><li>Energy Storage is a critical enabler of the Smart Grid capability to integrate renewable power </li></ul><ul><ul><li>Existing grid is a just in time/use it or lose it system </li></ul></ul><ul><ul><li>Many renewables are variable (wind/no wind, sun/no sun) and storage smoothes the cycle </li></ul></ul><ul><li>Energy storage technologies are arriving: </li></ul><ul><ul><li>Battery arrays </li></ul></ul><ul><ul><li>Compressed air, flywheels, pumped water systems </li></ul></ul><ul><ul><li>V2G automobiles </li></ul></ul><ul><li>You need to know: </li></ul><ul><ul><li>How much storage will be in place to support power requirements? </li></ul></ul><ul><ul><li>How is that storage managed and controlled? </li></ul></ul><ul><ul><li>Who has access to the systems controlling and monitoring the storage functions? </li></ul></ul>img courtesy upei.ca
  22. 22. Microgrids <ul><li>Microgrids are small-scale power supply and consumption units </li></ul><ul><ul><li>Generating sufficient or nearly sufficient power for use in served community </li></ul></ul><ul><ul><li>Connected to traditional power infrastructure for back-up and for surplus power trade </li></ul></ul><ul><li>Organizations, campuses, bases, and small communities can be served via Microgrid </li></ul><ul><li>You must know: </li></ul><ul><ul><li>The security of components and control systems that will manage and monitor the microgrid </li></ul></ul><ul><ul><li>The nature of data sharing/interconnect with other Microgrids, Smart Grids, or traditional utility control elements </li></ul></ul>img courtesy of ieses.fsu.edu
  23. 23. Groups and resources to know <ul><li>FERC : http://www.ferc.gov </li></ul><ul><ul><li>Federal Energy Regulatory Commission - Assist consumers in obtaining reliable, efficient and sustainable energy services at a reasonable cost through appropriate regulatory and market means </li></ul></ul><ul><li>NERC : http://www.nerc.gov </li></ul><ul><ul><li>North American Electrical Reliability Corporation - Enforces reliability standards with all U.S.  users, owners, and operators of the bulk power system. Owns responsibility for Smart Grid security standards </li></ul></ul><ul><li>NIST : http://www.nist.gov/smartgrid </li></ul><ul><ul><li>National Institutes of Science and Technology Smart Grid working group – Responsible for creating recommendations for security and interoperability of the Smart Grid </li></ul></ul><ul><li>DOE : http://www.oe.energy.gov/smartgrid.htm </li></ul><ul><ul><li>Department of Energy Office of Electricity and Reliability – Driving Smart Grid development and direction </li></ul></ul><ul><li>Gridwise Alliance : http://www.gridwise.org </li></ul><ul><ul><li>Gridwise Alliance – Industry group working on cooperative evolution of the Smart Grid </li></ul></ul><ul><li>Smart Grid News </li></ul><ul><ul><li>http://smartgridnews.com </li></ul></ul><ul><li>National Demand Response Potential (FERC) </li></ul><ul><ul><li>http://www.ferc.gov/legal/staff-reports/06-09-demand-response.pdf </li></ul></ul><ul><li>NIST Draft Smart Grid Interoperability Standards </li></ul><ul><ul><li>h ttp://www.nist.gov/public_affairs/releases/smartgrid_interoperability.pdf </li></ul></ul><ul><li>21 Steps to Improve Cyber Security of SCADA Networks </li></ul><ul><ul><li>http://www.oe.netl.doe.gov/docs/prepare/21stepsbooklet.pdf </li></ul></ul><ul><li>A Systems View of the Modern Grid, Appendix 3 </li></ul><ul><ul><li>http://www.netl.doe.gov/moderngrid/docs/ASystemsViewoftheModernGrid_Final_v2_0.pdf </li></ul></ul><ul><li>NERC Memo on Critical Cyber Asset Identification </li></ul><ul><ul><li>http://online.wsj.com/public/resources/documents/CIP-002-Identification-Letter-040609.pdf </li></ul></ul>
  24. 24. Where to begin, a checklist. Manage Identities and Access: Create processes for ensuring appropriate access control to planned strategic energy management and monitoring systems Protect Data and Information: Ensure capability for granular protection of unstructured & structured data, data leak prevention and acceptable use policy monitoring Control Software and Application Releases: Process for assuring security, efficiency and integrity of any custom or contracted software development Manage Change and Configuration: Mandate regular process for routine, emergency and out-of-band changes that will minimize or prevent operational outages Understand and Address Threats and Vulnerabilities: Continually monitor systems and expert resources to remain informed on protection for enterprise infrastructure for new and emerging threats Implement Security Information and Event Management: Automate the process of auditing, monitoring and reporting on security and compliance posture across the enterprise Manage Problems and Incidents: Designate responsibility and ownership for any issues in security, reliability, or power quality, and their investigation. Maintain trained event forensics team or create relationship with expert provider Attain visibility into organizational power strategy: Develop and maintain risk profiles and lists of potential and planned partners and technology acquisitions Provide Security Training & Ensure Awareness: Ensure awareness of security issues in ppower and power facilities by providing consistent training to end users and operators
  25. 25. The Smart Grid IS coming … Get Ready
  26. 26. Questions? Jack Danahy Co-Author : The Smart Grid Security Blog smartgridsecurity.blogspot.com [email_address]

×