Tweet
SAN FRANCISCO, Calif.--The road to hardening the smart grid is still being built, but can it be finished in time to keep next-generation threats at bay?
That was the question that was left largely unanswered during panel discussion on "securing the smartgrid" during this week's RSA confab taking place here this week. According to experts, the problem is (and continues to be) huge fragmentation among the power companies, something that on its own is issue enough, but as the panelists lamented, the same problems threaten the technologies these companies plan to roll out.
"In my experience utility companies are very siloed," said Mike Echols who is the critical infrastructure protection program manager for the Salt River Project in Arizona "Each of those silos has its own IT groups, and there's a reason for that. They don't want to converge because in typical IT that's considered as a risk."
In the electricity industry that risk has become more apparent after watching what happened last year with Stuxnet, the computer virus that targeted homogenized industrial systems, and represents the first in a wave of expected attacks that target infrastructure. As the grid gets more intertwined with consumer electronics and home area networks, the likelihood and potential for a wider range of targets is expected to increase.
So what would it take to make utilities less fractured from an IT perspective? Echols suggested that the IT security be put higher up in the ladder of the corporate structure of these utility companies, so that important decisions trickled down into the sub-groups. "Cyber security tends not to be in a leadership position," he said, while noting that that was beginning to change with increased compliance, which was driving changes in the power industry.
Moderator Sam Curry with Gib Sorebo, Mike Echols and Heath Thompson at RSA 2011.
(Credit:Josh Lowensohn/CNET)
Another big issue, as noted by panelist Gib Sorebo who is the AVP and Chief Cybersecurity Technologist for SAIC, was that outside security companies looking to do business with the utilities first needed to gain a deep understanding of power companies before trying to tackle security challenges.
"We have to know how important it is for us to understand how everyone does their jobs, what the concerns are, and what the potential impact is depending upon what kind of events take place and to show that communication," Sorebo said. "You see that same kind of thing happening in banking."
Back to hardening the grid, one question that lingers is whether a simply more secure system would be able to handle evolving threats. Heath Thompson, the CTO at Landis & Gyr, said simply that the industry hadn't come to grips with that yet, but that it was on its way. "What I'm seeing is that going back to starting the foundation of strong security across the entire ecosystem of the smart grid is having the ability that at each of those points of interface, or extensibility for security that we need for the evolving threats." That included things like being able to upgrade firmware and the infrastructure itself, he added.
Ultimately though, making the grid too connected from a technology perspective could do just as much harm as good, which is why the right safeguards have to be put down. "The smart grid can do a lot of wonderful things in terms of automation and finding events quickly," Sorebo said. "But it can also automate disaster, and that's something that more and more people obviously need to focus on."
That was the question that was left largely unanswered during panel discussion on "securing the smartgrid" during this week's RSA confab taking place here this week. According to experts, the problem is (and continues to be) huge fragmentation among the power companies, something that on its own is issue enough, but as the panelists lamented, the same problems threaten the technologies these companies plan to roll out.
"In my experience utility companies are very siloed," said Mike Echols who is the critical infrastructure protection program manager for the Salt River Project in Arizona "Each of those silos has its own IT groups, and there's a reason for that. They don't want to converge because in typical IT that's considered as a risk."
In the electricity industry that risk has become more apparent after watching what happened last year with Stuxnet, the computer virus that targeted homogenized industrial systems, and represents the first in a wave of expected attacks that target infrastructure. As the grid gets more intertwined with consumer electronics and home area networks, the likelihood and potential for a wider range of targets is expected to increase.
So what would it take to make utilities less fractured from an IT perspective? Echols suggested that the IT security be put higher up in the ladder of the corporate structure of these utility companies, so that important decisions trickled down into the sub-groups. "Cyber security tends not to be in a leadership position," he said, while noting that that was beginning to change with increased compliance, which was driving changes in the power industry.
Moderator Sam Curry with Gib Sorebo, Mike Echols and Heath Thompson at RSA 2011.(Credit:Josh Lowensohn/CNET)
Another big issue, as noted by panelist Gib Sorebo who is the AVP and Chief Cybersecurity Technologist for SAIC, was that outside security companies looking to do business with the utilities first needed to gain a deep understanding of power companies before trying to tackle security challenges.
"We have to know how important it is for us to understand how everyone does their jobs, what the concerns are, and what the potential impact is depending upon what kind of events take place and to show that communication," Sorebo said. "You see that same kind of thing happening in banking."
Back to hardening the grid, one question that lingers is whether a simply more secure system would be able to handle evolving threats. Heath Thompson, the CTO at Landis & Gyr, said simply that the industry hadn't come to grips with that yet, but that it was on its way. "What I'm seeing is that going back to starting the foundation of strong security across the entire ecosystem of the smart grid is having the ability that at each of those points of interface, or extensibility for security that we need for the evolving threats." That included things like being able to upgrade firmware and the infrastructure itself, he added.
Ultimately though, making the grid too connected from a technology perspective could do just as much harm as good, which is why the right safeguards have to be put down. "The smart grid can do a lot of wonderful things in terms of automation and finding events quickly," Sorebo said. "But it can also automate disaster, and that's something that more and more people obviously need to focus on."