The US Power Grid Needs Better Security

A recent poll showed that more than 90 percent of Americans believe the government is not doing enough to protect the electric grid from cyber-security attacks. Their fears appear to be justified.

In March 2018, the US government revealed its concerns about Russian incursions into the operating systems of domestic electric power plants and noted that the efforts to disrupt date back to 2013. These attacks have the capability to bring down all or part of US electricity service.

Such large-scale grid cyberattacks were foreseen. The Departments of Energy and Homeland Security identified the grid’s vulnerability to cyber-attacks some time ago and called for new protective measures in the DOE-led January 2017 Quadrennial Energy Review.

The study, which analysed the entire US electricity system, noted that that the key critical infrastructures underpinning the nation’s economy and national security, transportation, water, finance, natural gas, oil, communications/IT, depend upon a reliable electricity “uber-network.”
 
A 2012 report by the National Research Council concluded that a cyber-attack could black out a large region of the nation for weeks or even months.

Public health and safety would be in jeopardy from an extended, widespread power outage, resulting in loss of life support systems in hospitals, nursing homes, and households, disruption of clean water supplies and sanitation, and a massive breakdown of the transportation system.

The economic disruptions from an extended blackout would also be enormous.

A 2015 Lloyds of London study found that a cyber-attack on 50 generators in the Northeast could leave 93 million people without power and cost the economy over $234 billion.

We’ve already seen previews of a successful cyberattack on the grid stemming from operational failures and extreme weather. The 2003 Northeast blackout left 50 million people without power for four days, causing economic losses between $4 billion and $10 billion.

In Puerto Rico, 400,000 people are still without power six months after Hurricane Maria, with staggering impacts on the commonwealth’s economy and well-being.

Russia, Iran, North Korea and others have large-scale, offensive cyber-attack programs.

The CIA has concluded with “high confidence” that Russian military attackers crippled computers in Ukraine’s financial system last year. This followed 2015 and 2016 cyber-attacks that disabled part of Ukraine’s electric grid.

Global security analysts say Russia is using Ukraine as a cyber-war testing ground. The US also appears to be in their crosshairs as the overall US-Russia relationship hits new lows, evidenced most dramatically by their interference in our 2016 elections.

According to DHS and the FBI, Russia appears to be laying a foundation for a large scale cyber-attack on US infrastructure. The Dragonfly 2.0 hackers, identified by DHS as Russian government cyber actors, pursued a prolonged cyberattack (since 2015) on a US power plant and computer networks controlling the grid.

Industry and government have been trying to address cyber vulnerabilities.

In 2015, Congress expanded DOE’s authority to take immediate measures in response to cyberattacks on the grid in the FAST Act. Congress has also proposed additional legislation to address grid-related cyber-defense deficiencies with resilience measures for electricity infrastructure.

These bills, introduced but not passed, focus on state assistance, authority to address cybersecurity gaps for other energy infrastructures, and identification of cyber secure products for the grid. Energy Secretary Rick Perry should also be commended for setting up a new cybersecurity office at DOE.

These actions are important but not enough.

It is time for a comprehensive examination of how the US can anticipate, recover, and deter cyber-attacks. They need to fund development and deployment of advanced designs and technologies to protect their grid and to provide states the tools they need to contribute to the defense of the nation’s electricity system.

They need to incorporate mandatory reliability and resilience measures into every aspect of our electricity system and the Internet. They must also address state-sponsored cyber-attacks at the legal, regulatory, operational and diplomatic levels, including the development of international protocols.

But the hardest part may be modernising our jurisdictional system to ensure seamless federal authority to prepare for and respond to cyber-attacks.

The DOE study concluded that the electricity system is a national security asset.

National security is inherently a federal responsibility and cyber-security attacks do not respect jurisdictional boundaries. It is time to adopt a regulatory system that meets 21st century realities. The US economy and national security depend on it.

The Hill

You Might Also Read: 

US Accuses Russia Of Attacking Energy Infrastructure:

 

« Snowden: The Deep State’s Influence On The Presidency
Julian Assange Has Internet Connection Cut »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

ON-DEMAND WEBINAR: Navigating cloud security: The importance of posture management tools

ON-DEMAND WEBINAR: Navigating cloud security: The importance of posture management tools

Watch this webinar to see how cloud security posture management (CSPM) tools can fit into your cloud security strategy.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

HPE Aruba Networking

HPE Aruba Networking

HPE Aruba Networking, a Hewlett Packard Enterprise company, is a leading provider of next-generation network access solutions for the mobile enterprise.

ManTech International

ManTech International

ManTech provides comprehensive, integrated cyber security support, which includes computer and network design, implementation, and operations.

Orange Cyberdefense

Orange Cyberdefense

Orange Cyberdefense is the expert cybersecurity business unit of the Orange Group, providing managed security, managed threat detection & response services to organizations around the globe.

ClickDatos

ClickDatos

ClickDatos specializes in consulting, auditing, data protection training, accredited by ISO/IEC 27001 certification.

Array Networks

Array Networks

Array Networks, the network functions platform company, develops purpose-built systems for hosting virtual networking and security functions with guaranteed performance.

National Information Technology Development Agency (NITDA) - Nigeria

National Information Technology Development Agency (NITDA) - Nigeria

The National Information Technology Development Agency (NITDA) is committed to implementing the Nigerian National Information Technology Policy.

BrainChip

BrainChip

BrainChip is the leading provider of neuromorphic computing solutions, a type of artificial intelligence that is inspired by the biology of the human neuron - spiking neural networks.

NetNordic Group

NetNordic Group

NetNordic is a Nordic system integrator focusing on solutions and services in the area of networking, smart data centers, cybersecurity, and unified communication.

Open Systems

Open Systems

Open Systems is a Secure Access Service Edge (SASE) pioneer delivering a complete solution to network and security.

Cybriant

Cybriant

Cybriant Strategic Security Services provide a framework for architecting, constructing, and maintaining a secure business with policy and performance alignment.

Software Diversified Services (SDS)

Software Diversified Services (SDS)

SDS provides the highest quality mainframe software and award-winning, expert service with an emphasis on security, encryption, monitoring, and data compression.

HacWare

HacWare

HacWare is a data driven cybersecurity awareness product that leverages machine learning and behavior analytics help IT professionals combat phishing.

NorthRow

NorthRow

NorthRow provides digital transformation compliance solutions to help businesses manage regulatory and financial crime risks.

Unisys

Unisys

Unisys is a global information technology company providing industry-focused solutions integrated with leading-edge security to clients in the government, financial services and commercial markets.

First Focus

First Focus

First Focus is a managed service provider for medium-sized organisations.

QANplatform

QANplatform

QANplatform is a Quantum-resistant hybrid blockchain platform.