The US Power Grid Needs Better Security

A recent poll showed that more than 90 percent of Americans believe the government is not doing enough to protect the electric grid from cyber-security attacks. Their fears appear to be justified.

In March 2018, the US government revealed its concerns about Russian incursions into the operating systems of domestic electric power plants and noted that the efforts to disrupt date back to 2013. These attacks have the capability to bring down all or part of US electricity service.

Such large-scale grid cyberattacks were foreseen. The Departments of Energy and Homeland Security identified the grid’s vulnerability to cyber-attacks some time ago and called for new protective measures in the DOE-led January 2017 Quadrennial Energy Review.

The study, which analysed the entire US electricity system, noted that that the key critical infrastructures underpinning the nation’s economy and national security, transportation, water, finance, natural gas, oil, communications/IT, depend upon a reliable electricity “uber-network.”
 
A 2012 report by the National Research Council concluded that a cyber-attack could black out a large region of the nation for weeks or even months.

Public health and safety would be in jeopardy from an extended, widespread power outage, resulting in loss of life support systems in hospitals, nursing homes, and households, disruption of clean water supplies and sanitation, and a massive breakdown of the transportation system.

The economic disruptions from an extended blackout would also be enormous.

A 2015 Lloyds of London study found that a cyber-attack on 50 generators in the Northeast could leave 93 million people without power and cost the economy over $234 billion.

We’ve already seen previews of a successful cyberattack on the grid stemming from operational failures and extreme weather. The 2003 Northeast blackout left 50 million people without power for four days, causing economic losses between $4 billion and $10 billion.

In Puerto Rico, 400,000 people are still without power six months after Hurricane Maria, with staggering impacts on the commonwealth’s economy and well-being.

Russia, Iran, North Korea and others have large-scale, offensive cyber-attack programs.

The CIA has concluded with “high confidence” that Russian military attackers crippled computers in Ukraine’s financial system last year. This followed 2015 and 2016 cyber-attacks that disabled part of Ukraine’s electric grid.

Global security analysts say Russia is using Ukraine as a cyber-war testing ground. The US also appears to be in their crosshairs as the overall US-Russia relationship hits new lows, evidenced most dramatically by their interference in our 2016 elections.

According to DHS and the FBI, Russia appears to be laying a foundation for a large scale cyber-attack on US infrastructure. The Dragonfly 2.0 hackers, identified by DHS as Russian government cyber actors, pursued a prolonged cyberattack (since 2015) on a US power plant and computer networks controlling the grid.

Industry and government have been trying to address cyber vulnerabilities.

In 2015, Congress expanded DOE’s authority to take immediate measures in response to cyberattacks on the grid in the FAST Act. Congress has also proposed additional legislation to address grid-related cyber-defense deficiencies with resilience measures for electricity infrastructure.

These bills, introduced but not passed, focus on state assistance, authority to address cybersecurity gaps for other energy infrastructures, and identification of cyber secure products for the grid. Energy Secretary Rick Perry should also be commended for setting up a new cybersecurity office at DOE.

These actions are important but not enough.

It is time for a comprehensive examination of how the US can anticipate, recover, and deter cyber-attacks. They need to fund development and deployment of advanced designs and technologies to protect their grid and to provide states the tools they need to contribute to the defense of the nation’s electricity system.

They need to incorporate mandatory reliability and resilience measures into every aspect of our electricity system and the Internet. They must also address state-sponsored cyber-attacks at the legal, regulatory, operational and diplomatic levels, including the development of international protocols.

But the hardest part may be modernising our jurisdictional system to ensure seamless federal authority to prepare for and respond to cyber-attacks.

The DOE study concluded that the electricity system is a national security asset.

National security is inherently a federal responsibility and cyber-security attacks do not respect jurisdictional boundaries. It is time to adopt a regulatory system that meets 21st century realities. The US economy and national security depend on it.

The Hill

You Might Also Read: 

US Accuses Russia Of Attacking Energy Infrastructure:

 

« Snowden: The Deep State’s Influence On The Presidency
Julian Assange Has Internet Connection Cut »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

CloudCheckr

CloudCheckr

CloudCheckr is a next-gen cloud management platform that unifies Security & Compliance, Inventory & Utilization and Cost Management.

Finnish Information Security Cluster (FISC)

Finnish Information Security Cluster (FISC)

FISC is an organization established by major Finnish information security companies to promote their activities nationally and internationally.

Cyber, Space, & Intelligence Association (CSIA)

Cyber, Space, & Intelligence Association (CSIA)

CSIA focuses on issues critical to Cyber Security, Military Space and Intelligence.

SecurePay

SecurePay

SecurePay is Australia's premier payment gateway, with a range of secure online payment solutions for online retailers, SMEs and enterprise businesses.

Managed Security Services (MSS)

Managed Security Services (MSS)

MSS deliver consultancy services and managed security services for IT departments who may lack the time, resources, or expertise themselves.

IberLayer

IberLayer

IberLayer is the company behind the Email Guardian service, a cloud based Email Total Protection system that filters and blocks email threats.

Finnish Accreditation Service (FINAS)

Finnish Accreditation Service (FINAS)

FINAS is the national accreditation body for Finland. The directory of members provides details of organisations offering certification services for ISO 27001.

Huntress Labs

Huntress Labs

Huntress provides managed threat detection and response services to uncover and address malicious footholds that slip past your preventive defenses.

Techleap.nl

Techleap.nl

Techleap.nl is a non-profit publicly funded organisation helping to quantify and accelerate the tech ecosystem of the Netherlands.

NightDragon

NightDragon

NightDragon is a venture capital firm investing in innovative growth and late stage companies within the cybersecurity, safety, security, and privacy industry.

AirEye

AirEye

AirEye is a leader in Network Airspace Protection (NAP). Block attacks against your corporate network launched from wireless devices in your corporate network airspace.

NTT Group

NTT Group

NTT offers agile, scalable technology services to bring it all together seamlessly, securely, and sustainably. We help you adopt a holistic security approach across your network, clouds, applications.

Clearvision

Clearvision

As an Atlassian Platinum Solution Partner, Clearvision works with teams in the UK and US, providing solutions for the Atlassian stack, Git and open source tooling.

Morpheus Enterprises

Morpheus Enterprises

Morpheus Enterprises offer managed security solutions designed to keep your web applications secure and your business running smoothly.

Commonwealth Scientific & Industrial Research Organisation (CSIRO)

Commonwealth Scientific & Industrial Research Organisation (CSIRO)

CSIRO is Australia's national science agency. We solve the greatest challenges through innovative science and technology.

VLC Solutions

VLC Solutions

VLC Solutions is an independent solutions and technology service provider offering Cloud Services, Cybersecurity, ERP Services, Network Management Services, and Compliance Solutions.