Risks grow as more networks are connected and digitized.
Cyberattacks are becoming as troublesome to the electrical power grid as natural disasters, and the problem is growing worse as these grids become more connected and smarter.
Unlike in the past, when a power outage affected just the electricity supplied to homes and businesses, power grids are becoming core elements of smart cities, infrastructure, and safety-related services. Without power, none of this works, and sophisticated cybercriminal operations can hold large regions hostage until they pay enormous ransoms or give into other demands.
The threats are global, too. As the profitability of hacking these systems grows, so does the number of attacks. The European Network of Transmission System Operators for Electricity (ENTSO-E), which represents 42 European transmission system operators in 35 countries, was hacked in 2020. Other successful cyberattacks include those on the Russian power grid in 2019 and Saudi Aramco petrochemical plants in 2017.
Ukraine’s grid was attacked in 2015, leaving 200,000 households without power. A similar attack happened the following year. And the cyber criminals who breached Korea Hydro and Nuclear Power, the South Korean nuclear and hydroelectric company, in 2014 posted plans and manuals for two nuclear reactors online and exposed 10,000 employees’ personal data.
According to the Annual Threat Assessment Report of the U.S. Intelligence Community Report (page 20), countries with cyberattack capabilities targeting critical infrastructure include Russia, China, Iran, and North Korea. In other words, cyberattacks can happen anywhere and at any time, and with this level of capability, no entity is immune.
What is at risk?
Cyber attackers’ motives primarily fall into two categories — financial gain and weapons of war. Cybercriminals attempt to extract money from vulnerable targets using different techniques, including ransomware. They demand a ransom by locking up the victims’ operations. More recently, the attackers have been threatening to expose the stolen data if their demands are not granted.
Cyber warfare is more complicated. State-sponsored cybercriminals have a mission to steal, disrupt, and more importantly, cause damage to the victims’ operations and critical infrastructure.
The recent failure of the Electric Reliability Council of Texas (ERCOT), which was caused by a severe winter storm in February 2021, provides a glimpse of the potential consequences. That failure was felt across the state, with 11 million people freezing for three days. In 2019, a California power disruption left 248 hospitals without electricity.
The impact of cyberattacks potentially can be even more severe. The Significant Cyber Incidents list furnished by the Center for Strategic and International Studies notes the alarming trend of cyberattacks becoming more frequent and destructive. Power grids are particularly vulnerable, and the potential entry points of those attacks are everywhere.
“Our national critical infrastructure is extremely hackable,” said Andreas Kuehlmann, CEO of Tortuga Logic. “It’s like a step function. If I find a vulnerability in a power meter, I can knock out your power. But I also can knock out everything connected to it. I don’t need to attack the grid itself. And some of these attacks can be devastating. We’ve just seen a sliver of what’s possible.”
Connectivity makes the security issue much worse. “Traditionally, the power grids have been predominantly isolated infrastructures,” said Neeraj Paliwal, vice president and general manager of Rambus Security. “Digitalization has changed that. Modern, connected power grids provide the convenience of remote monitoring, decentralized control, load balancing for alternative sources, and data analytics. Smart cities can take advantage of remote IoT capabilities to increase efficiency and provide insight for future city planning. However, the network-based, interconnected infrastructure often raises security concerns. Hackers target the critical infrastructure of a modern city to cause disruption. Stopping the electricity supply not only causes inconvenience to the users, it would also disrupt operations in an emergency situation. For example, hospitals have to rely on backup power generators, if available. Government agency operations will be severely impacted in their normal day-to-day activities when service is interrupted. In some cases, this may even threaten national security. Therefore, protection of these critical infrastructures as well as all end points is vitally important to prevent large scale outages.”
According to the U.S. Government Accountability Office (GAO), cybersecurity has been on its High-Risk List since 1997. GAO is the audit, evaluation, and investigative arm of the U.S. Congress. It exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people.
In its Critical Infrastructure Protection report, which was published in August 2019, the GAO pointed out that actions were needed to address significant cybersecurity risks facing the electric grid. Specifically, manufacturers and software developers create their products in many different locations around the world, thus making them potentially susceptible to foreign-based threats.
In the Electricity Grid Cybersecurity Report published in March 2021, the GAO noted that the Department of Energy (DoE) and the Department of Homeland Security (DHS) have the responsibility for outlining a national strategy for critical infrastructure cybersecurity, including the power grids.
The report concluded that the grid’s distribution systems were increasingly at risk from cyberattacks. DoE, DHS, and other federal agencies have helped improve the cybersecurity of distribution systems. However, the DoE’s plans for implementing the national cybersecurity strategy for the grid do not fully address risks to these systems. Cyberattacks on distribution systems may still result in outages on a national scale.
The report recommended “the Secretary of Energy, in coordination with DHS, states, and industry, should more fully address risks to the grid’s distribution systems from cyberattacks—including the potential impact of such attacks—in DoE’s plans to implement the national cybersecurity strategy for the grid.” The DoE agreed to take action, and the GAO will review its progress on an annual basis.
Are these efforts sufficient to address the risk to the nation’s power grids? Furthermore, how will DoE’s funding and scheduling actions be prioritized?
Power grids are evolving. They will become more connected and smarter. Future networked grids will use low-power wide-area networks (LPWANs) and 5G to improve energy efficiency via distributed and remote control. New innovations, such as the new Wi-Fi CERTIFIED 6 Release 2, are being added regularly to advance the power grids.
“It is certainly possible that Wi-Fi, including the new Wi-Fi CERTIFIED 6 Release 2 could be used by Transmission System Operators as part of their IT communication networks,” said Nick Sargologos, senior product manager at the Wi-Fi Alliance. “The most common positioning of Wi-Fi HaLow and Wi-Fi CERTIFIED 6 Release 2 for IoT applications is that Wi-Fi HaLow is better suited for low data rate, widely dispersed, battery powered IoT applications, and Wi-Fi CERTIFIED 6 Release 2 is better suited for IoT sensors or building automation devices that are connected to a dense, high-performance Wi-Fi network.”
The networked grids provide many benefits, but they also present challenges. The more connected the power grids, the more opportunities cybercriminals gain to hack the systems. Additionally, when renewable energy sources and the existing power grid integrate, the interfaces will present additional vulnerabilities.
“Whenever you connect things to a network, you are raising the risk of cybersecurity attacks,” said Steve Hanna, distinguished engineer, Infineon Technologies. With critical infrastructure such as the power grid, this risk is amplified because the impact of failure is great. One of the biggest cybersecurity threats to the electric grid involves control systems used to manage electrical processes and physical functions like opening and closing circuit breakers. Networking these control systems enables remote monitoring and can improve cost and energy conservation. However, it also creates more access points for hackers. The attacks on the Ukrainian power grid are a typical example where attackers were able to use internet-based attacks to remotely shut off circuit breakers.”
How prepared are we?
In its 2021 Report Card For America’s Infrastructure, the American Society of Civil Engineers issued a C– grade to the energy sector. The report warned that a “majority of the nation’s grid is aging, with some components over a century old — far past their 50-year life expectancy — and others, including 70% of transmission and distribution lines, are well into the second half of their lifespans.”
So how prepared are we in the fight against cyberattacks on power grids? To answer that question, we need to first understand what a power grid is.
In the United States, the electricity grid consists of three components — generation and storage, transmission, and distribution of electricity to residential, industrial, and commercial users. The power plants generate electricity from various sources, including chemical, hydro-electrical, wind, solar, or nuclear. Storage is done using batteries and hydroelectric. New technologies for storing energy are being explored.
Transmission takes place over substations and power lines. Today, smart meters, solar panels, and network devices may connect to the distribution systems.
In the U.S., there are three power grid system regions — eastern, western, and Texas (ERCOT). There also are interconnections between power grids. The digitization of electricity (smart grids) delivery has been discussed since 2007 when Title XIII of the Energy Independence and Security Act of 2007 (EISA) was passed by Congress. As of today, some regions are digitized, but not all.
Fig. 1: Components of the power grid. Source: GAO
In 2019, GAO warned about the U.S. power grid’s supply chain vulnerability. Any of the grid’s components can potentially be hacked and disrupt electricity supply to the users. More alarming is that if a nuclear source is hacked, it can mean a major disaster.
Fig. 2: Types of attacks and where they happen. Source: GAO
Underlying challenges
There are multiple issues facing the power grids today that make it more vulnerable. Among the top three are the age of systems, a lack of cohesive planning and action, and the number of stakeholders involved,
In the U.S., stakeholders include operators, power grid owners, local municipal authorities, the DoE and DHS. The term “national power grid” encompasses a collection of privately owned grids and substations. Additionally, the three U.S. regions have their own policies and cybersecurity strategies. Even though the DoE and DHS have overall responsibility for setting cybersecurity policies at the national level, the various stakeholders need to cooperate and implement policies in a timely manner.
But each stakeholder has its own priorities, interests, and budgets, which may not align with national policies. Today, it is almost impossible to have one grand plan set at the national level for every stakeholder to follow. More importantly, individual power grids have their own equipment, machinery, and power generation methods. There is no uniformity. It may be easier for a newer facility to implement smart grids, while it would be very costly for an old power grid to digitize. There also is a mindset of, “If it ain’t broke, don’t fix it,” which limits the ability to do anything about an attack. By the time the impact of that attack is felt, it is too late.
Solving problems
Overcoming these issues requires using technology to fight cyber criminals, better and more centralized leadership, and a mindset change that recognizes the immediacy of cyber threats.
There are plenty of technologies and knowledge around to help fight cyberattacks. All LPWAN and 5G networks have built-in security protocols. The security-conscious developers of chips and hardware have produced solid and reliable security hardware platforms, which include secure boot, zero trust, sophisticated encryption, authentication, and more.
More difficult is convincing each operator in the power grid to examine their current state of security and readiness. Fortunately, there are plenty of knowledgeable cybersecurity consultants who are ready to help. And with the approved infrastructure budget at the federal level, this is a good time for the federal agencies to work with the industry, including providing financial support and incentives to improve and upgrade individual power grids to deal with future attacks.
“The power grid is susceptible to malicious attacks from various entry points from power generation to power distribution to the smart meter,” said Andy Jaros, vice president of IP sales and marketing at Flex Logix. “All points involve some form of communication to monitor activity, from tracking energy consumption to voltage fluctuations/anomalies to monitoring electrical generation equipment. Each point represents vulnerable access points to break into a power grid’s network. In addition to typical encryption techniques, adding FPGA flexibility to the networked devices can add a second layer of security through circuit obfuscation and/or the ability to add proprietary security measures in hardware that can be updated after the device is deployed. The other advantage of reconfigurable circuitry is that artificial intelligence models can be applied (and updated in field) to monitor suspicious, non-standard communications, data movement or anomalies in equipment operation.”
There are new standards being developed to help with this, including the IEEE Wi-SUN field area network (FAN), which is specially designed for power grids.
“Wi-SUN has a security profile that uses device certificates authenticated by trusted root certification authorities to prevent unauthorized network access,” said Rogerio Almeida, product marketing engineer for sub-1GHz marketing at Texas Instruments. “It also uses crypto algorithms, such as elliptic curve Diffie-Hellman, elliptic curve digital signature algorithms, and Advanced Encryption Standard-128 cipher block chaining-message authentication code to preserve message confidentiality and integrity. This is important when adding new devices to the network and enabling their identification and authentication. Wi-SUN equipment manufacturers can even obtain a cybersecurity certificate indicating compliance with the FAN Technical Profile Specification, including using the SoC security and security enablers to help developers implement their security measures to protect their assets (data, code, identity, and keys).”
Security standards can be implemented when designing the grid systems and power equipment, which is especially effective. The North American Electric Reliability Corporation (NERC) has compiled a set of reliability standards for the electric systems of North America.
“Wireless communication technologies have long been used to connect power grids, from TETRA to LoRaWAN and Wi-Fi,” said Kalina Barboutov, head of wireless presales and business development at Hitachi Energy. “To date, 5G as a technology provides some of the most robust cyber security features and architectures. As with all 3GPP technologies, 5G traffic is encrypted end-to-end. Hitachi Energy is a longstanding power grid vendor with over 100 years of experience and contribution to the industry. Hence, in addition to 3GPP cyber security standards, we continue to implement industry specific standards, such as IEC 62443 (and underlying standards), which focuses on cyber security of critical grid operations throughout the assets’ lifecycle.”
Stronger leadership across the industry is potentially a tougher problem. In the U.S., the DoE and DHS have provided resources and information for the industry to tap into, but they also need to continue to work with the power industry to provide leadership and guidelines to achieve national cybersecurity goals.
“Operators need to work with cybersecurity experts and federal agencies to identify the vulnerabilities in their grid network, study the industry standard cybersecurity guidelines and frameworks, create a threat model to determine the required level of security for each system, and map that to available security solutions,” said Infineon’s Hanna. “For any gaps, they need to work with vendors to address the gaps and deploy the solution in a phased approach.”
That leadership is essential to developing an overall cybersecurity mindset, and it needs to happen at all levels.
“Advanced technology, digitalization and evolution toward real-time electrical supply and demand all invite new inter-connected technology, and thus the increased threat of malicious cybersecurity events,” said Rich Springer, head of industrial cybersecurity business strategy and development at Tripwire. “Fortunately, sage minds started architecting cybersecurity protections for the grid 20 years ago to establish the NERC Critical Infrastructure Protection (CIP) regulations for the electrical industry. The grid is always a target, and recently we’ve seen multimillion-dollar ransom events in other critical infrastructures. So it’s not a matter of “if,” but “when” will the next attack occur. So, what to do? Simple, we have to build cybersecurity into our future project plans and assess our current infrastructure. With cybersecurity events, the risk is to both production losses and cyber-losses (intellectual property, personal information, reputational loss, etc.), and both are quantifiable. Thus, the need for a robust cyber security budget is not debatable. As we rightly rush to employ Industry 4.0 and smart cities, we must also think in terms of cybersecurity 4.0 and cyber-secure smart cities. Unfortunately, the cyber security risk aspects are often deemed too low a risk or are to be added later. Likewise, NERC CIP only covers the most critical portions of grid operations and leaves the rest of the grid relatively untouched. Therefore, we need to develop a mindset to have cybersecurity built into every aspect of the power grids.”
On the bright side, the North American Electric Reliability Corporation (NERC), a not-for-profit international regulatory authority, with a mission to increase the reliability and security of the grid, is taking the lead. Every two years, NERC’s grid security exercise, GridEx, will host 700 planners to lead their organization to participate in a simulated exercise to fight cyberattacks. It is the largest such exercise in North America. NERC’s Electric Information Sharing and Analysis Center (E-ISAC) will post his findings in its grid security exercise report to help various organizations with similar vision.
Conclusion
We are living in an “interesting” time, witnessing a modern grid migration in which new innovations will be integrated with existing power grids. Going forward, we are likely to see more renewable energy sources, including solar, wind, and hydroelectric, become a significant part of the modern grid. In the smart, connected grid, which involves 5G, LPWAN (Wi-SUN and others) digitalization will become a reality over time. This in turn will propel smart city development.
Challenges remain in terms of how these new technologies will be integrated into the existing aging infrastructure. But one thing remains unchanged. The power industry will be facing an onslaught of cyberattacks, and it needs to be vigilant regarding cybersecurity. But armed with $2 billion federal funding for cybersecurity and IT equipment upgrades, the industry in the U.S. stands a chance of at least holding its own the cyber war.
Resources
 |
 |
 |
 |
 |
 |
Leave a Reply