Energy Sector Cyber Security – In ICS-CERT responded to 295 cyber incidents in the critical infrastructure, 46 were aimed at energy
In the U.S., no entity has reported an energy sector cyber security attack that resulted in widespread loss of power, though menaces like the one in Ukraine persist across the built infrastructure.
Through new research initiatives and more robust standards, the U.S. aims to provide energy sector cyber security regulation to better protect against attacks and build higher resiliency in the electric power grid. The electricity infrastructure will require power system-specific advanced technology.
For fiscal year 2015, the Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) — part of the Department of Homeland Security — responded to 295 cyber incidents in the critical infrastructure. Of those, 46 were aimed at the energy sector (16%)
In that spirit, the U.S. Department of Energy (DoE) recently awarded two grants for developing energy sector cyber security to develop research centers that help make the power grid less susceptible to attack and more resilient should a cyber-related incident occur.
One recipient is the University of Illinois at Urbana-Champaign, which formed the Cyber Resilient Energy Delivery Consortium (CREDC) that involve 10 other universities and national laboratories. Researchers will evaluate grid resiliency, of which security is a part, “but not the whole ball of wax,” says David Nicol, professor of electrical and computer engineering and CREDC principal investigator.
Other areas the consortium will cover include data analytics for cyber event detection, risk assessment of EDS technology and the impact of the Internet of Things and cloud computing on energy infrastructure resiliency.
A second DoE grant was awarded to the University of Arkansas, which is leading the Secure, Evolvable Energy Delivery Systems, or SEEDS, center. Its goal is to research and develop technologies that will detect incidents, prevent intrusions and help grid operators in decision-making when incidents occur.
Investigators plan to test and validate the protective measures at the universities, then at industry partner sites, before making systems available to power producers and operators throughout the U.S.
In July 2016, new critical infrastructure protection cybersecurity standards from the North American Electric Reliability Corp. (NERC) go into effect for owners and operators of the bulk electric system (BES). This is hopefully the energy sector cyber security that is expected to be the rule.
One change to the standards — known as CIP Version 5 — is a tiered system that classifies cyber assets as high, medium or low impact. Control centers, transmission stations and substations, and systems and facilities critical to electrical grid restoration. The classifications are role-based, rather than risk-based as in the past.
Among other requirements of the revised standards are encryption of grid command and control signals, multifactor authentication for more secure password access and consideration of all serial connections. Entities also must develop incident response recovery plans, as well as document all software and security patches on each BES device.
NERC representative Kimberly Mielcarek says that just as critical is the organization’s Electricity Information Sharing and Analysis Center, which monitors the security of the BES in real-time.
More Here [globalspec]