With billions of dollars of public and private smart-grid investment in place and billions of dollars in network hardware and software in forecast shipments, will the smart grid be stalled by security concerns? Current smart-meter deployment trends and reported security breaches seem to point toward the possibility. In fact a recent Pike Research report “Smart Grid: 10 Trends to Watch 2011 and Beyond,” states that “security will become the top smart-grid concern” rating it number one the 2011 grid trends.
Making the Dumb Grid Smart
This approach may seem backwards for most network and security people, but was necessary to quickly show smart-grid utility ROI and power generation savings. The basic demand-side theory was that if you could gather intelligence from the power grid demand side first, you could immediately reduce peak load consumption offering tremendous capital and raw material recurring savings. The problem was that these end network communication devices were rushed out without sufficient security and breaches became evident.
Consider this power-grid communication infrastructure, and then try to securely deploy an interactive network to a real-time database connected to every electricity user. Quite a daunting task.
Security breaches in power plants have now been documented and the recent Stuxnet attacks have been called “without precedent” and “a game changer” by Sean McGurk, head of the Department of Homeland Security's Cybersecurity Center. Pike Research reported, “The technical analysis on Stuxnet continues, and it appears to be a very sophisticated attack not aimed at the electrical infrastructure. But if nothing else, the threats security experts have been warning of for years have now moved from theory to reality. Since the industry is taking greater notice, especially regulators and government (including the U.S. Congress), utilities will need to determine what cyber security measures are required -- even as standards and regulations are still evolving.
Network intrusion detection experts like Josh Wright from InGuardian early on confirmed smart-meter security vulnerabilities and now have detected vulnerabilities in wireless Zigbee systems that are targeted to be the premier network technology in smart-grid Home-Area Networks (HAN). In his recent presentation the Killer Bee, Practical ZigBee Exploitation Framework, Wright clearly demonstrated current Zigbee security concerns in a variety of smart-grid end user devices.
These vulnerabilities and need corrections were further documented in another Pike Research report, Smart Meter Security. The report assesses the security risks to Smart Metering, using ISO 27002:2005 as a baseline to identify topics for consideration. The study reviews Smart Metering against all 11 security clauses of ISO 27002:2005 to identify six key security opportunities including event correlation improvements, security software on meters, identity management and authorization, network resiliency, meter worm prevention, and end-to-end data encryption.
With known vulnerability, who wants to hack the grid anyway? Mike Ahmadi -- organizer of the Smart Grid Security East Conference and vice president of operations for the security firm GraniteKey -- targets the accessibility of data then adds volume to dollars in a formula that will attract organized crime. “I think about this a lot when I consider smart grid technologies, as well as health-care information technologies. As these technologies grow we are going to see new sources of information emerge, and in our inherent somewhat lackadaisical manner of dealing with security at the decision-making helm of our corporate culture, we will create plenty of early opportunities for aggregation and inference. The quicker an attack leads to cash for the attacker, the greater the likelihood that the attack moves from theory to reality."
He goes on, “This is, however, only part of the theory. The other part has to do with volume. For organized crime to get involved, the volume needs to be big enough to take the risk. Remember, organized crime is just as concerned with risk as corporations are. Therefore a quick path to cash that does not include a large enough volume is not necessarily a win for organized crime.” The smart grid certainly qualifies the volume requirements.
Big-Time Security and Big-Time Bucks
Grid Net just released a white paper “Assuring a Secure Smart Grid,” which opens with: “To build a secure, resilient, mission-critical smart-grid network, utilities require technology that is secure, reliable, and self healing. The growth of the Smart Grid and the advanced security technology will necessarily go hand in hand. The electricity grid is the foundation infrastructure on which rests not only economic performance, but also public and personal health, safety and welfare. Without robust security in place, the Smart Grid will not -- and should -- be built and deployed.”
By applying over 40 standards, Grid Net's approach to smart-grid security is “multi-layer.” The core architecture delivers an end-to-end secure solution, which begins with PolicyNet SmartNOS and Smart Grid devices (smart meters, routers, inverters and customer devices), proceeds to data encryption for both data storage and data transport on the network, and concludes with PolicyNet SmartGrid NMS at the Utility NOC. The PolicyNet software suite is based on three foundations -- Architecture, Process, and Response -- that take a “defense-in-depth” approach to security to provide robust end-to-end security.
SmartSynch came out with a hardware solution called the GridRouter which is a smart-grid solution that serves as an IP-addressable, external interface offering WAN, LAN and HAN connectivity to a variety of smart grid devices. The GridRouter acts as a wireless pipe capable of transmitting and receiving data over public wireless networks using Internet-based or other open standards. Through the GridRouter and its use of public wireless networks, utilities can quickly and affordably spot-deploy smart-grid applications, including load profile and control, power quality monitoring, distribution automation, and standby generator control. The GridRouter also enables utilities to support homeowner-focused smart-metering programs such as demand response, demand-side management and real-time pricing. It uses an IPsec Security Platform using Public Key Infrastructure (PKI) VPN Subtunnels to Connected IP end-devices with Digital Certificates and AES 256-bit Encryption connecting VPN Tunnels to Each GridRouter Port.
WirelessWall offers a standards-based, FIPS 140-2 solution to securing at Layer 2 with a unique approach -- implementing an IEEE Robust Secure Network for everything. According to CTO Phil Smith, “WirelessWall is elegance through simplicity. It can best be described as WPA2-Enterprise in software (AES 128-bit CCMP, 802.1x and EAP-TTLS mutual authentication).” Billed as a high-throughput and lightweight encrypting firewall, a central part of the WirelessWall advantage is providing uniform security across multiple domains which in the case of Smart Meters, would be HAN (Zigbee) and backhaul (Wi-Fi, WiMax, broadband, Mesh, etc.). Smith goes on to say, “without WirelessWall, it is like the Tower of Babel. Management complexity makes it operationally infeasible and cost prohibitive to use different security methods for each type of network. Inconsistency and complexity lead to vulnerabilities. Our strength is securing end-to-end at Layer 2 to provide cohesion, uniformity and interoperability."
FYRM Associates offer a completely different approach in addressing smart-grid security needs. Tony Flick has worked for over eight years in the security industry and is currently a Principal with Tampa-based FYRM Associates. In his book Securing the Smart Grid, Flick says a different approach needs to be taken in addressing smart grid security.
“A secure smart grid can be implemented through effective security controls," said Flick. "By focusing on security controls, rather than individual vulnerabilities and threats, utility companies and smart-grid technology vendors can remediate the root cause issues that lead to vulnerabilities. As history has shown, these security controls are much more difficult and sometimes impossible to be added on; they need to be integrated from the beginning to minimize implementation issues. Additionally, new threats and attacks will arise and thus, the operating effectiveness of the implemented security controls must be assessed on a regular basis to ensure smart grids are protected against the ever-evolving threat landscape."
Conclusion
Every security approach has advantages and disadvantages. Some have complexities that will add cost to development and product while others may put loads on the network that can affect recurring cost in bandwidth and potentially unacceptable network latency. Some may be simple but are only part of the required solution while others will require continued upgrades.
Security solutions may differ, but the clear message in the smart grid is to get effective security deployed and get it deployed now. With billions of dollars in deployments on hold there must be a concerted effort to fund immediate, short- and long-term security solutions for the smart grid or the smart grid "ain't gonna get smart any time soon."
Larry Karisny is the Director of Project Safety.org and a consultant supporting local wireless broadband, smart grid, transportation and network security platforms. ProjectSafety Business and Technology Cluster researches and deploys leading-edge standards based technologies supporting secure migration paths to current and future wireless networks and network applications.
