Protecting the power grid from cyber attacks
As the national power grid becomes increasingly dependent on computers and data sharing—providing significant benefits for utilities, customers, and communities—it has also become more vulnerable to both physical and cyber threats.
While evolving standards with strict enforcement help reduce risks, efforts focused on response and recovery capabilities are just as critical––as is research aimed at creating a well-defended next generation smart grid. The Daily Herd recently sat down with Michael Ahern to discuss the many challenges involved in securing the national power grid against physical and cyber attacks––both now and in the future.
In addition to his role as director in WPI’s Corporate and Professional Education and instructor for the Foisie Business School, Ahern also leads a WPI research team supporting BAE Systems as part of the Defense Advanced Research Project Agency’s Rapid Attack Detection, Isolation, and Characterization Systems (DARPA RADICS) intitative.
What is being done in the U.S. to protect the power grid from cyberattacks?
Here in the U.S., a lot is being done to protect the power grid from cyberattacks. The power grid, or electric transmission system, is required to meet the North American Electric Reliability Corporation’s Critical Infrastructure Protection (NERC CIP) Standards. These standards include mandatory requirements for specific actions to protect the power grid from both physical and cyberattacks. CIP Standards are updated regularly to address emerging threats and are vigorously enforced by independent auditors backed by Federal Energy Regulatory Commission [FERC] fines for noncompliance.
The result of these regulations and their enforcement is reduced risk of attacks that create widespread power outages.
Even with these evolving standards, cybersecurity is like a race that never ends. Attackers are learning and building their capabilities, too. Many nation states and rogue organizations are developing their cyberattack capabilities. We’ve seen attacks against power grid control systems create widespread outages twice in Ukraine. Recently, the U.S. Department of Homeland Security reported attempts to insert malware in our electric power control systems.
The U.S. recognizes the risk that other nations may develop cyberattacks the industry is unable to stop. One initiative DARPA launched several years ago is called Rapid Attack Detection, Isolation, and Characterization Systems [RADICS], research to develop technology that cybersecurity personnel, power engineers, and first responders can utilize to accelerate restoration of cyber-impacted electrical systems.
Overall, the U.S. industry is improving defenses and the U.S. government is conducting research to add new restoration capabilities.
