Ken Silverstein reports that now that the Department of Homeland Security and the FBI have formally accused of Russia of penetrating this nation’s cyber defenses and threatening our critical infrastructure, what can be done? The simple answer is to have a common defense to prevent any cascading effect and total disruption. That’s the findings of Protect Our Power, which seeks to safeguard the nation’s transmission grid from cyber attacks. It would first devise a set of “best practices” and identify the “best available technologies” to guard against an invasion. And then it would push for the adoption of those same standards or at the very least, use them as model laws with utilities rating each other.
“There is a common bond across the nuclear sector: if one gets screwed, they all get screwed,” says Paul Feldman, senior advisor to Protect Our Power and the former chairman of the Mid-continent Independent System Operator, in a phone conversation. “That’s never existed on the non-nuclear side. They need private best practices because they now have common pain.”
Let’s review: federal law enforcement just identified a “multistage intrusion campaign” in which bad actors had planted malware and which went on “phishing” expeditions to gain access to remote transmission networks to which they could have shut down. And it started around 2016 and it drew a lot of suspicion last summer when the Wolf Creek Nuclear Operating Corp. got hacked. Russia reportedly did the same to Ukraine’s network — and a lot more damage. Now, though, the pathways through Internet invite entry into one unprotected port that could allow access to vital areas. Add to that “the cloud," which stores valuable data and which an invader could potentially wreak havoc. Altogether, there are 5,800 major power plants and 450,000 miles of high-voltage transmission lines, says the American Society of Civil Engineers.
The National Academy of Sciences has warned about the destruction of the transmission network or the substations that convert the voltage levels so that the power can be delivered to homes and businesses. Because electricity is “wheeled” across the country, any assault could reverberate. That group said that anyone from vandals to terrorists could damage utility assets to the point where they would be unusable for sustained periods, affecting the economic well-being of business communities.
The Great Blackout of 2003 is a case in point: It began in FirstEnergy Corp.’s territory and was the result of unwieldy trees that had interfered with the lines, all compounded by a computer system error. Ultimately, 50 million people stretching from the Mid Atlantic states to the Northeast and into Canada were affected. That cost $6 billion and 11 lives. Meantime, Energy Department’s Joint Cybersecurity Coordination Center has said that there had been a steady barrage of assaults on the nation’s vital infrastructure and its energy laboratories. In one 48 month period, for example, 1,131 attacks occurred, with 159 of those successful. “The sense of urgency is real but more resources are needed and we need to be singularly focused,” says Jim Cunningham, executive director of Protect Our Power, in an interview. “I can’t envision passing $1 trillion infrastructure bill and not have some portion of that go toward cyber security.”
For their part, power companies are already supposed to certify with the Federal Energy Regulatory Commission that they have developed robust systems that can continue to generate and deliver power if attacked. To comply, they are describing their potential risks based on historical accounts. They are also simulating such attacks and what their responses will be.
Utilities such as Duke Energy have been hit quite a bit in recent years. To help defend itself, it has allocated $13 billion toward grid modernization. Xcel Energy, meanwhile, is also fending off “thousands” of would-be attackers, noting that both it and its nemeses are always trying to one-up each other. And PG&E is fighting back by bridging its information technology department with its operations unit, meaning that those who are responsible for securing the company are communicating closely with those who keep the lights on.
Read on .... Original URL: https://www.forbes.com/sites/kensilverstein/2018/03/18/in-light-of-the-russian-attack-utilities-seek-new-defenses-to-protect-critical-infrastructure/#e42cb967d364
Managed & Built by I2M Consulting, LLC | © 2010-
