Slashdot Mirror
Securing the Smart Grid
brothke writes "Securing the Smart Grid: Next Generation Power Grid Security, authors Tony Flick and Justin Morehouse provide a comprehensive and first-rate overview of smart grid technology and what is needed to ensure that it is developed and deployed in a secure and safe manner. An issue is that smart grid has significant amount of hype around it, including the promise that it will make energy more affordable, effective and green. With that, promises around security and privacy are often hard to obtain." Read on for the rest of Ben's review.
Securing the Smart Grid: Next Generation Power Grid Security
author
Tony Flick and Justin Morehouse
pages
320
publisher
Syngress
rating
9/10
reviewer
Ben Rothke
ISBN
1597495700
summary
Excellent overview on smart grid technology and its related security, privacy and regulatory issues
While the books notes early on that there is no singular definition of what defines smart grid, a generally accepted definition is that it is a "network of technologies providing real-time two-way communication that delivering electricity from utilities to consumers".
Most importantly, it is crucial to understand that the smart grid is an evolving environment, not a single entity or technology.
As important as the smart grid and security is, roughly 80% of Americans claim to know little or nothing about the smart grid, while 76% lack knowledge or understanding of smart meters, according to results of the latest Market Strategies International E2 Study.
From a security perspective, securing the smart grid is a complex endeavor. When you combined this with a public that is oblivious to the security and privacy issues, it gets worrisome quite fast.
The books 14 chapters provide a good overview of the various aspects of smart grid, energy and utility transmission, security, privacy attack vectors and more. The book offers a good balance of the topics, in a very readable format.
In chapter 1, the authors note that a smart grid is not a single device, application, system network, or even idea. And that there is no single authoritative definition for what a smart grid is. With that, the initial chapter sets and defines the various aspects to smart grid.
Chapter 2 provides an overview of the threats and impacts of smart metering at the consumer level. A large part of smart grid technologies is advanced metering infrastructure (AMI), which is a set of systems that measure, collect and analyze energy usage, and interact with advanced devices such as electricity meters, gas meters, heat meters, and water meters, through various communication media. Once smart grid is ubiquitous, AMI will be a hacker's platform of choice.
With all those benefits of AMI come security and privacy issues, and those open the metering infrastructure to smart thieves, stalkers, and a broad range of other threats and attacks. AMI also opens up a new set of privacy issues in that the AMI devices will be collecting significant amounts of personal energy data, which may or may not be transmitted over a secure channel.
Unfortunately, leaving security to vendors of home-based products has traditionally not been met with much success. Let's hope the smart grid vendors learn from the security debacles of the past and build effective and strong security into their products.
Chapter 4 notes that smart grid security is a matter of national security and that the US government is playing a large role in directing the effort. Numerous groups have efforts in place to secure smart grids, including DOE, FERC, DoC, DHS and more.
An important group working on this is the NIST Cyber Security Working Group (CSWG). The primary goal of the CSWG is to develop an overall cyber security strategy for the smart grid that includes a risk mitigation strategy to ensure interoperability of solutions across different domains/components of the infrastructure. This strategy addresses prevention, detection, response, and recovery.
The CSWG recently created NISTIR 7628 — Guidelines for Smart Grid Cyber Security, which complement everything detailed in this book. It also has the added benefit of being free. At 577 pages, it is also much more comprehensive.
Chapter 11 is especially fascinating, which deals with the topic of social networks and smart grid. While smart grid can leverage the power of social networking, it is inevitable that people will start tweeting about their energy usage. While that energy data may seem like an innocuous tweet, that information can be used to determine if the people are at home, on vacation, using specific appliances, etc.
For example, the Lyceum is the oldest building on the University of Mississippi campus. The Lyceum also has a twitter feed about its energy usage. While this is more informational, when individuals start sharing their energy usage, without effective social media controls, the security outcome is quite predictable. With that level of information disclosure, it is quite easy to determine if a family is home, not home, sleeping, entertaining guests, etc.
As to users who in the future will integrate tweets and other energy data into their social networking, the chapter illustrates how much of a security risk this can pose by detailing vampire energy cost estimates for over 75 different types of electronic products. Attackers can use the energy data and extrapolate what products are in use, when, and more.
The chapter concludes with a smart grid social networking security checklist. The smart grid social networking security checklist contains five categories for implementing basic security controls, name around: identity, authentication, information sharing, networking and usage.
The book also includes a number of sidebar Epic Fail stories, which detail major failures and catastrophes in various energy topics.
Overall, Securing the Smart Grid: Next Generation Power Grid Security provides an excellent overview on the state of smart grid technology and its related security, privacy and regulatory issues. The book provides an excellent introduction for anyone looking to understand what smart grid is all about, and its security and privacy issues.
You can purchase Securing the Smart Grid: Next Generation Power Grid Security from amazon.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
Most importantly, it is crucial to understand that the smart grid is an evolving environment, not a single entity or technology.
As important as the smart grid and security is, roughly 80% of Americans claim to know little or nothing about the smart grid, while 76% lack knowledge or understanding of smart meters, according to results of the latest Market Strategies International E2 Study.
From a security perspective, securing the smart grid is a complex endeavor. When you combined this with a public that is oblivious to the security and privacy issues, it gets worrisome quite fast.
The books 14 chapters provide a good overview of the various aspects of smart grid, energy and utility transmission, security, privacy attack vectors and more. The book offers a good balance of the topics, in a very readable format.
In chapter 1, the authors note that a smart grid is not a single device, application, system network, or even idea. And that there is no single authoritative definition for what a smart grid is. With that, the initial chapter sets and defines the various aspects to smart grid.
Chapter 2 provides an overview of the threats and impacts of smart metering at the consumer level. A large part of smart grid technologies is advanced metering infrastructure (AMI), which is a set of systems that measure, collect and analyze energy usage, and interact with advanced devices such as electricity meters, gas meters, heat meters, and water meters, through various communication media. Once smart grid is ubiquitous, AMI will be a hacker's platform of choice.
With all those benefits of AMI come security and privacy issues, and those open the metering infrastructure to smart thieves, stalkers, and a broad range of other threats and attacks. AMI also opens up a new set of privacy issues in that the AMI devices will be collecting significant amounts of personal energy data, which may or may not be transmitted over a secure channel.
Unfortunately, leaving security to vendors of home-based products has traditionally not been met with much success. Let's hope the smart grid vendors learn from the security debacles of the past and build effective and strong security into their products.
Chapter 4 notes that smart grid security is a matter of national security and that the US government is playing a large role in directing the effort. Numerous groups have efforts in place to secure smart grids, including DOE, FERC, DoC, DHS and more.
An important group working on this is the NIST Cyber Security Working Group (CSWG). The primary goal of the CSWG is to develop an overall cyber security strategy for the smart grid that includes a risk mitigation strategy to ensure interoperability of solutions across different domains/components of the infrastructure. This strategy addresses prevention, detection, response, and recovery.
The CSWG recently created NISTIR 7628 — Guidelines for Smart Grid Cyber Security, which complement everything detailed in this book. It also has the added benefit of being free. At 577 pages, it is also much more comprehensive.
Chapter 11 is especially fascinating, which deals with the topic of social networks and smart grid. While smart grid can leverage the power of social networking, it is inevitable that people will start tweeting about their energy usage. While that energy data may seem like an innocuous tweet, that information can be used to determine if the people are at home, on vacation, using specific appliances, etc.
For example, the Lyceum is the oldest building on the University of Mississippi campus. The Lyceum also has a twitter feed about its energy usage. While this is more informational, when individuals start sharing their energy usage, without effective social media controls, the security outcome is quite predictable. With that level of information disclosure, it is quite easy to determine if a family is home, not home, sleeping, entertaining guests, etc.
As to users who in the future will integrate tweets and other energy data into their social networking, the chapter illustrates how much of a security risk this can pose by detailing vampire energy cost estimates for over 75 different types of electronic products. Attackers can use the energy data and extrapolate what products are in use, when, and more.
The chapter concludes with a smart grid social networking security checklist. The smart grid social networking security checklist contains five categories for implementing basic security controls, name around: identity, authentication, information sharing, networking and usage.
The book also includes a number of sidebar Epic Fail stories, which detail major failures and catastrophes in various energy topics.
Overall, Securing the Smart Grid: Next Generation Power Grid Security provides an excellent overview on the state of smart grid technology and its related security, privacy and regulatory issues. The book provides an excellent introduction for anyone looking to understand what smart grid is all about, and its security and privacy issues.
You can purchase Securing the Smart Grid: Next Generation Power Grid Security from amazon.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
From a security perspective, securing the smart grid is a complex endeavor. When you combined this with a public that is oblivious to the security and privacy issues, it gets worrisome quite fast.
If residential end users have to worry about the security of the power grid, the "smart grid" is a bad idea.
Maybe someone needs to check CmdrTaco's apartment.
Smart grid has nothing to do with the power grid (as in the nation's power grid / infrastructure). This has only to do with the "last mile" customers and making information available to customers to help them and the power companies better manage usage.
While there are security implications, these are limited to maybe a hacker getting in and shutting down a bunch of meters or generally being a nuisance to customers and the power company.
Sometimes the light at the end of the tunnel is the headlight of an oncoming train.
Skimping on line and generator maintenance in an attempt to boost profits, but which knocks out power for a significant section of the Northeast US and Canada when the chickens come home to roost. (All completely hypothetical, of course)
I am officially gone from
I'd be ticked if someone were to remotely keep my coffee maker from turning on in the morning! The horror!
"In chapter 1, the authors note that a smart grid is not a single device, application, system network, or even idea. And that there is no single authoritative definition for what a smart grid is. With that, the initial chapter sets and defines the various aspects to smart grid."
Read - we took generic security concepts and replaced "computer network" with "smart grid" in the text.
As someone who has worked for a successful smart grid company, there is very little known outside of these start-ups about how smart grids work. Most talks you see around *smart grid* security at blackhat or defcon are centered around decade old meters and technology. Those are ancient!
As someone who has worked on distribution automation for a large electric utility for the past 13 years, I've never understood the fascination with the cyber aspect of securing the grid. It would be far easier to cause a major outage with a 4x4 truck and a few pounds of high explosive, yet I don't recall a single attack of any type against a transmission tower anywhere in the U.S.. As for intercepting and deciphering meter data (a truly non-trivial task), it would be far easier for thieves to simply watch the houses in a given neighborhood, a la Home Alone.
The residential meters do have disconnect capability, but by design this functionality ignores broadcasts. Therefore a hacker could only affect a single residence at a time, and even then only if they knew the encrypted disconnect command. An insider attack is the only real threat, and that is not addressed here.
Will it stay on after the zombie apocalypse? Stupid context, but seriously, if the smart grid is going to be able to talk to my fridge and potentially let some hacker melt my icecream, that means it will have a lot of complexity to it. With that level of complexity (and invested time/money) it damn well better stay on for a bit if it has to be left unattended.
is about making people feel the capital costs needed at peak times. Currently this is not the case. I fail to see how this will make energy more affordable.
I'd think that, as people avoid the peak-priced energy, there should be a leveling of demand, which should reduce the need for more power plants in the longer term, controlling costs. Right now they need to build plants to meet a few peaks (around here, the hottest summer days). Pepco came and installed a thermostat for me which can turn off my central ac at peak times (I noticed it once last summer) and I get a little money back for being part of the program. If enough houses have these types of devices (and the smart grid would be much better than this) then power companies can better spread the load & avoid adding natural gas plants which are rarely used.
Enter FERC/NERC which then mandates and fines utilities for not doing the right thing. The bad thing is this puts a burden on utilities already doing the right thing as they now have to deal with NERC audits. In the end, it's they way to go, but it would have been better of the power industry policed itself (but responsibility without authority is pointless, which is where FERC authority to fine millions per day gives NERC the ability to carry out this responsibility).
is about making people feel the capital costs needed at peak times. Currently this is not the case. I fail to see how this will make energy more affordable.
Actually that turns out not to be the case. The idea of the smart grid was two-fold; It provided a vehicle for upgrading infrastructure that hasn't been upgraded since it was built in (mostly) the middle of the last century, and by giving the generators more fine-grained knowledge of when to apply secondary generation facilities for peak load. The latter would provide sufficient savings to bankroll the entire project.
Or at least that was the opinion of the 20 or so C-level energy execs we interviewed in 2009 when I wrote our company's smart grid report. The concept may have drifted since then (and I'll admit I'm out of touch, I no longer work for that company) but I don't think by that much.
Do not mock my vision of impractical footwear
Trying to avoid getting off-topic and digressing into yet another diatribe on Smart-Grid technologies and focusing on the content of the book. . . This is a good introductory book on the topic. Not very deep, nor will you find the technical details on the wide range of technologies, but then again - the technical details of Smart Grid technologies would fill thousands of pages and the discussion of all the security implications, thousands more. So, this book is a good 50,000 foot view, and it fills a void as I know of no other general introductory text. I agree with some of the comments, that the actual analysis is a bit weak, that at times it seems like they just substitute "smart grid" for "network" before security and do mass replace function. And, in reality, this will not be the path to securing this technology, as it has different purposes and characteristics than a standard TCP/IP network. That said, it is still a decent book and worth the read if you want to learn about the ideas behind the new technologies coming to us like a out of control freight train. Mandatory Disclaimer: I am not, nor do I know the authors. I have read the book (cover to cover) and bought several for people on my Smart Grid team.
Hope is the worst of evils, for it prolongs the torment of man. -- Friedrich Nietzsche
It's not about making energy affordable. It's about modifying demand by holding consumers accountable.
There is no effort to build new power plants in this country. We're not adding new coal plants, because they pollute. We're not adding new nuclear plants, because we don't know how to handle nuclear waste. We're not building new dams, because we might kill an endangered fish, or wreck some historic valley. At most, we're adding tiny little windmills and tidal generators and solar farms that have no practical chance of keeping up with the growth of the population. As things stand today, we're in a bind.
So if we can't figure out how to build more generating capacity, our options are to either restrict growth, improve efficiency, or curb demand.
Restricting growth is not a realistic option. Improving efficiency is. The utilities do what they can from a generating standpoint to try to squeeze every watt from every therm they produce. They encourage us to improve efficiency economically, through rebates for replacing inefficient devices with energy star devices. And they curb demand by raising rates.
Because electrical plants have a finite capacity, as the plants reach their peak of production the utilities have one more trick. They fire up auxiliary generators to supply additional power to the grid. These are diesel or natural gas generating plants, often owned by large businesses as disaster recovery generators. They are very, very expensive to fuel and run. This only happens at times of peak demand, but the cost of peak generation is about ten times that of regular generation. The smart grid will allow utilities to charge higher rates to consumers during peak times, in order to encourage energy saving during peak times.
The smart grid can pass that information to consumer appliances. The grid can tell your dryer that "peak pricing is from 3:00 PM until 8:00 PM." Your dryer can then tell you "if you dry them now it will cost $3, but if you wait until 8 PM it will only cost $0.15." Or if you hit the "cheap" button, it will automatically delay operation until the peak period has ended.
Today we all pay peak rates 24x7, for everything. The peak charges are amortized across all the electricity we buy. The smart grid will let them keep from raising the prices for non-peak electricity. And it puts the information in your hands so you can make the decision.
John