Slashdot Mirror
Lack of US Cybersecurity Across the Electric Grid
Lasrick writes: "Meghan McGuinness of the Bipartisan Policy Center writes about the Electric Grid Cybersecurity Initiative, a collaborative effort between the center's Energy and Homeland Security Projects. She points out that over half the attacks on U.S. critical infrastructure sectors last year were on the energy sector. Cyber attacks could come from a variety of sources, and 'a large-scale cyber attack or combined cyber and physical attack could lead to enormous costs, potentially triggering sustained power outages over large portions of the electric grid and prolonged disruptions in communications, food and water supplies, and health care delivery.' ECGI is recommending the creation of a new, industry-supported model that would create incentives for the continual improvement and adaptation needed to respond effectively to rapidly evolving cyber threats. The vulnerability of the grid has been much discussed this last week; McGuinness's recommendations are a good place to start."
If money doesn't grow on trees why do banks have branches?
Why not a separate WAN for the power based stuff, similar to NIPRNet and SIPRnet? That way, if there is a bridge across the Internet, it is point to point encrypted, but most traffic would be on separate leased lines. With this in place, combined by measures to limit connectivity, it would make it far harder than just having an Internet connected box to be able to do power grid shenanigans, unless one has physical access to the substations/stations.
Why does anyone, anyone whatsoever, think that attaching their critical national energy infrastructure is a good idea?
Those machines are not designed to be connected to the internet.
So why are they connected?
cloud-synergy-profit!
It's a damn Firesale!
I could take out a substation with parts found in any store and wouldn't trigger any alerts buying them. Heck, damage things with a bow and arrow and thick metal wire. There are cheaper/easier ways to take down power. Back a pickup truck into a tower. The "cyber" complaint is FUD. It may be true, but is still FUD because it's easier to attack the infrastructure in other ways.
Learn to love Alaska
OK, that's enough nightmare fuel for one day.
Help stamp out iliturcy.
But, but...what about the poor baby profits?
Seriously, you won't see these corporations do anything like this until they are forced to do so with heavy regulations, potential heavy fines and the real possibility of criminal prosecution upon proof of criminal negligence by a prosecuting attorney.
MBA school teaches them this: costs equal profits taken out of your pocket, so anything you can do to put the costs anywhere else is the profit in your pocket. This is how they think and how they operate. This is why you don't want business running and maintaining your infrastructure.
Everything in the Universe sucks: It's the law!
Companies want to concentrate on their core competencies. To an electric utility, IT isn't a core competency.
My power company can't be bothered to trim trees and replace rotten poles. That's all contracted out. Their core competency is collecting bills. Heck, they don't even read their own meters. That's contracted out.
So good luck with the whole 'secure the system' idea. Outages are all classified as 'Acts of God'. Maybe. I guess God has it in for corporate morons.
Have gnu, will travel.
So here we go again... Some uncontrollable thing is going to disrupt our electric grid and technological infrastructure!
Just over a decade ago it was Y2K. Folks where stockpiling food, water and fuel for generators in fear that the electric grid was obviously going down at 12:00AM January 1, 2000 when all their 2 digit year clocks rolled over.
Since then, I've heard stories about people who fear an EMP that will take out the grid and are out stocking up on food, water, fuel getting ready to live without power for years..
Last week, here on slashdot, we had a story on a huge solar storm powerful enough to bring down the grid... Folks where encouraged to stock up, by food, water, fuel and prepare for weeks without power..
So, here we are today discussing a cyber attack on the power grid that could bring the grid down.... Need I type the rest?
Really? Look, it would *really* suck if the power grid in North America went down. Yes people would die and it would be a huge mess to fix with disruptions in food supplies and fuel. Of all the ways the grid could be disabled, cyber attack is the least likely and the one easiest to fix. It's unlikely to take the whole grid down unless the saboteurs where extremely crafty and organized. They would have to first find enough infrastructure to access, manage to break in, understand how all the stuff they could control was interconnected and what failures they could induce and THEN coordinate all the individual attacks well enough to actually do something more than just local damage before they cut power to enough infrastructure they needed to continue the attack. How all the infrastructure is connected and interrelates are not easy problems to solve.
We have bigger fish to fry than fearing some mythical cyber attack on infrastructure like the power grid. I won't say it will NEVER happen, but you are talking about something that his bordering on impossible. This is like Y2K. A bunch of Chicken Little's that don't have a clue about how things *really* work or how resilient things really are overall, stoking up panic over small things. So, go stock up on food, water and fuel, just don't do it because you fear some cyber attack on the power grid.
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
After 10 years of HEAVY security articles & discussion, remind me again why ANY critical infrastructure SCADA system should be allowed to be online?
Come on now. Why? Are we talking total incompetence at the top of these orgs and their watchdogs?
there is zero need for a grid any more. wind power has been under a dollar a watt for years, and PV panels for about two years now, and I'm talking about consumer prices. the only thing keeping people from installing their own sources of electricity is laziness.
I could take out a substation with parts found in any store and wouldn't trigger any alerts buying them. Heck, damage things with a bow and arrow and thick metal wire. There are cheaper/easier ways to take down power. Back a pickup truck into a tower. The "cyber" complaint is FUD. It may be true, but is still FUD because it's easier to attack the infrastructure in other ways.
If you're in Jilin province China, backing a pickup truck into a tower is going to be a wee bit tricky. Clicking a button to take out power for the Midwest? Pretty easy at the moment.
Power goes out where I live every once in a while. Aside from having to reset clocks on the microwave and range, we don't give it a second thought.
THe hospitals all have diesel backups.
IOWs, the Chinese take out the power grid, well, BFD.
And the big blackouts that have happened in the NE, people took it in stride. Really, even if all this Cyber attack stuff is real, it won't cause much harm or panic.
"ECGI is recommending the creation of a new, industry-supported model that would create incentives for the continual improvement and adaptation needed to respond effectively to rapidly evolving cyber threats"
..
How about not connecting your Electric Grid directly to the Internet
That article and the sources it references fatally misunderstand both the nature of cybersecurity as a large scale problem space and the paths to improve the situation.
First, cybersecurity is inherently a business management problem - how the business itself operates is what introduces vulnerable systems (whether through purchasing decisions, operating maturity, development, HR, market timing, financial trade-offs, user awareness and responsibility management etc.). Even if the rate at which those vulnerabilities are introduced by the business remains constant, increasingly connected and complex systems assure that the vulnerable space will increase is the overall business - not just the dedicated cybersecurity functions & capabilities are improved. It will become, if it hasn't already, functionally impossible to resource cybersecurity in a way that keeps risk down to limits we find acceptable. In other words, train up all the security people you want and create all the security specific standards you can - unless you standardize and base business environments into predictable patterns, those security efforts will continue to fail.
Second, because of the deeply embedded business nature of the problem (only the symptoms of which are really technical), any external organization that comes in to try and help "fix it" will face substantial challenges - telling an independent organization that it must change the way it makes money fundamentally in order to meet theoretical and apparently-to-non-security-folks abstract risks doesn't go far quickly and involving government in any way assures that the conversation will stay as log jammed as it has been. There has to be a DEEP culture change that involves planning for long term business maturity, and that is almost antithetical to the culture in the U.S.
Third, there ARE organizations and programs that are and have been attempting this. This stuff isn't "new", just the reporting on it is - journalists rarely investigate this stuff beyond what it takes to write a succulent story. (I work for one of those organizations.)
Fourth, for all of the talk about all the "attacks against the grid" as opposed to other attacks, there is almost no information provided of useful analytical value. How much are other sectors looking? What kind of attacks are these? Real? Automated? A function of being on the internet at large? Etc. etc.
Finally, for all you "air gap" people - get with reality. There are no air gaps. Anywhere. Data moves across systems - whether they are connected by technology or not. If you're someone who is seriously attempting to interfere with critical infrastructure operations, you know this, know how to exploit it, and have the time/resources to do so.
Used to do "threat assesments" for commecial nuclear plants as part of modification packages while a staff EE; easy as falling off a log to break the distribution and transmission systems with 'rocks and sticks' technology, harder-n-hell to break a power plant from the outside in a way that the shutdown systems can not prevent major unrecoverable damage ... OK, true only if the "operators" keep their damn hands in their pockets.
This newly discovered vulnerability IS well understood by almost every EE I have worked with, who was an actual utility employee doing Engineering NOT MLM, this transmission system as the most vulnerable part of the industry is NOT a new thing.
What do avocados have to do with linux? Avocados have pits, for goodness sakes, not kernels. Makes no sense.
Control has been unintentionally outsourced to an overseas actor with lower performance benchmarks
And birds. Those are the true power-line terrorists around these parts. They create massive power grid outages regularly. They also like to start brush fires with their suicidal attacks.