Slashdot Mirror
Lack of US Cybersecurity Across the Electric Grid
Lasrick writes: "Meghan McGuinness of the Bipartisan Policy Center writes about the Electric Grid Cybersecurity Initiative, a collaborative effort between the center's Energy and Homeland Security Projects. She points out that over half the attacks on U.S. critical infrastructure sectors last year were on the energy sector. Cyber attacks could come from a variety of sources, and 'a large-scale cyber attack or combined cyber and physical attack could lead to enormous costs, potentially triggering sustained power outages over large portions of the electric grid and prolonged disruptions in communications, food and water supplies, and health care delivery.' ECGI is recommending the creation of a new, industry-supported model that would create incentives for the continual improvement and adaptation needed to respond effectively to rapidly evolving cyber threats. The vulnerability of the grid has been much discussed this last week; McGuinness's recommendations are a good place to start."
If money doesn't grow on trees why do banks have branches?
Why not a separate WAN for the power based stuff, similar to NIPRNet and SIPRnet? That way, if there is a bridge across the Internet, it is point to point encrypted, but most traffic would be on separate leased lines. With this in place, combined by measures to limit connectivity, it would make it far harder than just having an Internet connected box to be able to do power grid shenanigans, unless one has physical access to the substations/stations.
Because efficiency. If you have to pay some laborer to drive down to the substation to change settings, you're going to be spending a lot of money on humans.
If you can get Bob in the office to click "change", you can have one person doing dozens of them in 5 minutes.
And I don't know if you noticed during recent crises, but officially speaking, the only "critical" things according to the US government are police and military. Everything else is "non-essential". Infrastructure barely even counts for long term planning.
cloud-synergy-profit!
Attaching it to the PUBLIC INTERNET is bad. Said 'laborer' can still happily sit in his office making a change to an air-gapped system that IS connected directly to the substation.
There's simply no point in having the same system that runs critical stuff also be able to browse Facebook.
People in cars cause accidents....accidents in cars cause people
I'd pay extra to have humans working instead of insecure Internet connections being used.
If nothing else it would get rid of these stupid stories all the time.
AIR gapped network eats in to our profit.
also what if we want to have bob be replaced by some over seas?
But since we're talking about a utility, it's not that simple. That increase unilaterally affects people who can barely afford their electric bill as is.
Because, again, efficiency. Do you want to build a separate redundant, self-routing network of switches, identifiers, and miles of cable for your company's network, when you can piggyback on the one that's already there? You probably do, since that would provide jobs in slashdot's main sector, but that's personal, "you" are an electric company in this scenario.
I could take out a substation with parts found in any store and wouldn't trigger any alerts buying them. Heck, damage things with a bow and arrow and thick metal wire. There are cheaper/easier ways to take down power. Back a pickup truck into a tower. The "cyber" complaint is FUD. It may be true, but is still FUD because it's easier to attack the infrastructure in other ways.
Learn to love Alaska
Do you want to build a separate redundant, self-routing network of switches, identifiers, and miles of cable for your company's network, when you can piggyback on the one that's already there?
You mean the wires that are already there? If only it were possible to use the power lines to transport a modest amount of control information...
Ezekiel 23:20
OK, that's enough nightmare fuel for one day.
Help stamp out iliturcy.
But, but...what about the poor baby profits?
Seriously, you won't see these corporations do anything like this until they are forced to do so with heavy regulations, potential heavy fines and the real possibility of criminal prosecution upon proof of criminal negligence by a prosecuting attorney.
MBA school teaches them this: costs equal profits taken out of your pocket, so anything you can do to put the costs anywhere else is the profit in your pocket. This is how they think and how they operate. This is why you don't want business running and maintaining your infrastructure.
Everything in the Universe sucks: It's the law!
Companies want to concentrate on their core competencies. To an electric utility, IT isn't a core competency.
My power company can't be bothered to trim trees and replace rotten poles. That's all contracted out. Their core competency is collecting bills. Heck, they don't even read their own meters. That's contracted out.
So good luck with the whole 'secure the system' idea. Outages are all classified as 'Acts of God'. Maybe. I guess God has it in for corporate morons.
Have gnu, will travel.
Ah; but the guy down at the station babysitting the PLC probably wants to get his Facebook fix too -- so he hooks up a wireless USB stick and presto! The entire national WAN is now online....
So here we go again... Some uncontrollable thing is going to disrupt our electric grid and technological infrastructure!
Just over a decade ago it was Y2K. Folks where stockpiling food, water and fuel for generators in fear that the electric grid was obviously going down at 12:00AM January 1, 2000 when all their 2 digit year clocks rolled over.
Since then, I've heard stories about people who fear an EMP that will take out the grid and are out stocking up on food, water, fuel getting ready to live without power for years..
Last week, here on slashdot, we had a story on a huge solar storm powerful enough to bring down the grid... Folks where encouraged to stock up, by food, water, fuel and prepare for weeks without power..
So, here we are today discussing a cyber attack on the power grid that could bring the grid down.... Need I type the rest?
Really? Look, it would *really* suck if the power grid in North America went down. Yes people would die and it would be a huge mess to fix with disruptions in food supplies and fuel. Of all the ways the grid could be disabled, cyber attack is the least likely and the one easiest to fix. It's unlikely to take the whole grid down unless the saboteurs where extremely crafty and organized. They would have to first find enough infrastructure to access, manage to break in, understand how all the stuff they could control was interconnected and what failures they could induce and THEN coordinate all the individual attacks well enough to actually do something more than just local damage before they cut power to enough infrastructure they needed to continue the attack. How all the infrastructure is connected and interrelates are not easy problems to solve.
We have bigger fish to fry than fearing some mythical cyber attack on infrastructure like the power grid. I won't say it will NEVER happen, but you are talking about something that his bordering on impossible. This is like Y2K. A bunch of Chicken Little's that don't have a clue about how things *really* work or how resilient things really are overall, stoking up panic over small things. So, go stock up on food, water and fuel, just don't do it because you fear some cyber attack on the power grid.
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
After 10 years of HEAVY security articles & discussion, remind me again why ANY critical infrastructure SCADA system should be allowed to be online?
Come on now. Why? Are we talking total incompetence at the top of these orgs and their watchdogs?
there is zero need for a grid any more. wind power has been under a dollar a watt for years, and PV panels for about two years now, and I'm talking about consumer prices. the only thing keeping people from installing their own sources of electricity is laziness.
Presto nuttin. Disabled USB ports don't give you much
People in cars cause accidents....accidents in cars cause people
To paraphrase a bit:
Those who give up some security for some efficiency deserve neither.
Seriously, you don't engineer CRITICAL INFRASTRUCTURE to be insecure simply because you don't want to run 2 sets of wires. It's simply a cost of doing the job correctly - which we haven't yet.
People in cars cause accidents....accidents in cars cause people
They traced most of the "big blackouts" down to a single line failure, and cascade failures after that. That should demonstrate the fragility of our grid.
Learn to love Alaska
Ah; but the guy down at the station babysitting the PLC probably wants to get his Facebook fix too -- so he hooks up a wireless USB stick and presto! The entire national WAN is now online....
And the next day, he finds a pink slip waiting for him.
Jesus was all right but his disciples were thick and ordinary. -John Lennon
"ECGI is recommending the creation of a new, industry-supported model that would create incentives for the continual improvement and adaptation needed to respond effectively to rapidly evolving cyber threats"
..
How about not connecting your Electric Grid directly to the Internet
That article and the sources it references fatally misunderstand both the nature of cybersecurity as a large scale problem space and the paths to improve the situation.
First, cybersecurity is inherently a business management problem - how the business itself operates is what introduces vulnerable systems (whether through purchasing decisions, operating maturity, development, HR, market timing, financial trade-offs, user awareness and responsibility management etc.). Even if the rate at which those vulnerabilities are introduced by the business remains constant, increasingly connected and complex systems assure that the vulnerable space will increase is the overall business - not just the dedicated cybersecurity functions & capabilities are improved. It will become, if it hasn't already, functionally impossible to resource cybersecurity in a way that keeps risk down to limits we find acceptable. In other words, train up all the security people you want and create all the security specific standards you can - unless you standardize and base business environments into predictable patterns, those security efforts will continue to fail.
Second, because of the deeply embedded business nature of the problem (only the symptoms of which are really technical), any external organization that comes in to try and help "fix it" will face substantial challenges - telling an independent organization that it must change the way it makes money fundamentally in order to meet theoretical and apparently-to-non-security-folks abstract risks doesn't go far quickly and involving government in any way assures that the conversation will stay as log jammed as it has been. There has to be a DEEP culture change that involves planning for long term business maturity, and that is almost antithetical to the culture in the U.S.
Third, there ARE organizations and programs that are and have been attempting this. This stuff isn't "new", just the reporting on it is - journalists rarely investigate this stuff beyond what it takes to write a succulent story. (I work for one of those organizations.)
Fourth, for all of the talk about all the "attacks against the grid" as opposed to other attacks, there is almost no information provided of useful analytical value. How much are other sectors looking? What kind of attacks are these? Real? Automated? A function of being on the internet at large? Etc. etc.
Finally, for all you "air gap" people - get with reality. There are no air gaps. Anywhere. Data moves across systems - whether they are connected by technology or not. If you're someone who is seriously attempting to interfere with critical infrastructure operations, you know this, know how to exploit it, and have the time/resources to do so.
Used to do "threat assesments" for commecial nuclear plants as part of modification packages while a staff EE; easy as falling off a log to break the distribution and transmission systems with 'rocks and sticks' technology, harder-n-hell to break a power plant from the outside in a way that the shutdown systems can not prevent major unrecoverable damage ... OK, true only if the "operators" keep their damn hands in their pockets.
This newly discovered vulnerability IS well understood by almost every EE I have worked with, who was an actual utility employee doing Engineering NOT MLM, this transmission system as the most vulnerable part of the industry is NOT a new thing.
Ah; but the guy down at the station babysitting the PLC probably wants to get his Facebook fix too -- so he hooks up a wireless USB stick and presto! The entire national WAN is now online....
And the next day, he finds a pink slip waiting for him.
You have much faith in his local IT managers and their managers... I've seen places run for months with such a setup with nobody noticing... and then when something happens as a direct result of the rogue router, it still takes significant time to isolate it and take appropriate steps. Sometimes, the guy who set up a system like this doesn't even work for the company by the time they realize what is wrong. This despite the fact that on paper, it should be as you say -- something logged and flagged up, resulting in a pink slip less than 24 hours later.
It was actually wishful thinking rather than faith. I've seen the same things you describe. I've also seen where things like this are swept under the rug forever. Then, the root cause analysis comes back and people flip shit because nothing was done about it in the past. Well, nothing other than ignore the recomendations of us morlocks...
Jesus was all right but his disciples were thick and ordinary. -John Lennon
What do avocados have to do with linux? Avocados have pits, for goodness sakes, not kernels. Makes no sense.
And birds. Those are the true power-line terrorists around these parts. They create massive power grid outages regularly. They also like to start brush fires with their suicidal attacks.
Why does anyone, anyone whatsoever, think that attaching their critical national energy infrastructure is a good idea?"
Easy answer, money and greed.
Easy answer, money and greed.