Slashdot Mirror
NERC Fines Utilities $10 Million Citing Serious Cyber Risk, But Won't Name Them (securityledger.com)
chicksdaddy shares a report from The Security Ledger: The North American Electric Reliability Corp. (NERC) imposed its stiffest fine to date for violations of Critical Infrastructure Protection (CIP) cybersecurity regulations. But who violated the standards and much of what the agency found remains secret. In a heavily redacted 250-page regulatory filing, NERC fined undisclosed companies belonging to a so-called "Regional Entity" $10 million for 127 violations of the Critical Infrastructure Protection standards, the U.S.'s main cyber security standard for critical infrastructure including the electric grid. Thirteen of the violations listed were rated as a "serious risk" to the operation of the Bulk Power System and 62 were rated a "moderate risk." Together, the "collective risk of the 127 violations posed a serious risk to the reliability of the (Bulk Power System)," NERC wrote.
The fines come as the U.S. intelligence community is warning Congress of the growing risk of cyber attacks on the U.S. electric grid. In testimony this week, Director of National Intelligence Dan Coats specifically called out Russia's use of cyber attacks to cause social disruptions, citing that country's campaign against Ukraine's electric infrastructure in 2015 and 2016. The extensively redacted document provides no information on which companies were fined or where they are located, citing the risk of cyber attack should their identity be known. Regional Entities account for virtually all of the electricity supplied in the U.S. They are made up of investor-owned utilities; federal power agencies; rural electric cooperatives; state, municipal, and provincial utilities; independent power producers; power marketers; and end-use customers. However, details in the report provide some insight into the fines. For example, violations of a CIP statue that requires companies to "manage electronic access to (Bulk Electric System) Cyber Systems by specifying a controlled Electronic Security Perimeter" is rated a serious risk. So too are violations of CIP requirements calling for covered entities to "implement and document" access controls for "all electronic access points to the Electronic Security Perimeter(s)." Specific requirements that were violated suggest that the companies failed to implement access controls that "denies access by default," "enable only ports and services required for operations and for monitoring Cyber Assets within the Electronic Security Perimeter," and ensure the authenticity of parties attempting to remotely access the company's "electronic security perimeter."
The fines come as the U.S. intelligence community is warning Congress of the growing risk of cyber attacks on the U.S. electric grid. In testimony this week, Director of National Intelligence Dan Coats specifically called out Russia's use of cyber attacks to cause social disruptions, citing that country's campaign against Ukraine's electric infrastructure in 2015 and 2016. The extensively redacted document provides no information on which companies were fined or where they are located, citing the risk of cyber attack should their identity be known. Regional Entities account for virtually all of the electricity supplied in the U.S. They are made up of investor-owned utilities; federal power agencies; rural electric cooperatives; state, municipal, and provincial utilities; independent power producers; power marketers; and end-use customers. However, details in the report provide some insight into the fines. For example, violations of a CIP statue that requires companies to "manage electronic access to (Bulk Electric System) Cyber Systems by specifying a controlled Electronic Security Perimeter" is rated a serious risk. So too are violations of CIP requirements calling for covered entities to "implement and document" access controls for "all electronic access points to the Electronic Security Perimeter(s)." Specific requirements that were violated suggest that the companies failed to implement access controls that "denies access by default," "enable only ports and services required for operations and for monitoring Cyber Assets within the Electronic Security Perimeter," and ensure the authenticity of parties attempting to remotely access the company's "electronic security perimeter."
The country's grid is one giant 0-day. Best not to pics details or even identities until it is mitigated.
it definitely seems prudent to keep the specifics from the world at large. There have already been enough reports over the past few years to realize our electric infrastructure is vulnerable. It's good to see they are at least doing something to motivate these various entities to get their stuff protected.
It would be a smart move for any country that wants to attack to us to use a coordinated Internet attack against our grid while also hitting us in whatever fashion they intend, be it landing troops or bombing us with aircraft and ICBMs.
and ensure the authenticity of parties attempting to remotely access the company's "electronic security perimeter.
What's that?!? I thought that walls don't work. Since they don't, why did the President say this?
If the universe is someone's simulation -- does that mean the stars are just stuck pixels?
i sniff youre dog butthoal,
I just bought a disgusting BLT sandwich
Look, we know what power systems are resilient to attack and survive physical and internet attacks:
Renewable microgrids.
Naming old grid providers only provides rogue nation states and their kaiju hacker mercs with targets.
That said, give them 90 days and start jailing their senior execs. Fines won't work.
-- Tigger warning: This post may contain tiggers! --
Have gnu, will travel.
Since I'm off-grid, another way of saying I'm the power company for myself. And none of it is accessible from the internet. In fact, the only parts of it available on my LAN are the results of data acquisition - all actual control is not even on the local network. It's not that hard to push a button once in awhile...
Why guess when you can know? Measure!
WSJ reports, referring to Energywire, that it was Duke Energy.
This might be compensating an inadequacy of 'capitalism will provide'. It is definitely giving criminal management a right to be forgotten.
I understand why the power grid operations folks need good comms. I know load- and frequency-matching is very important. The Intertubes is a great thing for that.
I also know that ANYthing connected to the grid is at risk for intrusion. So, I keep wondering why that stuff is connected to the 'net, and why nodangbody suggests we fix that. After all, back before Al Gore made the Intertubes, they used common, ordinary voice telephones to coordinate the electric grid and other critical infrastructure systems. I hope, as I have for years, that someday I'll see the reasons this stuff's still on the 'net.
The only way that cyber security will be taken seriously is when failures result in serious damage to the profits of companies. Until then the temptation to do the minimum you can will remain far too great. Interestingly this is one of the advantages of having privitised utilities; you can burn them with fines without hurting the general public when they break the rules - a fact which the investors in the California utility should be about to find out unless the corrupt politicians of Sacramento shield their campaign contributor again. https://www.nytimes.com/2019/0...
There were no violations for High-Impact related Cyber Assets. This points to it being a small to medium sized outfit. Duke is to big.
Rumors I have heard within the industry and timing point to Grant County PUD in Washington state in the middle of no where. They lost some key staff just before their scheduled WECC audit. I suspect a lack of management support and the staff went somewhere that would play by the regulations. If it was Grant County PUD, $10M is huge as they have a customer base of 40K. If it was Duke, $10M is pocket change.
Citation needed.
This should make for an interesting DistribuTECH this week.
I wonder who the SCADA vendor was at the utility?