Forgot your password?
typodupeerror
Power Security Book Reviews

Securing the Smart Grid 97

Posted by samzenpus
from the protect-ya-neck dept.
brothke writes "Securing the Smart Grid: Next Generation Power Grid Security, authors Tony Flick and Justin Morehouse provide a comprehensive and first-rate overview of smart grid technology and what is needed to ensure that it is developed and deployed in a secure and safe manner. An issue is that smart grid has significant amount of hype around it, including the promise that it will make energy more affordable, effective and green. With that, promises around security and privacy are often hard to obtain." Read on for the rest of Ben's review.
Securing the Smart Grid: Next Generation Power Grid Security
author Tony Flick and Justin Morehouse
pages 320
publisher Syngress
rating 9/10
reviewer Ben Rothke
ISBN 1597495700
summary Excellent overview on smart grid technology and its related security, privacy and regulatory issues
While the books notes early on that there is no singular definition of what defines smart grid, a generally accepted definition is that it is a "network of technologies providing real-time two-way communication that delivering electricity from utilities to consumers".

Most importantly, it is crucial to understand that the smart grid is an evolving environment, not a single entity or technology.

As important as the smart grid and security is, roughly 80% of Americans claim to know little or nothing about the smart grid, while 76% lack knowledge or understanding of smart meters, according to results of the latest Market Strategies International E2 Study.

From a security perspective, securing the smart grid is a complex endeavor. When you combined this with a public that is oblivious to the security and privacy issues, it gets worrisome quite fast.

The books 14 chapters provide a good overview of the various aspects of smart grid, energy and utility transmission, security, privacy attack vectors and more. The book offers a good balance of the topics, in a very readable format.

In chapter 1, the authors note that a smart grid is not a single device, application, system network, or even idea. And that there is no single authoritative definition for what a smart grid is. With that, the initial chapter sets and defines the various aspects to smart grid.

Chapter 2 provides an overview of the threats and impacts of smart metering at the consumer level. A large part of smart grid technologies is advanced metering infrastructure (AMI), which is a set of systems that measure, collect and analyze energy usage, and interact with advanced devices such as electricity meters, gas meters, heat meters, and water meters, through various communication media. Once smart grid is ubiquitous, AMI will be a hacker's platform of choice.

With all those benefits of AMI come security and privacy issues, and those open the metering infrastructure to smart thieves, stalkers, and a broad range of other threats and attacks. AMI also opens up a new set of privacy issues in that the AMI devices will be collecting significant amounts of personal energy data, which may or may not be transmitted over a secure channel.

Unfortunately, leaving security to vendors of home-based products has traditionally not been met with much success. Let's hope the smart grid vendors learn from the security debacles of the past and build effective and strong security into their products.

Chapter 4 notes that smart grid security is a matter of national security and that the US government is playing a large role in directing the effort. Numerous groups have efforts in place to secure smart grids, including DOE, FERC, DoC, DHS and more.

An important group working on this is the NIST Cyber Security Working Group (CSWG). The primary goal of the CSWG is to develop an overall cyber security strategy for the smart grid that includes a risk mitigation strategy to ensure interoperability of solutions across different domains/components of the infrastructure. This strategy addresses prevention, detection, response, and recovery.

The CSWG recently created NISTIR 7628 — Guidelines for Smart Grid Cyber Security, which complement everything detailed in this book. It also has the added benefit of being free. At 577 pages, it is also much more comprehensive.

Chapter 11 is especially fascinating, which deals with the topic of social networks and smart grid. While smart grid can leverage the power of social networking, it is inevitable that people will start tweeting about their energy usage. While that energy data may seem like an innocuous tweet, that information can be used to determine if the people are at home, on vacation, using specific appliances, etc.

For example, the Lyceum is the oldest building on the University of Mississippi campus. The Lyceum also has a twitter feed about its energy usage. While this is more informational, when individuals start sharing their energy usage, without effective social media controls, the security outcome is quite predictable. With that level of information disclosure, it is quite easy to determine if a family is home, not home, sleeping, entertaining guests, etc.

As to users who in the future will integrate tweets and other energy data into their social networking, the chapter illustrates how much of a security risk this can pose by detailing vampire energy cost estimates for over 75 different types of electronic products. Attackers can use the energy data and extrapolate what products are in use, when, and more.

The chapter concludes with a smart grid social networking security checklist. The smart grid social networking security checklist contains five categories for implementing basic security controls, name around: identity, authentication, information sharing, networking and usage.

The book also includes a number of sidebar Epic Fail stories, which detail major failures and catastrophes in various energy topics.

Overall, Securing the Smart Grid: Next Generation Power Grid Security provides an excellent overview on the state of smart grid technology and its related security, privacy and regulatory issues. The book provides an excellent introduction for anyone looking to understand what smart grid is all about, and its security and privacy issues.

You can purchase Securing the Smart Grid: Next Generation Power Grid Security from amazon.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

*

This discussion has been archived. No new comments can be posted.

Securing the Smart Grid

Comments Filter:
  • From a security perspective, securing the smart grid is a complex endeavor. When you combined this with a public that is oblivious to the security and privacy issues, it gets worrisome quite fast.

    If residential end users have to worry about the security of the power grid, the "smart grid" is a bad idea.

    • by RapmasterT (787426) on Wednesday January 05, 2011 @04:04PM (#34768762)
      Say what you will about the security or reliability of our current power grid, but it's got uptime measured in a whole shitload of 9's.
      • by Desler (1608317)

        There have been more than a dozen major power outages in the US since the 1960s. That's far from having even a single 9.

        • by Orne (144925)

          Well, the bulk electric system is designed to "one event in 10 years", which works out to about 99.95% uptime.

          • Well, the bulk electric system is designed to "one event in 10 years", which works out to about 99.95% uptime.

            Depends on the duration of the event.

            • by SHP (8391)

              The US average annual interruption per customer is 1.36 hours. I think that is from 2008. That's 99.98% uptime. That number would obviously be a bit lower for, say, 2003, but it's a good general indicator of overall grid reliability.

        • by plover (150551) *

          There have been more than a dozen major power outages in the US since the 1960s. That's far from having even a single 9.

          Then I don't think you understand the whole 9s concept. Uptime is referred to in terms of the percentage of time the resource is available. If a thing is there when you go to it half the time, its uptime is 50%. If the thing is there when you want it 999 times out of a thousand, its uptime is 99.9% That thing can be said to have "three nines" of uptime, because there are three nines in 99.9%.

          It's often easier to think of the resource in terms of how often it goes away. Five nines (99.999%) equates to j

          • by plover (150551) *

            Holy crap, I just saw below that San Francisco has rolling blackouts, and that California still has occasional power emergencies! I live in one of those countries!

            See, there's one advantage to living in a flyover state. We still have adequate power.

      • Say what you will about the security or reliability of our current power grid, but it's got uptime measured in a whole shitload of 9's.

        Funny you should mention that. I had an outage at my San Francisco Bay area townhouse just this morning. (While I was reading the electric bill. B-) ).

        I'm in "rotating outage block 50" - i.e. I don't get rotating outages because I'm on the same chunk of the grid with some essential services. Like the local City Hall, cop shop, and fire station (which also went down), serv

    • I work for a large electrical engineering company that develops technology that could be classified as smart gird technology. I think that the big game changer in the next 20 years is mainly going to be HVDC links using Voltage Source Conversion technology. This will allow a lot of low cost HVDC links to be constructed (this technology is perfect for offshore windfarms). Another technology that my company is involved in is Energy market management. So we run the servers that predict the loads from the n

    • by onionman (975962)

      My primary concern is that most of the components for the U.S. "smart grid" are going to be manufactured overseas in countries which we (the U.S.) might have a conflict with in the next several decades. This will give potential adversaries ample opportunities to install backdoors and logic bombs in the components to bring down critical infrastructure in the event of a conflict. Without better control over the supply chain, I fail to see how the "smart grid" could ever be secure.

      Even the lowly residential

  • is about making people feel the capital costs needed at peak times. Currently this is not the case. I fail to see how this will make energy more affordable.
    • by b0bby (201198)

      is about making people feel the capital costs needed at peak times. Currently this is not the case. I fail to see how this will make energy more affordable.

      I'd think that, as people avoid the peak-priced energy, there should be a leveling of demand, which should reduce the need for more power plants in the longer term, controlling costs. Right now they need to build plants to meet a few peaks (around here, the hottest summer days). Pepco came and installed a thermostat for me which can turn off my central ac at peak times (I noticed it once last summer) and I get a little money back for being part of the program. If enough houses have these types of devices (a

    • is about making people feel the capital costs needed at peak times. Currently this is not the case. I fail to see how this will make energy more affordable.

      Actually that turns out not to be the case. The idea of the smart grid was two-fold; It provided a vehicle for upgrading infrastructure that hasn't been upgraded since it was built in (mostly) the middle of the last century, and by giving the generators more fine-grained knowledge of when to apply secondary generation facilities for peak load. The latter would provide sufficient savings to bankroll the entire project.

      Or at least that was the opinion of the 20 or so C-level energy execs we interviewed in 20

    • by plover (150551) *

      It's not about making energy affordable. It's about modifying demand by holding consumers accountable.

      There is no effort to build new power plants in this country. We're not adding new coal plants, because they pollute. We're not adding new nuclear plants, because we don't know how to handle nuclear waste. We're not building new dams, because we might kill an endangered fish, or wreck some historic valley. At most, we're adding tiny little windmills and tidal generators and solar farms that have no pra

  • ...which is burning stuff with huge inefficiency and high cost, and ruining our environment and our standing in the world with unnecessary wars in the process.

    Green, renewable energy is LONG overdue.
  • Smart grid has nothing to do with the power grid (as in the nation's power grid / infrastructure). This has only to do with the "last mile" customers and making information available to customers to help them and the power companies better manage usage.
    While there are security implications, these are limited to maybe a hacker getting in and shutting down a bunch of meters or generally being a nuisance to customers and the power company.
    • by Yold (473518)

      Ummm.... no

      http://www.technologyreview.com/energy/26472/?p1=A1 [technologyreview.com] (How to hack the energy grid for fun and profit)

      • Ummm.. no. The article you reference is bullshit.

        This guy is just spreading FUD. Typical academia crap that seems to think - "Oh geez, I wonder if those guys with decades of experience in the power distribution business ever thought of this?" It may be hard to believe, but sometimes the smartest people work in the business sector and not in education. As the old saying goes, "those than can, do; those that can't, teach".

        I've been working with AMI (aka smart grid) for years now and am in fact right now i
        • No you are spouting bullshit. "Smart grid" is about meters for the customer. True. But it is ALSO about giving the company control to do rolling blackouts during peak times, or lowering the temperature during peak times. How do I know? It's already happening.

          Some smart gird technologies also include high-speed internet (although it is atypical). That's both good and bad. Good for the internet access, but bad for Shortwave, AM, FM/HD Radio, and VHF TV customers since they generate spurious noise that

          • But it is ALSO about giving the company control to do rolling blackouts during peak times, or lowering the temperature during peak times. How do I know? It's already happening.

            More FUD. Rolling blackouts have been going on for years. The utilities don't need smart meters for that. They may choose to perform blackouts using smart meters, but it simply allows them to do what they are already doing at a more fine grained level. Now exactly how is the utility "lowering the temperature during peak times" unless you have a thermostat that you put in your house and given the utility the ability to control it? Do you think the utilities are releasing little gremlims to go around adjusti

            • by Golddess (1361003)

              Now exactly how is the utility "lowering the temperature during peak times" unless you have a thermostat that you put in your house and given the utility the ability to control it?

              That does seem to be how BGE Peak Rewards operates, yes. But even without it, if they can cut power to individual appliances (say, the AC or furnace), that too could alter the temperature without ever needing to touch the thermostat dial.

            • >>>Now exactly how is the utility "lowering the temperature during peak times" unless you have a thermostat that you put in your house and given the utility the ability to control it?
              >>>

              That's why it's called a SMART meter.
              It can be controlled remotely.
              The company can adjust the temperature.

              • I think you are missing my point. A smart meter is just that - a meter - the thing that sits outside your house with the numbers spinning on it.

                The power company can close the switch (giving your house power) or open the switch (turning off the power to your house), or it can obtain the current consumption and/or demand readings and use it for billing and/or load management. It can't change your thermostat. This is not to say that you can't install a thermostat in your house, tie it in to your smart meter
                • Oh I see.
                  You're being pedantic with the word "meter". Stop it. When BGE offered to install "smart metering" in my home it wasn't JUST the meter. It also included an upgrade of the thermostat which could record my temperature, report the results to BGE, and even give BGE control to adjust it up or down. Smart metering is an all-inclusive term just like "PC" or "Mac" is inclusive of both the actual hardware AND the software (windows and OS X).

                  • Sorry, I wasn't trying to be pedantic but your post implied (at least that's how I read it) that somehow BGE was nefariously altering thermostats against peoples' will or without their knowledge. The fact is you are agreeing to allow them to do this for (I assume) some discount in your kWH rate or some other perk. The term "Smart Grid" does encompass all things related to it, but it's not an all or nothing proposition. Your utility can offer only smart metering (with nothing else included), or it can offer
                    • >>>(I don't think) it can force this down your throat

                      Not yet, no. But time will tell. If Congress can force me to buy hospital insurance that I don't want (I pay cash), then they can also force me to accept external control (either by BGE or the USC) of my thermostat.

  • by dkleinsc (563838) on Wednesday January 05, 2011 @04:22PM (#34769034) Homepage

    Skimping on line and generator maintenance in an attempt to boost profits, but which knocks out power for a significant section of the Northeast US and Canada when the chickens come home to roost. (All completely hypothetical [wikipedia.org], of course)

    • by Anonymous Coward

      Enter FERC [ferc.gov]/NERC [nerc.com] which then mandates and fines utilities for not doing the right thing. The bad thing is this puts a burden on utilities already doing the right thing as they now have to deal with NERC audits. In the end, it's they way to go, but it would have been better of the power industry policed itself (but responsibility without authority is pointless, which is where FERC authority to fine millions per day [ferc.gov] gives NERC the ability to carry out this responsibility).

  • I'd be ticked if someone were to remotely keep my coffee maker from turning on in the morning! The horror!
  • by losttoy (558557) on Wednesday January 05, 2011 @04:34PM (#34769192)
    "In chapter 1, the authors note that a smart grid is not a single device, application, system network, or even idea. And that there is no single authoritative definition for what a smart grid is. With that, the initial chapter sets and defines the various aspects to smart grid."

    Read - we took generic security concepts and replaced "computer network" with "smart grid" in the text.

    As someone who has worked for a successful smart grid company, there is very little known outside of these start-ups about how smart grids work. Most talks you see around *smart grid* security at blackhat or defcon are centered around decade old meters and technology. Those are ancient!
  • by sxltrex (198448) on Wednesday January 05, 2011 @04:39PM (#34769232)

    As someone who has worked on distribution automation for a large electric utility for the past 13 years, I've never understood the fascination with the cyber aspect of securing the grid. It would be far easier to cause a major outage with a 4x4 truck and a few pounds of high explosive, yet I don't recall a single attack of any type against a transmission tower anywhere in the U.S.. As for intercepting and deciphering meter data (a truly non-trivial task), it would be far easier for thieves to simply watch the houses in a given neighborhood, a la Home Alone.

    The residential meters do have disconnect capability, but by design this functionality ignores broadcasts. Therefore a hacker could only affect a single residence at a time, and even then only if they knew the encrypted disconnect command. An insider attack is the only real threat, and that is not addressed here.

    • by odin84gk (1162545)

      The fascination is based on an attack with X country. If they knew of a crippling zero-day exploit (For example, a "recloser- Open" command, or a "MV Switch ON/OFF" command), they could theoretically disable portions of the grid from the safety of their own home.

      Heaven forbid they can download custom firmware. Then they could tell every Smart Car Charger to charge their electric automobiles at the same time. Think about it. A neighborhood full of electric cars charging at the same time. Makes most utility g

      • by Orne (144925)

        Yeah, but the utility companies are paid to design the network to handle the worst-case load scenario. It's the one thing they are totally allowed to pass the cost on to the consumers .. reliability. If the whole neighborhood upgrades to electric vehicles, the distribution company puts in a larger transformer and ups their rates.

        • by jeffstar (134407)

          the idea is that the cars will be smart grid enabled and only charge when you aren't running the dishwasher and the dryer and the oven and 3kw of lighting already, thereby maximizing the use of the existing infrastructure's capability.

    • by Dare nMc (468959)

      > As for intercepting and deciphering meter data (a truly non-trivial task), it would be far easier for thieves to simply watch the houses in a given neighborhood
      Your assuming some security that's not likely there, the point of the article, it need to be done right for that to remain true. Power lines are un-shielded so intercepting it is as simple as a small antenna. These systems also currently work by having a reader download what is stored in all meters for a building/neighborhood on demand (trust

    • by goudan (1971556)
      They named these shoes Fools cheap jordans for sale [uksportshoes.co.uk] air max 1 [uksportshoes.co.uk] Gold, perhaps because bright yellow color, contains these sneakers. Thi s yellow on the insole, lining, side Nike Air Max 95 uk [uksportshoes.co.uk] panels and displays in front of shoe with a very distinctive look. Besides this color, a shade of brown field and pulling at the neck found, while the dark brown hues and Nike logo on the sides. This sneaker also has a black rubber washers and heel tab, with the logo of Nike Air. This shoe is designed with a midsole with
    • yes.i agree with you really.
  • Will it stay on after the zombie apocalypse? Stupid context, but seriously, if the smart grid is going to be able to talk to my fridge and potentially let some hacker melt my icecream, that means it will have a lot of complexity to it. With that level of complexity (and invested time/money) it damn well better stay on for a bit if it has to be left unattended.
  • Trying to avoid getting off-topic and digressing into yet another diatribe on Smart-Grid technologies and focusing on the content of the book. . . This is a good introductory book on the topic. Not very deep, nor will you find the technical details on the wide range of technologies, but then again - the technical details of Smart Grid technologies would fill thousands of pages and the discussion of all the security implications, thousands more. So, this book is a good 50,000 foot view, and it fills a void

As the trials of life continue to take their toll, remember that there is always a future in Computer Maintenance. -- National Lampoon, "Deteriorata"

Working...