Securing the Smart Grid

Recently, hype around the Smart Grid, smart homes and smart meters has reached a fever pitch. Yet, many consumers are still figuring out what the term, “smart grid” actually means. According to a March 2010 Harris Poll, “two-thirds of Americans have never heard of it (68%) and 63% have not heard of a “smart meter.” It’s actually a pretty simple concept, though enormously difficult to deliver and implement the reality. The electricity grid is the vast, diverse collection of devices and equipment that delivers electricity from utilities to consumers. The Smart Grid refers to connecting those devices and that equipment into a network that is monitored and managed by computing resources. How one interprets “computing resources” is pretty broad, but Grid Net’s objective is to enable the Smart Grid with a secure, reliable, real-time, all-IP, standards-based and scalable software platform that can run on any device and leverage any type of broadband communications resource.

My own experience implementing the first Smart Grid network in the U.S. at Austin Energy, and now at Grid Net working with utilities in their Smart Grid deployments, has given me a unique perspective on security, and I’m not the only one. Security is a huge area of concern for every utility executive that I know. At the 2009 Black Hat security conference, security consultancy IOActive reported that it was able to simulate a smart meter worm that infected about 15,000 home meters (out of 22,000 homes) and subjected the devices to the control of the worm’s designers. At the time, IOActive’s Mike Davis stated that, “the vast majority of smart meter systems use no encryption or authentication processes to prevent someone from uploading malicious software or turning meters on and off en masse."

Let’s be clear: any time that you connect devices into a network, you face security risks. But networking our nation’s electricity grids poses even greater security hazards, since most devices are located in physically unprotected / vulnerable locations and simply cannot be protected by the “four walls” of a data center or a physical plant.

But even worse: some Smart Grid vendors are offering technologies that are actually accelerating the threat of viruses and worms spreading the damage from a single device getting hacked.

For example, vendors that rely on radio-frequency (RF) mesh networks are peddling an architecture that relies on “peer-to-peer” networking – in this case, using the meter as a network link – and that thereby increases the risk of ‘man-in-the-middle’ and impersonation attacks. In the RF mesh scenario, smart meters are the first, and highly vulnerable, line of penetration for hackers and virus-spreaders. Think of mesh network infrastructure as a self-propagating home botnet that makes the threat of spreading malware very, very real. It’s a scary thought.

While open standards for RF mesh networks are beginning to emerge at the physical and media access control layers, the networking specifications still lack definition as to how they will implement the robust, proven security methods and technologies described in the National Institute of Standards and Technology (NIST) specifications. Lacking open standards and the pervasive, granular implementation of proven, broadly-adopted, leading security methods and technologies, RF mesh networks remain virtually defenseless against attacks.

In designing the smart grid, utilities should hold their vendors accountable for implementing a multi-faceted security approach to their offerings. This should include the following:

Security starts at the edge device - While smart meter hacks are inevitable, utilities can protect their smart grid from a massive network virus or worm by implementing granular security architectures. Embed unique, standards-based hardware and software security into every network node and device. That way, the device can be detected and isolated before it proliferates a virus.

Use only standards-based security, and use it everywhere - By incorporating security standards throughout the smart grid, utilities can leverage the collective best efforts of tens of thousands of engineers, universities, government agencies and white-hat hackers, as well as hundreds of millions of dollars of investments in the latest security technologies. Moreover, standards-based security ensures faster upgrades and “future-proofing,” an idea essential for utilities to stay ahead in the never-ending “hack-patch” cycle of cyber security.

Make security pervasive and granular - Data encryption and IP security schemes are necessary but, by themselves, nowhere near sufficient. Instead, utilities must require that vendors deliver pervasive, granular security architecture in their solution offerings by incorporating government-grade security into: smart meters and other distribution network edge devices, embedded applications, the smart grid communications network infrastructure, smart grid network operating systems, data being stored and transmitted, and utility enterprise systems.

Security is a marathon, not a 40-yard dash - Maintaining a safe, secure smart grid requires continuous vigilance and the stamina to sustain ongoing investments in security oversight, critical software patches, software upgrades and process improvements. That’s because security threats are never-ending: hackers enjoy a challenge, and they intend to keep at it.

It’s time for utilities and their vendors to start building security protocols into every aspect of the smart grid fabric. It’s also time for utilities to hold their vendors accountable for flawed architectures and vulnerable technologies. The risks are too great to take lightly.