Conspiracy theories and wild media assumptions aside, how vulnerable is the smart grid to cyber attack?
There will always be extremes on the risk spectrum: one side that is sure that smart grids will succumb to devastating cyber attacks (power plants exploding, power outages for months, etc.) and the other side that believes the risks are merely scare tactics. The security industry has once again been accused of using FUD (fear, uncertainty, and doubt) to push its products and services into the smart grid arena and the energy industry has been accused of not addressing security and privacy issues.
As usual though, it is somewhere in the middle of the spectrum. Governments, utility companies, and technology vendors are actively considering the security risks that are associated with a smart grid. However, researchers have already uncovered and presented vulnerabilities in smart grid technologies at security conferences and, if history has taught us anything, more vulnerabilities and attacks will almost certainly be identified in the future. The risk of smart grid cyber attacks will never be eliminated, but it can be properly managed.
As systems grow in size, complexity and importance, it's natural for security risks to grow as well. Does an increasingly digital smart grid necessarily mean a less secure grid?
An increasingly digital electric grid increases the number of cyber attack vectors. In other words, there will be more ways to attack the electric grid through cyber attacks. Those who defend against cyber attacks are always at a disadvantage since they need to protect against every possible attack vector, as opposed to attackers that may only need to find one vulnerability. An effective security program could mitigate most of the risk associated with a digital electric grid. The real question is whether every utility company and technology vendor involved with a smart grid will allocate the necessary resources to implement an effective security program.
Based on your experience, what technologies should be used to mitigate the most dangerous risks while still enabling infrastructure upgrades?
Unfortunately, there is no silver bullet technology for securing a smart grid. There are hundreds of unique technologies in a smart grid, each with its own set of security issues, and the number will only continue to grow. Each component of the smart grid will pose its own risk and have its own set of security controls that will need to be implemented.
Fortunately, most existing security controls (authentication, authorization, encryption, etc.) can be utilized in smart grid technologies. Although, one of the current issues is implementing these security controls in smart grid devices that have limited resources. For example, encryption is computationally expensive and could cause problems for devices that were not built to handle it. Adding on security controls to a device that was designed to only execute its intended operational functionality will most likely cause performance issues, which is why it is imperative to design devices with security in mind and be able to update the device to protect against future threats.