Smart grid security facts
by Mirko Zorz - Tuesday, 2 November 2010.
Tony Flick has worked for over eight years in the security industry and is currently a Principal with Tampa-based FYRM Associates. He has presented at Black Hat, DEF CON, ShmooCon and OWASP chapter meetings on Smart Grid and application security concepts. In this interview he discusses smart grid security and the related challenges as well as his book - Securing the Smart Grid.

Conspiracy theories and wild media assumptions aside, how vulnerable is the smart grid to cyber attack?

There will always be extremes on the risk spectrum: one side that is sure that smart grids will succumb to devastating cyber attacks (power plants exploding, power outages for months, etc.) and the other side that believes the risks are merely scare tactics. The security industry has once again been accused of using FUD (fear, uncertainty, and doubt) to push its products and services into the smart grid arena and the energy industry has been accused of not addressing security and privacy issues.

As usual though, it is somewhere in the middle of the spectrum. Governments, utility companies, and technology vendors are actively considering the security risks that are associated with a smart grid. However, researchers have already uncovered and presented vulnerabilities in smart grid technologies at security conferences and, if history has taught us anything, more vulnerabilities and attacks will almost certainly be identified in the future. The risk of smart grid cyber attacks will never be eliminated, but it can be properly managed.

As systems grow in size, complexity and importance, it's natural for security risks to grow as well. Does an increasingly digital smart grid necessarily mean a less secure grid?

An increasingly digital electric grid increases the number of cyber attack vectors. In other words, there will be more ways to attack the electric grid through cyber attacks. Those who defend against cyber attacks are always at a disadvantage since they need to protect against every possible attack vector, as opposed to attackers that may only need to find one vulnerability. An effective security program could mitigate most of the risk associated with a digital electric grid. The real question is whether every utility company and technology vendor involved with a smart grid will allocate the necessary resources to implement an effective security program.

Based on your experience, what technologies should be used to mitigate the most dangerous risks while still enabling infrastructure upgrades?

Unfortunately, there is no silver bullet technology for securing a smart grid. There are hundreds of unique technologies in a smart grid, each with its own set of security issues, and the number will only continue to grow. Each component of the smart grid will pose its own risk and have its own set of security controls that will need to be implemented.

Fortunately, most existing security controls (authentication, authorization, encryption, etc.) can be utilized in smart grid technologies. Although, one of the current issues is implementing these security controls in smart grid devices that have limited resources. For example, encryption is computationally expensive and could cause problems for devices that were not built to handle it. Adding on security controls to a device that was designed to only execute its intended operational functionality will most likely cause performance issues, which is why it is imperative to design devices with security in mind and be able to update the device to protect against future threats.


What's the real cost of a security breach?

The majority of business decision makers admit that their organisation will suffer an information security breach and that the cost of recovery could start from around $1 million.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Thu, Feb 11th