Tony Flick has worked for over eight years in the security industry and is currently a Principal with Tampa-based FYRM Associates. He has presented at Black Hat, DEF CON, ShmooCon and OWASP chapter meetings on Smart Grid and application security concepts. In this interview he discusses smart grid security and the related challenges as well as his book - Securing the Smart Grid.

Conspiracy theories and wild media assumptions aside, how vulnerable is the smart grid to cyber attack?

There will always be extremes on the risk spectrum: one side that is sure that smart grids will succumb to devastating cyber attacks (power plants exploding, power outages for months, etc.) and the other side that believes the risks are merely scare tactics. The security industry has once again been accused of using FUD (fear, uncertainty, and doubt) to push its products and services into the smart grid arena and the energy industry has been accused of not addressing security and privacy issues.


As usual though, it is somewhere in the middle of the spectrum. Governments, utility companies, and technology vendors are actively considering the security risks that are associated with a smart grid. However, researchers have already uncovered and presented vulnerabilities in smart grid technologies at security conferences and, if history has taught us anything, more vulnerabilities and attacks will almost certainly be identified in the future. The risk of smart grid cyber attacks will never be eliminated, but it can be properly managed.

As systems grow in size, complexity and importance, it's natural for security risks to grow as well. Does an increasingly digital smart grid necessarily mean a less secure grid?

An increasingly digital electric grid increases the number of cyber attack vectors. In other words, there will be more ways to attack the electric grid through cyber attacks. Those who defend against cyber attacks are always at a disadvantage since they need to protect against every possible attack vector, as opposed to attackers that may only need to find one vulnerability. An effective security program could mitigate most of the risk associated with a digital electric grid. The real question is whether every utility company and technology vendor involved with a smart grid will allocate the necessary resources to implement an effective security program.