US Preps Cyber Outfit To Protect Electric Grid 58
coondoggie writes to mention that the US Department of Energy is planning to set up a new "National Energy Sector Cyber Organization" in order to protect the national bulk power electric grid. For the low, low cost of $8.5 million they will help integrate smart grid technology with the electric grid, speed research, and establish new policy and protocols. "It is paramount that smart grid devices and interoperability standards include protections against cyber intrusions and have systems that are designed from the start (not patches added on) that prevent unauthorized persons from gaining entry through the millions of new access points created by the deployment of smart grid technologies, Hoffman stated."
Make the process open (Score:2, Insightful)
Recently I saw that a bunch of stimulus funds were handed out [arst.ch] for bringing the nation's electrical grid into the 21st century. A big part of this is using computers to control various parts of the grid, from utility scale substations down into the home with smart meters and smart appliances.
Anytime you take infrastructure and connct it to computers you are opening it up to a whole new set of threats as well as bringing privacy implications.
Here's a couple great [wired.com] articles [arst.ch] that go into the details better t
Re:Make the process open (Score:5, Insightful)
Systems that control key infrastructure for your nations production and commerce should be on an completely separate network. End of story really.
For the information that needs to be distributed over the internet, make it eyes only transferred from the control network to the internet connected systems (double workstation setup). Then your only concern is direct espionage.
Re: (Score:3, Interesting)
I agree that it should be, however it is completely cost prohibitive to get a separate network run to the smart meter in everyone's home. Even running a separate network to all the utility substations would be challenging.
In reality, VPNs run all over the public internet, and can be extremely secure. DOD even allows parts of their classified networks to run over the commercial internet, provided they have the correct encryption gear at each end. The DOD gear is really expensive and tough to get setup,
Re: (Score:1)
Nobody Expects Chinese Smart Grid Hack! (Score:2)
Re: (Score:1)
Re: (Score:1)
Oh, and monitoring stuff they shouldn't be monitoring.
If the pipe was limited to government interaction alone, and all other data activity continues to run over current commercial pipes, then it would make sense.
As for them monitoring the data, if the "monitoring" process was open, that is, it could be scrutinized by the public, then it would not be bad.
For some people, they may be so poor that they use the government pipe for Internet. If they're going to use a service paid for by taxpayers, it's the responsibility of the government to make sure the pipe's n
Re: (Score:2)
Yes, I want a government owned network piped into my house without my permssion.
That would make me a happy taxpayer.
mmmmhmmmmm
I love you, government. I would marry you, if you were a woman (so as to fit within the proper constitutionally defined government definition of marriage as "one man and one woman"). But you don't so that would be wrong.
Forgive my transgressions oh, government and deliver me from evil.
blah blah blah.
Re: (Score:1)
I agree that it should be, however it is completely cost prohibitive to get a separate network run to the smart meter in everyone's home. Even running a separate network to all the utility substations would be challenging.
The smart meter is already connected to a network of hard-lines which links it to every other smart-meter in its area, as well as the substations those houses draw power from.
How cost-prohibitive is that?
Re: (Score:1)
This is absolutely true...you have to look at it end-to-end. However, if you can get all the internet communication to be over the VPN, that leaves an impossibly small vector for penetration from the internet (just the server with its one VPN port could be attacked).
Obviously (or maybe not so), you'd need to also think about the security of all the devices out there...what happens if one gets physically compromised, etc., but getting them so they're not accessible to the public from the internet is a grea
Re: (Score:2)
Yeah, I totally agree with this. Hopefully that will be exactly the recommendation that these geeks make to the government. We simply cannot afford to take chances with the security of our power grid. If it's at all possible for hackers to knock it out, they will.
Future terrorism will be aimed at hollowing out national governments, to basically make them unable to control their territory. (This is already happening now in Mexico, Nigeria, Iraq, etc.) To do this, attacks disrupt the very services that pro
Re: (Score:3, Insightful)
They ARE. I serviced DR systems for serveral power companies. by LAW there is not even an internet connection allowed in the BUILDING (let alont the room) housing the grid switch control systems, not even a modem.
I was frisked each time entering, and had to go through 2-3 layers of security to get in the room. Even then, i could only touch the DR equipment once an employee physically disconnected it (for hardware repairs), or they had to enter all the keystoks personally, all i could do was watch and ins
Re: (Score:2)
One of the better systems I've seen for doing this was one implemented for a company that had a private network that was disconnected fron the Internet just for embedded devices:
The internal network for reporting on embedded stuff had one machine that polled the embedded controllers and pulled data from them. The corporate intranet had another box which took the data and moved it to a Web server. Connecting the two was a serial cable, which was fast enough at 19200 BPS to move the small datasets, and a cr
Make the sysem intrinsically secure (Score:2)
Security approaches: Intrinsic vs. Extrinsic; Mutual vs. Unilateral.
How about decentralizing the "brittle power" system more in the first place, so you have "intrinsic security" so it degrades slowly under attack rather than rely heavily on "extrinsic security" through guards or passwords for controlling some central system? For example, renewables such as solar panels and fuel cells at each home would make energy production in a country difficult to interrupt intrinsically (assuming there was no single poi
Re:Make the process read-only (Score:2)
Re: (Score:2)
I agree purely with what you say, they must take into consideration the bruce willis factor, he might not be around next time to save the day, and we still have so many bad guys out there.
Seriously though, I do hope they do a better job this time around then last time to maintain the integrity of the power grid
"Cyber Outfit" (Score:3, Funny)
Re: (Score:2)
I guess they do not watch movies much (Score:1)
This was covered in "Live Free or Die Hard". Hello!!! What if Timothy Olyphant were to go crazy one day and believe he is still on the set of Live Free or Die hard? We might actually be taken over by cyberpunk terrorist. God help us....
Whenever You See the Prefix "Cyber"... (Score:3, Funny)
...and you double-check the calendar, and you see that it is not 1996, you know you are in for some expensive government boondoggle or another.
Small pricetag (Score:3, Informative)
Wouldn't a Smart Grid be Less Secure? (Score:3, Insightful)
From the summary:
they will help integrate smart grid technology with the electric grid
It's pretty obvious to anyone familiar with computer networking that making the the electric power grid "smart" would make it more vulnerable to attack. After all, if the grid's control apparatus isn't online, there's no way to hack into it in the first place. I realize there are other advantages to a smart grid but to claim that making the current "dumb" grid smart would also make it more secure seems disingenuous at best.
Re: (Score:1)
Re: (Score:2)
No,this is simply integrating PoE technology to smartgrid devices. It has absolutely NOTHING to do with managing the grid, grid switching systems, or other critical data that makes the grid stable (that's already a segregated system, actually even more secure than the ATM networks).
This is about policies for ensuring your home grid monitoring meter can access real-time info about local grid conditions, and to report usage information over the grid to the power company. It is NOT in any way about connectin
Re: (Score:1)
Re: (Score:2)
so maybe it is not security they are really interested in
here are a few thoughts
most federal electric policy seems to be designed to make price gouging practical. from a certain point of view, the problem with last big electrical speculation frenzy is that the power transmission lines could not support the manipulation, so the big push was for more power transmission lines
so only authorized persons should have your data. think of the political and ideological advantages of knowing exactly what you were us
Re: (Score:2)
read the soltion here (Score:2)
Re: (Score:1)
Re: (Score:2)
Re: (Score:1)
deployment of smart grid technologies (Score:2)
It is heartening to hear that though some facets of our educational system will have to tighten their belts, the dumb grids will still pop out the other side of their educational experience so much smarter (and deployed!) than before
Is Bruce Willis involved? (Score:3, Funny)
I mean you just kind of figure he'd have to be.
Re: (Score:2)
I have news for you, the electric companies *aren't* taxing us. They are just collecting for the local, county, state and federal governments that *are* taxing us.
terrorist don't use computers (Score:1, Insightful)
20 guys, 20 uhauls, 20 tons of explosive, 20 throw way cell phones all parked under the 20 biggest transmission lines and there's not a thing that technology can do to stop it.
We knew how to do this twenty years ago (Score:1)
There, I just saved you 8.5 million dollars.
Re: (Score:2)
:: facepalm ::
Now, if it was *really* that simple, don't you think it would have already been done that way? The problem is, it's not that simple. For a variety of reasons (both technical, and non-technical), electrical systems can't just be disconnected from the grid. Too many other systems rely on this connection. And, even if it could, would that really be the answer? With more and more members of industry talking about smartgrid technologies, does it really make sense to do it this way? Then, of c
Re: (Score:1)
And I mean that.
The breakage is recent, and can be rolled back. Roll it the hell back.
As always, the biggest problem here is the one that you're showcasing strongly: the "its just too HARD" modality. Yeah, its really hard. Do it
We can't get a real Cybersecurity Czar, but... (Score:3, Interesting)
Has the current Cybersecurity Czar even made a statement about the recent hacking invasion from the Chinese government?
We can't get a real Cybersecurity Czar (Score:2)
Hell no. A former C-level executive at Microsoft [signonsandiego.com] is not going to touch that, it's an international incident that he helped cause [bbc.co.uk]. Look instead for smoke and noise about some other happy horseshit. It's bizarre how he could squeak past the employment interviews. Any background check should have turned up his employment at Microsoft, so either none was done or there is some serious co
right link- We can't get a real Cybersecurity Czar (Score:2)
(Let's try that again with the correct link.) http://www.latimes.com/news/nation-and-world/la-na-cyber-czar23-2009dec23,0,6636463.story [latimes.com]
Hell no. A former C-level executive at Microsoft [latimes.com] is not going to touch that, it's an international incident that he helped cause [bbc.co.uk]. Look instead for smoke and noise about some other happy horseshit. It's bizarre how he could squeak past the employment
So just remember: (Score:2)
If you get in trouble on the Internets, just say, "Let's Cyber!"
Please, someone think of the meter readers! (Score:2)
I'm surprised the current administration hasn't called the whole smart grid idea off. After all, won't it put tens of thousands of meter readers out of work? That probably hasn't occurred to them yet, but you just wait. Please, someone think of the meter readers!
The best protection is self sufficiency (Score:2)
I'm not worried about *cyber* attacks. (Score:2, Insightful)
A nation's electrical infrastructure is everywhere and largely unguarded - there's really nothing stopping a single, determined individual from doing an extreme amount of *physical* damage to a power company via sabotage.
Theoretically, there's no reason I can't:
- Sneak into the woods with a gas angle grinder and start cutting guy wires on hydro towers. Cut down a few >300KV lines feeding a city and they'll have no power for days.
- Break into unmanned substations and open oil drains on transformers. Or sh
Re: (Score:2)
i bet it takes a lot longer than a week to get a 30-60 MVA transformer delivered and installed. oil/explosion clean up would take a week!
Re: (Score:2)
So what got Al-Quaeda all interested in blowing up US buildings to begin with? It's not about Afghanistan or Iraq (those were post-911, after all). How was the US pissing off the Arab world? Oh! It's because the US was friendly with the Israel. Israelis are obviously deplorable monsters, as you can tell from their religion and their tendency to shoot back when you launch a bunch of rockets at them from acros