Yesterday I had the pleasure of attending Anixter’s “The IP Connected Grid: The Future of the Intelligent Electric Power Network”  in Columbus, Ohio.  Here are my notes on the keynote address by Joe Weiss author of, “Protecting Industrial Control Systems from Electronic Threats”.  Mr. Weiss had the provocative and overall point that with the coming ’smart grid’ there is the convergence of IT security onto a electric power grid that in its current nature is void of security due to the power grids requirements to be reliable.   An added point is that our nation is in dire need of a particular skill set that is a blend of IT security know-how and power-grid expertise. Mr. Weiss commented that fewer that 100 people worldwide have this blend of skills because it draws from both IT and engineering backgrounds.

Here’s are my notes:

• Security has focused up until now on the end users and control systems.  Now that focus is shifting to the IT community.  Joe begins the presenation with the simple question, “What is a Smart Grid?”
  • • Multiple answers
      • AMI  (automated meter)
      • home automation
      • substation automation
      • plant automation

        What is common- two way communication – cyber!

• Mr. Weiss notes that not all power grid security incidences are malicious and he recounts the story of an engineer who using remote access login gained access to a private substation to update firmware. The update was not announced or known to the plant operators and the a firmware error in the update caused shutdown of entire operations of the plant. It was remote access, it was intentional, but it was not malicious.

• Mr. Weiss recounts another incident where corporate IT staff plugging an ethernet cable into SCADA network, which totally saturated the network and brought system down.  He tells these stories to remind IT network engineers that they are now apart of the electric grid process anytime IT interfaces with the power grid and the law of unintended consequences is very real, because the infrastructure was never designed for IT controls.

• Why Smart Grid
  • Customer “choice”
  • Minimize new infrastructure
  • improve grid reliability
  • improve safety
  • funding is available from stimulus
  • some or all the above

• A workflow the smart grid:  customer premise >> AMI meter > SCADA > utility substation > utility back office

• The problem that Mr. Weiss points out is that when you get to the industrial control, there is almost no security, such as the substation.  Why – reliability and safety.  Reliability and safety go almost opposite to security. We want our systems as open as possible, this is the opposite of security. How do we balance it?

Mr. Weiss spoke further on the needs for our nation to develop professionals who are competent in both IT security and with electric engineering. Since our current education system separates these two fields typically in separate colleges of Science and Engineering, it is difficult to develop skilled professionals with these fields and currently there are no U.S. education programs that have a program in place to educate future Smart Grid security engineers.