Cybersecurity Issues for the Bulk Power System
Released: 2015-06-10T00:00:00

Summary:
In the United States, it is generally taken for granted that the electricity needed to power the U.S. economy is available on demand and will always be available to power our machines and devices. However, in recent years, new threats have materialized as new vulnerabilities have come to light, and a number of major concerns have emerged about the resilience and security of the nation's electric power system. In particular, the cybersecurity of the electricity grid has been a focus of recent efforts to protect the integrity of the electric power system.
The increasing frequency of cyber intrusions on industrial control (IC) systems of critical infrastructure continues to be a concern to the electric power sector. Power production and flows on the nation's electricity grid are controlled remotely by a number of IC technologies. The National Security Agency (NSA) reported that it has seen intrusions into IC systems by entities with the apparent technical capability "to take down control systems that operate U.S. power grids, water systems and other critical infrastructure."
As the grid is modernized and the Smart Grid is deployed, new intelligent technologies utilizing two-way communications and other digital advantages are being optimized by Internet connectivity. Modernization of many IC systems (in particular, the Supervisory Control and Data Acquisition [SCADA] system) also has resulted in connections to the Internet. While these advances will improve the efficiency and performance of the grid, they also will increase its vulnerability to potential cyberattacks. Black Energy, Havex, and Sandworm are all recent examples of malware targeting SCADA systems. New devices (like smart meters) and increasing points of access (such as renewable electricity facilities) introduce new additional areas through which a potential cyberattack may be launched at the grid.
Many cybersecurity actions are reactive to the last threat discovered. While intrusion detection is a priority, some experts say that mitigation of cyber threats requires a focus on attackers, not the attacks. Cybersecurity strategies may shift from figuring out whether a system has been compromised to an understanding of who authored the malicious software and why. Although malware intrusions may not have resulted in a significant disruption of grid operations so far, they still have been possible even with mandatory standards in place. The North American Electric Reliability Corporation's (NERC's) current set of standards, Critical Infrastructure Protection (CIP) Version 5, is moving toward active consideration of bulk electric system security needs rather than just compliance with minimum standards.
Electric utilities emphasize the need for timely information sharing and advocate for liability protection from potential damages resulting from a major cyber event. Some observers argue that it is the responsibility of electric utilities to embrace security as part of their strategic business planning and operations. The National Electric Sector Cybersecurity Organization has identified six failure scenario domains intended to assist utility cybersecurity efforts. These scenarios also illustrate the continuing vulnerability of the grid to potential cyber and physical attacks, or a combination of both.
This report highlights several areas for congressional consideration to improve grid cybersecurity. One issue is whether electric utilities have the resources to make the financial investment and recruit staff to reduce vulnerabilities. Another issue is that NERC CIP standards do not apply to all points of grid connection to the distribution system, and these connections still may represent cyber vulnerabilities. The adequacy of current standards where they do apply is also an issue.

subsections: section_title: Introduction
paragraphs: In the United States, it is generally taken for granted that the electricity needed to power the U.S. economy is available on demand and will always be available to power our machines and devices. However, in recent years, new threats have materialized as new vulnerabilities have come to light, and a number of major concerns have emerged about the resilience and security of the nation's electric power system. In particular, the cybersecurity of the electricity grid has been a focus of recent efforts to protect the integrity of the electric power system. 
Power flows on the nation's electricity grid are remotely controlled by a combination of older, legacy systems and newer control technologies. Many of these legacy technologies are analog in design and were not originally connected to the Internet (although many are equipped with radio or other communications capabilities). But as the grid is modernized, the new "intelligent" technologies replacing them use advanced two-way communications and other digital advantages that likely will be optimized by Internet connectivity. While these advances will improve the efficiency and performance of the grid, they also potentially increase the vulnerability of the grid to cyberattacks. 
Cybersecurity is today, and will continue to be, a major issue and focus area for the electric power sector. The energy sector (i.e., electricity, natural gas, and petroleum) is one of 16 critical infrastructure sectors designated by the Department of Homeland Security. Incidents of reported cyber intrusions and attacks aimed at undermining the U.S. grid appear to be increasing. While parts of the electric power subsector have mandatory and enforceable cyber and physical security standards, some have argued that minimum, consensus-based standards are not enough to secure the system. Further, the electric grid is not isolated from attacks on other critical infrastructure sectors on which it depends (i.e., the natural gas subsector, water, and transportation), and mandatory and enforceable cybersecurity standards apply to only a few of the 16 critical infrastructure sectors. 
This report will discuss the current state of electric sector cybersecurity, surveying existing regulations and proposed efforts to improve cybersecurity in the wake of recently reported threats and potential vulnerabilities. The report will focus on the bulk power system under authority of the Federal Energy Regulatory Commission (FERC), which Congress directed to establish mandatory and enforceable reliability standards. Many cybersecurity standards and actions are in response to cyber events. As such, basic compliance with standards by electric utility companies may not be enough to achieve effective cybersecurity protections. Areas for possible further congressional consideration or action will be highlighted in this report.
section_title: Grid Components and Potential Vulnerabilities
paragraphs: The electric utility business encompasses the process of generating electricity and sending power to the ultimate user. The electrical grid is the name given to the machinery and power lines that enable power to be sent from the power plant to the ultimate user of electricity. As seen in Figure 1 , this generally requires an infrastructure made up of generating stations (where the power is produced), step-up transformers and transmission lines (whereby transformers increase the voltage so that the electricity can be sent over very long distances), and step-down transformers and distribution lines (whereby the voltage can be lowered allowing the electricity to be sent to businesses and homes to power machinery and devices). Depending on the regulatory regime in place, these system elements may be controlled by companies under state jurisdiction or entities under federal jurisdiction (such as regional transmission organizations or federal power marketing administrations).
Controlling and monitoring the various parts of the grid are industrial control (IC) systems, some of which are connected to the Internet. Other IC systems are not Internet-connected, and still rely on local area networks (LANs) or similar systems for control and reporting. The following paragraphs discuss these IC systems and potential vulnerabilities to intrusion and cyberattack. 
subsections: section_title: Electric Utility Industrial Control Systems
paragraphs: The grid relies on a number of electronic devices, switches and circuit breakers to regulate and report on the flow of electricity at different parts of the system. Together, these pieces of mechanical and automated equipment constitute the grid's IC systems, managing power plant controls, transformer yard and power bus functions, transmission system, and distribution substations. 
The IC system essentially operates in a "control loop" in which sensors continually check key components, with variable responses against control variables in order to ensure that the system is functioning as designed. If responses show a disturbance resulting in operation of the system outside normal operating parameters, then the system adjusts actuators to bring the system back to process norms, or sends alerts to human-machine interfaces (HMIs) to reconfigure the system or adjust operations in the control algorithms. Diagnostics and maintenance utilities are built into the system to "prevent, identify and recover from abnormal operation or failures." 
subsections: section_title: Supervisory Control and Data Acquisition Systems
paragraphs: One IC system used to control remote operations of the power grid is the Supervisory Control and Data Acquisition (SCADA) system. 
SCADA systems are highly distributed systems used to control geographically dispersed assets, often scattered over thousands of square kilometers, where centralized data acquisition and control are critical to system operation ... A SCADA control center performs centralized monitoring and control for field sites over long-distance communications networks, including monitoring alarms and processing status data. Based on information received from remote stations, automated or operator-driven supervisory commands can be pushed to remote station control devices, which are often referred to as field devices. Field devices control local operations such as opening and closing valves and breakers, collecting data from sensor systems, and monitoring the local environment for alarm conditions.
SCADA systems have been in use at least since the 1970s, and were adopted at a time when the focus of system design was on function and reliability. An example of a basic SCADA network is shown in Figure 2 . Historically, these systems consisted of remote terminal units which were often connected to a mainframe computer via telephone lines or radio connections. They were not typically connected to centralized networks. Utilities typically operated separate control systems created just to operate power plants and related infrastructure.
Over time, modification of SCADA systems has resulted in connection of many of these older, legacy systems to the Internet. However, many of these legacy SCADA systems were not designed with security features, allowing other potential pathways for a cyberattack. As a result, these systems may be vulnerable to intrusion through data reporting pathways, or attacks (for example) using a thumb drive to download malware like the Stuxnet worm. However, some of these earlier designs and configurations may not be as vulnerable to an Internet-launched cyberattack. The security issue, for old and new systems, then becomes both how they are connected to the utility's other systems, and what levels of security exist to detect and deter potential intrusions. 
section_title: Distributed Control Systems
paragraphs: Distributed control systems (DCSs) are used in power plant settings where process control requires feedback to maintain process conditions automatically about a desired set point. DCSs generally use several Programmable Logic Controllers (PLCs) to establish process tolerances. PLCs are typically microprocessor- or computer-based devices that are used extensively to control industrial equipment or processes. Communications over DCS or PLC networks need to be more reliable and function at higher speeds "compared to the long-distance communication systems used by SCADA systems" because of the process control functions of DCSs. 
section_title: Modernization and the Smart Grid
paragraphs: The electric grid of the United States has been called an "engineering marvel," but it is a system which in many places is becoming an "aging marvel."
America relies on an aging electrical grid and pipeline distribution systems, some of which originated in the 1880s. Investment in power transmission has increased since 2005, but ongoing permitting issues, weather events, and limited maintenance have contributed to an increasing number of failures and power interruptions. While demand for electricity has remained level, the availability of energy in the form of electricity, natural gas, and oil will become a greater challenge after 2020 as the population increases. Although about 17,000 miles of additional high-voltage transmission lines and significant oil and gas pipelines are planned over the next five years, permitting and siting issues threaten their completion.
In recognition of the need to deploy new technologies, Congress indicated its support for grid modernization in the Energy Independence and Security Act of 2007 (EISA) ( P.L. 110-140 ). Specifically, Section 1301 of the act states: 
It is the policy of the United States to support the modernization of the Nation's electricity transmission and distribution system to maintain a reliable and secure electricity infrastructure that can meet future demand growth ... which together characterize a Smart Grid...
The "Smart Grid" refers to the evolving electric power network as new information technology (IT) systems and communications capabilities are incorporated. EISA Section 1301 further states that aspects characterizing a Smart Grid include 
Increased use of digital information and controls technology to improve reliability, security, and efficiency of the electric grid. Dynamic optimization of grid operations and resources, with full cybersecurity. Deployment of ''smart'' technologies (real-time, automated, interactive technologies that optimize the physical operation of appliances and consumer devices) for metering, communications concerning grid operations and status, and distribution automation.
 Figure 3 provides a conceptual illustration of what a Smart Grid network may look like. The many disparate elements and user systems also emphasize the need for secure communications pathways required for Smart Grid operation. 
Smart Grid networks are also potentially better able to integrate the intermittent energy from renewable electricity technologies (i.e., renewable electricity systems such as distributed solar photovoltaic [PV] and wind), distributed generation, demand response, and consumer energy efficiency programs. 
While the potential of the Smart Grid to revolutionize the ways power is generated and used is great, so too are the potential cybersecurity risks. Additional Smart Grid components may add to the ability to control power flows and enhance the efficiency of grid operations, they also potentially increase the susceptibility of the grid to cyberattack. Smart Grid components are built around microprocessor and other hardware devices whose basic functions are controlled by software programming. These devices and functions may be subject to manipulation over a network. The information processing and communications attributes which make the Smart Grid attractive are the very same attributes which can increase the vulnerability of the electric power system and its critical infrastructure to a possible cyberattack. This risk is potentially increased for systems connected to the Internet.
section_title: Other Potential Vulnerabilities
paragraphs: The grid has other potential vulnerabilities and avenues that a cyberattacker might seek to exploit. Independent researchers are reported to have found hacking into grid computer networks to be "startlingly easy," and they have alerted authorities to their findings. While new security systems and controls are added to address known weaknesses, new vulnerabilities may emerge as new devices and avenues of access are added. 
subsections: section_title: Distributed Generation
paragraphs: Renewable electricity generation is increasing and is highly distributed to capture the best renewable resources available to maximize the amount of power generated. However, these facilities can represent potential backdoors for cyberattackers to access the grid. Renewable electricity companies in Europe reportedly were targeted by cyberattackers at a clean power website from which malware was passed to visitors, thus giving the attackers access to the power grid:
The communication networks and software that link green energy sources to the grid as well as the electronic meters that send real time power usage to consumers and utilities are providing new back-door entry paths for computer hackers to raise havoc with the grid.
section_title: Smart Meters
paragraphs: Smart meters are an example of new systems added to the grid. While such systems are designed with security in mind (i.e., following international standards using best practices such as encryption of sensitive data, system protection from viruses and malware, access control and tamper alerts on meters, and two-party authorization), systems analysts acknowledge that such connected systems can have new vulnerabilities. Smart meters were singled out as a vulnerability by a report as potentially being susceptible to fraud from "manipulated meter readings, misuse of private customer data and a threat of power outages through a large cyberattack." One particular weakness was said to be the built-in encryption of data sent from smart meters to utilities. The meters are designed to last approximately 20 years, but it was speculated that the device's built-in cryptology system may not be secure for that long a period. However, another source says that smart meter encryption and authentication "should be readily and proactively updatable" and combined with intrusion detection to better protect networks.
section_title: Supply Chains
paragraphs: Supply chains are another potential vulnerability that affects old legacy systems as well as new Smart Grid hardware and software applications. Legacy systems are a particular concern because upgrades and repairs of equipment may not include installation of security upgrades. New procurement guidance for energy delivery systems focus on life cycle considerations by providing "baseline cybersecurity procurement language for use by asset owners, operators, integrators, and suppliers during the procurement process." Security of the supply chain for newer Smart Grid systems is a significant procurement concern because many components are obtained from many sources and vendors internationally. These sources may be considered targets of opportunity to compromise or counterfeit Smart Grid components. 
Supply chain best practices in security and resilience need to be benchmarked and shared with the power sector. These practices need to be explored and explained in dialogues between IT and supply chain professionals, and between utilities and their suppliers.
section_title: The Grid Is Experiencing Cyber Intrusions
paragraphs: The increasing frequency of cyber intrusions on industrial control systems of critical infrastructure is a trend of concern to the electric utility industry. The National Security Agency reported that it has seen intrusions into IC systems by entities with the apparent technical capability "to take down control systems that operate U.S. power grids, water systems and other critical infrastructure." These intrusions, while they have not manifested in cyberattacks capable of inhibiting or disrupting electric system operations, still have reportedly occurred with CIP mandatory standards in place. Some have asserted that consensus-based standards are not strong enough, or are not developed quickly enough, to address cybersecurity needs, while others believe the cost of meeting the standards goes beyond the perceived risks.
The following paragraphs describe several recently reported incidents of cyber intrusions and examples of malware found on IC systems that are commonly used to control energy flows on the electric grid.
subsections: section_title: BlackEnergy
paragraphs: In October 2014, the Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) announced that several industrial control systems had been infected by a variant of a Trojan horse malware program called BlackEnergy. Originally designed for "nuisance spam attacks," the software for BlackEnergy was first reported in 2007 and is designed to target critical energy infrastructure. 
BlackEnergy is a special concern for critical infrastructure companies because the software is being used in an Advanced Persistent Threat (APT) form ostensibly to gather information. 
BlackEnergy specifically targets human machine interface ("HMI") software, which enables users to monitor and interact with industrial control systems such as heating, ventilation, and air conditioning systems through a dashboard or other type of graphical interface. HMI software is typically running 24/7, can be remotely accessed, and is rarely updated, thus making it a favorite target for opportunistic hackers.
While no attempts to "damage, modify, or otherwise disrupt the victim systems' control processes were found," the ICS-CERT alert indicates that this APT variant of BlackEnergy is a special concern because it is a modular malware capable moving through network files onto removable storage media.
[T]ypical malware deployments have included modules that search out any network-connected file shares and removable media for additional lateral movement within the affected environment. The malware is highly modular and not all functionality is deployed to all victims.
Hackers are reported to have used the BlackEnergy Trojan horse to deliver plug-in modules used for several purposes, including keylogging, audio recording, and grabbing screenshots. Researchers looking at the BlackEnergy malware are reported to have identified a plug-in that can destroy hard disks, and believe that the attackers will activate the module once they are discovered in order to hide their presence.
section_title: HAVEX
paragraphs: The HAVEX malware is not new, but it has been modified several times since its first reported deployment. It has targeted the energy sector since "at least August 2012." Originally, HAVEX was distributed via spam email or spear-phishing attacks. This new version of HAVEX appears to have been designed as a Trojan horse specifically to infiltrate and modify "legitimate" software from ICS and SCADA suppliers, adding an instruction to run code (i.e., the " mbcheck.dll " file) containing the HAVEX malware. 
In the instance discovered, HAVEX malware was used as a remote access tool (RAT) to extract data from Outlook address books and ICS-related software files used for remote access from the infected computer to other industrial servers. The cyberattack leaves the company's system in what appears to be a normal operating condition, but the attacker now has a backdoor to access and possibly control the company's ICS or SCADA operations.
The HAVEX malware possibly entered the control systems of targeted companies using one or multiple levels of attack:
1. Email Campaign: Executives and senior employees were targeted with malicious PDF attachments in February-June 2013. 2. Watering Hole Attack: Websites likely to be visited by people working in the energy sector were infected such that they redirected the site visitor to another compromised legitimate website hosting an exploit kit. The exploit kit then installs the RAT. This method of distribution began in June 2013. 3. Software Downloaded from ICS-Related Vendors: At least three ICS vendors' software downloads were hacked so that they included the RAT malware.
HAVEX is also called "Backdoor.Oldrea" (or the "Energetic Bear RAT"), as it contains the malware known as "Kragany" or "Trojan.Kragany." HAVEX is a product of the Dragonfly group (aka Energetic Bear), which appears to be a "state-sponsored" undertaking focused on espionage with sabotage as a "definite secondary capability." The malware allows attackers to upload and download files from the infected computer and run executable files. It was also reported to be capable of collecting passwords, taking screenshots and cataloguing documents. 
section_title: Sandworm
paragraphs: Sandworm is a type of Trojan horse, and it was originally focused on a vulnerability in the Windows operating system (reported as patched by Microsoft in October 2014). It was used to deliver malware through Powerpoint files on thumb drives using automatically run files, but that vector of attack has been largely closed. The primary mode of Sandworm attack was spear-phishing, using grammatically well-written emails with topics of interest to the target. The malware contained an attachment that exploited the vulnerability to deliver variants of the BlackEnergy Trojan. 
The focus of the Sandworm attack discovered was SCADA systems, as the malware targeted specific software used for these systems.
On October 14 th , a report was publicly released regarding the Sandworm team. After beginning an investigation into the affiliated malware samples and domains, we quickly came to realization that this group is very likely targeting SCADA-centric victims who are using GE Intelligent Platform's CIMPLICITY HMI solution suite ... CIMPLICITY is an application suite that is used in conjunction with SCADA systems. A key component of any SCADA system is the HMI. The HMI (which stands for Human-Machine interface) can be viewed as an operator console that is used to monitor and control devices in an industrial environment. 
Sandworm can potentially have greater impacts on an enterprise, as the malware could be transferred to other corporate business systems.
These devices can be responsible for automation control as well as safety operations... It is important to note that we are currently seeing CIMPLICITY being used as an attack vector; however, we have found no indication that this malware is manipulating any actual SCADA systems or data. Since HMIs are located in both the corporate and control networks, this attack could be used to target either network segment, or used to cross from the corporate to the control network.
section_title: Mandatory Bulk Power Cybersecurity Standards
paragraphs: The bulk electric power system has mandatory and enforceable standards for cybersecurity. The Energy Policy Act of 2005 (EPACT) ( P.L. 109-58 ) gave the Federal Energy Regulatory Commission authority over the reliability of the grid, with the power to approve mandatory cybersecurity standards proposed by the Electric Reliability Organization (ERO). Currently, the North American Electric Reliability Corporation (NERC) serves as the ERO. NERC therefore proposes reliability standards for critical infrastructure protection (CIP) which are updated considering the status of reliability and cybersecurity concerns for the grid.
FERC views grid security as a high priority, and separately established the Office of Energy Infrastructure Security (OEIS) to deal with cyber and physical security. OEIS has a mission to provide expertise to the Commission to "identify, communicate and seek comprehensive solutions to potential risks to FERC-jurisdictional facilities from cyberattacks and such physical threats as electromagnetic pulses." However, FERC still asserts that it does not have the authority to act quickly in the event of a major cyber event. 
subsections: section_title: Defining the Extent of FERC's Authority over Cybersecurity
paragraphs: NERC originally determined which electric industry facilities would be subject to mandatory reliability standards based on its definition of the term "bulk electric system" (BES). However, the regional bodies making up NERC had discretion in determining which facilities would be subject to these reliability standards under NERC's guidelines for the definition.
FERC has authority over wholesale power sales and the transmission of electricity in interstate commerce, and it is responsible for the reliability of the bulk electric system. States regulate electric distribution systems. FERC was concerned that certain facilities needed to ensure bulk power system reliability were not being considered under NERC's definition of the bulk electric system. FERC acknowledged that EPACT excluded local distribution systems from its reliability mandate under Section 215 of the Federal Power Act, as not being part of the bulk power system. However, while that definition excluded facilities in Alaska and Hawaii, it also excluded virtually the entire grid in cities with large distribution systems like New York City.
In 2010, FERC directed NERC to develop uniform criteria for determining which facilities were necessary for the operation of the "interconnected transmission network," with the intention of including all such systems under NERC's CIP regulations. FERC approved NERC's revised criteria and new definition of the BES in 2012. These criteria and definitions apply to all NERC regions and are a bright-line threshold including all Transmission Elements operated at 100 kilovolts (kV) or higher, and real power and reactive power resources connected at 100 kV or higher. This definition does not include facilities used in the local distribution of electric energy. 
The revised definition of the BES allowed the potential inclusion of some facilities typically considered as distribution level, if they were seen as necessary for the operation of the interconnected transmission network. However, there are still many areas of potential access to the BES from the distribution system (which are not necessarily important to the operation of the transmission system), and thus beyond NERC's CIP regulations and FERC's reliability mandate. Because there are no mandatory standards of protection for distribution facilities below the bright-line threshold, these potentially "less protected" seams of the BES may provide a backdoor to cyber intrusions to the grid. 
section_title: Toward a Focus on Security and Not Just Compliance
paragraphs: The current iteration of NERC's standards is CIP Version 5, which appears to be moving utility companies toward an active consideration of system security needs rather than just compliance with the standards. It is largely the result of concerns that some owner/operators were not designating their bulk electric power facilities as "critical cyber assets," leaving potential "holes" in bulk electric power system cybersecurity. 
The most notable change is the tiered impact rating system, which classifies bulk electric system (BES) Cyber Systems into High, Medium, and Low categories. This approach results in all cyber assets that could impact BES Facilities being in scope for the CIP standards ... Version 5's tiered classification brings all BES generating facilities into scope for at least some requirements. Cyber assets meeting certain criteria will be grouped into systems and assigned a High, Medium, or Low impact rating based upon the characteristics of the facility they support. For example, BES Cyber Systems at plants larger than 1,500 MW may receive a Medium impact rating, while most black-start units will be Low impact. All such systems, referred to officially as BES Cyber Systems, will be assigned at least a Low impact rating and will be required to comply with at least a portion of the requirements.
CIP Version 5 therefore establishes new criteria and requirements for bulk electric system (BES) Cyber Systems, mandating compliance but requiring owner/operators of bulk electric systems to focus on improving the security of critical assets. BES assets, once categorized as low or high impact, must be protected according to the level of requirements for that impact category. Among other factors, CIP Version 5 now requires encryption of grid command and control signals; "role-based" instead of "risk-based" classifications requiring multiple levels of compliance considering facilities with low, medium or high-level impacts on the BES; monitoring and control of remote access Internet connections (with inclusion of serial connections); multiple-factor authentication (rather than a simple one-step password for access), incident response recovery plans; physical security of BES cyber assets to prevent unauthorized physical entry and access; and cataloging of all software and all security patches on BES devices. , 
Among the concerns raised with the implementation of CIP Version 5 is the potentially high cost. With the new BES designation, all facilities (whether these are low, medium, or high risk) will be covered by some level of the new requirements. Many of these facilities may not have been designated cyber assets before, so the costs of compliance likely will increase. 
section_title: Government and Industry Cooperation on Grid Cybersecurity
paragraphs: Cooperation between the federal government and the electric power sector now extends beyond mandatory and enforceable industry standards for the bulk electric system. However, such cooperation has not always been typical. Companies apparently were not aware of other government efforts. Reports began to emerge in 2010 that the federal government has been developing the capability to detect cyber intrusions on private critical infrastructure company networks. The program dubbed Perfect Citizen reportedly was designed to detect cyber intrusions using sensors in computer networks that would be activated by "unusual activity." 
While a number of voluntary structures now exist for information sharing and cybersecurity strategies, the degree of adoption by electric utilities and the overall effectiveness of these programs is unknown. The FY2016 budget proposes $14 billion in cybersecurity funding for "critical initiatives and research" across the federal government.
Several of the key organizations and their missions with regard to electric power sector cybersecurity are profiled below.
subsections: section_title: Department of Energy
paragraphs: The Department of Energy (DOE) is home to a number of voluntary initiatives and programs for electric sector cybersecurity, with the Office of Electricity Delivery and Energy Reliability (OE) having the lead role. DOE considers the security and resilience of the electric sector to be paramount " ... since it is arguably the most complex and critical infrastructure that other sectors depend upon to deliver essential services." Several of these programs are described below.
subsections: section_title: National Electric Sector Cybersecurity Organization (NESCO)
paragraphs: In 2009, under the FY2010 Energy and Water Appropriations Act ( P.L. 111-85 ), Congress directed DOE to form a national organization which would serve as the National Electric Sector Cybersecurity Organization resource.
[T]he Secretary shall establish an independent national energy sector cyber security organization to institute research, development and deployment priorities, including policies and protocol to ensure the effective deployment of tested and validated technology and software controls to protect the bulk power electric grid and integration of smart grid technology to enhance the security of the electricity grid.
DOE selected two organizations to form the National Electric Sector Cybersecurity Organization (NESCO): EnergySec and the Electric Power Research Institute (EPRI). EnergySec provides support for "information sharing, professional development and collaborative programs and projects that improve the cyber security posture of all participating organizations." EPRI serves as the research and analysis resource for NESCO. NESCO's mission is to improve the "cybersecurity posture of the electric sector by establishing a broad-based public-private partnership for collaboration and cooperation" by providing a forum for cybersecurity experts, developers, and systems users.
section_title: Electricity Subsector Cybersecurity Capability Maturity Model
paragraphs: The Cybersecurity Capability Maturity Model (C2M2) was developed by DOE-OE, the Department of Homeland Security (DHS), and industry as a self-evaluation survey tool for any organization to address cybersecurity vulnerabilities. The C2M2 asks users to assess cybersecurity control implementation across 10 areas of cybersecurity "best practices" based on an evaluation of the maturity of a specific cybersecurity function. The Electricity Subsector Cybersecurity Capability Maturity Model (ES-C2M2) goes one step further, specifically tailoring the core C2M2 survey for the electricity subsector with a "maturity model, an evaluation tool, and DOE facilitated self-evaluations."
Additionally, in 2006, DOE released a report titled Roadmap to Secure Control Systems in the Energy Sector . It outlined a strategic framework to be developed by industry, vendors, academia and government stakeholders to "design, install, operate, and maintain a resilient energy delivery system capable of surviving a cyber-incident while sustaining critical functions." The plan called for a 10-year implementation timeline focusing on barriers and recommended strategies for achieving effective grid cybersecurity. A five-year update released in 2011 highlighted what had been achieved to date, discussing ongoing efforts with respect to short- to long-term goals.
section_title: Department of Homeland Security
paragraphs: DHS has a broad mission to make the United States safe and resilient against terrorism and other potential threats. The cyber and physical security of the grid are encompassed in this mission, and DHS has several initiatives in pursuit of these goals. 
subsections: section_title: National Protection and Programs Directorate
paragraphs: The National Protection and Programs Directorate (NPPD) coordinates national efforts to protect critical infrastructure, working with partners "at all levels of government, and from the private and non-profit sectors" to share information to make critical infrastructure more secure. Under NPPD are several offices focused on cybersecurity, critical infrastructure protection, and resiliency:
The Office of Cyber and Infrastructure Analysis (OCIA) uses information received from public and private sources to conduct consequence modeling, simulation, and analysis to inform cyber and physical security risk management for U.S. critical infrastructure. The Office of Infrastructure Protection (IP) helps critical infrastructure owners and operators to understand and address risks to critical infrastructure. The office provides tools and training to critical infrastructure owners to help them manage risks to their assets, systems, and networks. The Office of Cybersecurity and Communications (CS&C) is responsible for enhancing the security, resilience, and reliability of the nation's cyber and communications infrastructure. A major priority of the office is the reduction of cyber risks to federal and private Internet domains from terrorist attacks, natural disasters, or other emergencies. CS&C is also the home of the National Cybersecurity and Communications Integration Center (NCCIC).
NCCIC is focused on "cyber situational awareness, incident response, and management." NCCIC acts as an information sharing forum for the public and private to improve understanding of cybersecurity and communications vulnerabilities and incidents, and mitigation and recovery from cyber events. NCCIC's mission is to reduce the likelihood and severity of incidents that may "significantly compromise the security and resilience of the Nation's critical information technology and communications networks."
The NCCIC works closely with those federal departments and agencies most responsible for securing the government's cyber and communications systems, and actively engages with private sector companies and institutions, state, local, tribal, and territorial governments, and international counterparts. Each group of stakeholders represents a community of practice, working together to protect the portions of critical information technology that they own, operate, manage, or interact with.
Two critical branches of NCCIC with functions important to electric grid cybersecurity are the United States Computer Emergency Readiness Team (US-CERT) and the Industrial Control Systems Cyber Emergency Response Team (ICS-CERT).
US-CERT brings advanced network and digital media analysis expertise to bear on malicious activity targeting our nation's networks. US-CERT develops timely and actionable information for distribution to federal departments and agencies, state and local governments, private sector organizations, and international partners. In addition, US-CERT operates the National Cybersecurity Protection System (NCPS), which provides intrusion detection and prevention capabilities to covered federal departments and agencies.
ICS-CERT reduces risk to the nation's critical infrastructure by strengthening control systems security through public-private partnerships. ICS-CERT has four focus areas: situational awareness for Critical Infrastructure and Key Resources stakeholders; control systems incident response and technical analysis; control systems vulnerability coordination; and strengthening cybersecurity partnerships with government departments and agencies.
US-CERT developed the Einstein 2 intrusion detection system used by the National Cybersecurity Protection System (NCPS).
NCPS intrusion detection capabilities alert DHS to the presence of malicious or potentially harmful computer network activity transiting to and from participating in federal executive branch civilian agencies' information technology networks. This capability is deployed via EINSTEIN 2 and provides for improved detection and notification capabilities to provide near real time response to cyber threats.
ICS-CERT coordinates responses to control systems-related security incidents and facilitates information sharing among federal, state, and local agencies and organizations; the intelligence community; and private sector constituents, including vendors, owners and operators, and international and private sector CERTs. The focus on control systems cybersecurity provides a direct path for coordination of activities among all members of the critical infrastructure stakeholder community.
section_title: Science and Technology Directorate
paragraphs: The Science and Technology Directorate (S&T) was created to provide science and technology in support of DHS's mission. Since DHS assists in efforts for the security and resiliency of the grid, the Smart Grid with characteristics of self-healing from power disturbance events, and operating resiliently against physical and cyber threats is of particular interest. 
S&T also has a Cyber Security Division whose mission is to enhance the security and resilience of the nation's critical information infrastructure and the Internet by 
1. developing and delivering new technologies, tools and techniques to enable the United States to defend, mitigate and secure current and future systems, networks and infrastructure against cyberattacks; 2. conducting and supporting technology transition; and 3. leading and coordinating cybersecurity research and development for department customers, and with government agencies, the private sector and international partners.
Since recovery from cyberattacks is seen as a part of S&T's resiliency focus, S&T is working on several electric power sector specific initiatives. These include the Resilient Electric Grid (an effort to "keep the lights on" in the event of a power outage by enabling distribution level power substations to share power with one another), and the Recovery Transformer (a program developing a prototype large power transformer to enable a quicker recovery [i.e., within days instead of months or years] from an event which might damage key transformers). S&T is currently managing an effort to assess the state of the Smart Grid concept, as well as specific technologies needed to achieve goals of ensuring Smart Grid security and resiliency.
section_title: National Institute of Standards and Technology
paragraphs: The Energy Independence and Security Act of 2007 (EISA) ( P.L. 110-140 ) defined attributes of a Smart Grid and plans for its development. EISA also gave the National Institute of Standards and Technology (NIST) the role of coordinating the development of a framework to enable the development of the Smart Grid in a safe and secure manner. Because cybersecurity threats were perceived as "diverse and evolving," NIST advocated a defense-in-depth strategy with multiple levels of security and asserted no single security measure could counter all types of threats. The key to NIST's suggested approach is the determination of risk (i.e., the potential for an unwanted outcome resulting from internal or external factors, as determined from the likelihood of occurrence and the associated consequences) as quantified by the threat (e.g., event, actor or action with potential to do harm), the vulnerability (e.g., weakness in the system), and the consequences (e.g., physical impacts) to the system.
NIST published its Guidelines for Smart Grid Cybersecurity as a comprehensive, voluntary framework for organizations to use in developing effective cybersecurity strategies "tailored to their particular combinations of Smart Grid-related characteristics, risks, and vulnerabilities." 
According to NIST, deliberate attacks are not the only threat to Smart Grid cybersecurity. 
Smart grid cybersecurity must address not only deliberate attacks, such as from disgruntled employees, industrial espionage, and terrorists, but also inadvertent compromises of the information infrastructure due to user errors, equipment failures, and natural disasters. The Smart Grid Interoperability Panel (SGIP) Cybersecurity Committee (SGCC) ... is moving forward in FY14 to address the critical cybersecurity needs in the areas of Advanced Metering Infrastructure security requirements, cloud computing, supply chain, and privacy recommendations related to emerging standards. This project will provide foundational cybersecurity guidance, cybersecurity reviews of standards and requirements, outreach, and foster collaborations in the cross-cutting issue of cybersecurity in the smart grid.
NIST established the Smart Grid Interoperability guidelines with a primary goal of developing a cybersecurity risk management strategy to enable secure "interoperability" of technologies across different Smart Grid domains and components.
NIST was asked in 2013 by Presidential Executive Order No. 13636, "Improving Critical Infrastructure Cybersecurity," to lead the development of a "Cybersecurity Framework" to reduce cyber risks. The framework was based on industry methodologies, procedures, and processes that align policy, business, and technological approaches to address cyber risks, incorporating "voluntary consensus standards and industry best practices to the fullest extent possible." The first version of the Framework was released on February 12, 2014. Sector-specific federal agencies (such as DOE) are to report annually to the President on the extent to which owners and operators of critical infrastructure at greatest risk are participating in the program.
NIST also hosts the National Cybersecurity Center of Excellence, which is focused on getting better adoption of secure, commercially available cybersecurity technologies by both the public and private sectors.
section_title: North American Electric Reliability Corporation (NERC)
paragraphs: NERC's Critical Infrastructure Protection Committee (CIPC) is responsible for its physical security and cybersecurity initiatives. CIPC consists of both NERC-appointed regional representatives and technical subject matter experts, and serves as an expert advisory panel to the NERC Board of Trustees. It has standing subcommittees in the areas of physical security and cybersecurity. The CIPC also oversees the Electricity Sector Information Sharing and Analysis Center (ES-ISAC).
subsections: section_title: Electricity Sector Information Sharing and Analysis Center (ES-ISAC)
paragraphs: ES-ISAC seeks to establish situational awareness, incident management, coordination and communication capabilities within the electricity sector through timely information sharing. The ES-ISAC works with DOE and the Electricity Sector Coordinating Council (ESCC) to share critical information with the electricity sector, enhancing its ability to "prepare for and respond to cyber and physical threats, vulnerabilities and incidents."
The Electricity Sector Information Sharing and Analysis Center ... which was established in 1998 under Presidential Decision Directive 63 (President Bill Clinton), called for the establishment of an ISAC for each of the eight infrastructure industries deemed critical to our national economy and public well-being.
NERC members who are "registered entities" can report information regarding cyber incidents to ES-ISAC via a secure Internet exchange, and also receive information on threats. 
section_title: Electricity Sub-Sector Coordinating Council (ESCC)
paragraphs: The Electricity Sub-Sector Coordinating Council is the principal liaison between the federal government and the electric power sector. It represents the electricity sub-sector (as part of the Energy Critical Infrastructure sector) under DHS's National Infrastructure Protection Plan (NIPP). The ESCC draws its membership from all segments of the electric utility industry, and is led by three chief executive officers—one each from the American Public Power Association, the Edison Electric Institute, and the National Rural Electric Cooperative Association. Among its activities, the ESCC coordinates industry and government efforts on grid security, guides infrastructure investments and R&D for critical infrastructure protection, seeks to improve threat information sharing and processes with public and private sector stakeholders, and coordinates cross sector activities with other critical infrastructure sectors. A Senior Executive Working Group (SEWG) supports the mission and activities of the ESCC, creating ad hoc "sub teams" to address goals identified by utility and government executives.
section_title: Edison Electric Institute
paragraphs: The Edison Electric Institute (EEI) as the trade association for investor-owned electric utilities has been involved with the formation of industry partnerships on cybersecurity issues with a number of federal agencies. Information sharing between public and private entities is an issue the industry considers critical in protecting the grid against cyber-threats. The industry is involved in several information sharing efforts including the ES-ISAC, ESSC, and NCCIC.
section_title: Evaluating and Improving Electricity Subsector Cybersecurity
paragraphs: As noted above, the bulk electric system has mandatory standards for critical infrastructure cybersecurity that NERC proposes, and FERC approves (or may modify and remand back to NERC). Industry compliance with these standards may be enough to prevent fines, but the question is whether existing mandatory standards result in a cybersecure grid. The grid has reportedly experienced intrusions to SCADA systems, which could possibly compromise systems operations. While the exact details and location have not been revealed, the cyberattacks demonstrate potential threats to grid reliability. Although some may believe the risks of a major cyberattack on the grid are small, FERC is obligated to consider CIP and cybersecurity as part of its reliability mandate. This section will summarize current concepts for evaluating and improving electricity subsector cybersecurity. 
subsections: section_title: NESCO Cybersecurity Failure Scenarios
paragraphs: In 2013, NESCO released the results of an analysis intended to help electric utilities plan for cybersecurity risks. The "Electric Sector Failure Scenarios and Impact Analyses" report focuses on specific events in which the "failure to maintain confidentiality, integrity, and/or availability of sector cyber assets creates a negative impact on the generation, transmission, and/or distribution of power." The report organizes the failure scenarios according to six categories, corresponding to the domains identified by the National Institute of Standards and Technology.
1. Advanced Metering Infrastructure (AMI) 2. Distributed Energy Resources (DER) 3. Wide Area Monitoring, Protection, and Control (WAMPAC) 4. Electric Transportation (ET) 5. Demand Response (DR) 6. Distribution Grid Management (DGM)
A seventh, generic cross-cutting scenario was also identified which could impact any of these categories. The failure scenarios are "high-level" examples, so as not to present a cyberattacker with ideas on how to carry out an attack. The focus is on cybersecurity events, not other events which could potentially cause similar issues. Mitigations and options are suggested for the various scenarios, with a scheme for prioritization of solutions for securing control systems. The report was designed to "support risk assessment, policies, planning, procedures, procurement, training, tabletop exercises and security testing." 
 Figure 4 lists what NESCO considered as some of the top potential failure scenarios. NESCO teams ranked the scenarios, with the darker bands indicating the potential higher risk failures. A relatively large number of potential failures came from the WAMPAC domain, a significant number from AMI, and a moderate number came from the DGM domain. Few were selected from DER or DR, and none were selected from the ET domain. 
In the report, each failure scenario is accompanied by a descriptive example of an action causing the breach, the relevant vulnerabilities and impacts. A possible mitigation of the AMI.24 scenario above is shown in the example of Figure 5 . 
subsections: section_title: Integrating Electric Subsector Failure Assessments into a Risk Assessment Methodology
paragraphs: Using the potential cybersecurity failure scenarios put forward by NESCO, DOE and EPRI issued a voluntary risk assessment process for utilities to consider in developing and implementing a plan to manage risks from the six failure scenarios developed by NESCO. Utility strategies for framing, assessing, responding to, and monitoring risk on a continual basis are at the center of the process. NESCO's risk assessment approach is based on DOE's ES-C2M2 model, and risk management is focused on DOE's systems security approach specific to risks from operating IT and IC systems.
section_title: Potential Mitigation of Cyber Threats
paragraphs: The electric power industry is mostly in a defensive mode regarding cybersecurity threats. One potential area of increasing importance is intrusion detection, since some reports state that cyber attackers may be on an enterprise's system for years before they are detected. 
Much of what is emerging from the collaborative efforts of government, industry and academia appears to be focused on changing the way the electric sector views and operates as an enterprise. Protection of the sector from deliberate disruption was not necessarily a high priority for most utilities, especially before Internet connectivity became common. Cyber and physical security are essential if the enterprise is to fulfil its function, and protection of critical infrastructure of the bulk electric system is a mandatory part of utility system operations.
Because many cybersecurity actions are reactive to the last threat discovered, some experts say that mitigation of cyber threats requires a focus on attackers, not the attacks. Therefore, they suggest that higher-level cybersecurity postures are thus said to require looking beyond whether "something bad" is happening, and shifting to understanding who authored the malicious software and why. Finding an answer to these issues means understanding the reason for the attack, and then the appropriate resources can be gathered in building an effective defense. The Financial Services Information Sharing and Analysis Center (FS-ISAC) reportedly uses a team of threat analysts who base cyberattack defenses on safeguarding what they think the attackers are after. FS-ISAC operates "a centralized threat repository and an automated network for rapid distribution of threat information from government and industry sources." The ES-ISAC performs a similar function to the FS-ISAC for the electricity subsector, but is said not to match FS-ISAC in technical capabilities yet. 
The automated, machine-to-machine information exchange that currently exists at FS-ISAC enables a faster, finer-grained identification and analysis of suspected Internet addresses, malicious software code and other threat indicators than the ES-ISAC currently can achieve. That gives FS-ISAC the potential for advanced search and analysis capabilities, including greater insights into identities and methods of various actors. In other words, FS-ISAC has a great capability to "connect the dots" that reveal critical information about an attack and its authors, according to participants in the programs
...Adoption of faster, more automated threat processing technologies by the electric power sector's vendors may be the best hope of improving cybersecurity defenses among the hundreds of smaller utilities that can't afford in-house cyberdefense expertise.
NCCIC expects to have such "machine-to-machine sharing of online threat data" capabilities available soon. 
subsections: section_title: Resilience and Recovery
paragraphs: Renewable electricity in distributed generation installations and microgrids have the potential to resist disruptions to the grid, whether from natural occurrences or cyberattacks, by continuing to generate power if the grid is brought down. Microgrids can be a partial solution to larger scale resilience as they are sized to meet the power needs of a local community or institution, and they may also be useful in a major cyber event as a staging point for power outage and recovery workers. But they are also another potential point of access to the grid by a cyberattacker.
The Department of Defense looked at how distributed generation can harden its capabilities to maintain its mission and functions in the case of a major cybersecurity event affecting the Grid. A project called the Smart Power Infrastructure Demonstration for Energy Reliability and Security (SPIDERS) program was undertaken to help secure military installations if grid power supplies are disrupted. One of the goals of the SPIDERS project was to transition military bases from reliance on diesel generators for back-up purposes to other on-site renewable electricity technologies and hydrogen fuel cells. Thus, military facilities could function in the event of a major cyber event and serve as centers for recovery efforts.
section_title: Using Distributed Computing for Grid Security
paragraphs: In 2013, NIST initiated the SmartAmerica Challenge to address grid vulnerabilities with a focus on using novel approaches. Since the grid relies on control centers to manage power flows in each area of operation, if that control center's operations are disrupted, reductions in service quality or power outages may occur. One SmartAmerica effort is looking at how a distributed computing approach could make the grid more resilient against both physical and cyberattacks. 
Because having a single control center for each section of the grid creates a significant vulnerability threat, the NC State and UNC group within the Smart Energy [Cyber-Physical Systems] team is pursuing the idea of creating a distributed computing system that would disseminate monitoring and control functions across multiple virtual machines in a cloud computing network that overlays the grid.
According to a researcher leading the effort, the advantage of using distributed computing methods is "that if one element of the computing system gets compromised, the other virtual machines could step in to protect the system and coordinate their efforts to keep the Grid functioning."
Preparation for recovery from a potential cyberattack requires consideration of the resiliency of the system. Cyber resiliency can be defined as "the coordinated set of enterprise wide activities designed to help organizations respond to and recover from a variety of cyber incidents, while reducing the cost, impact to business operations, and brand damage." But for electric utilities, the overall goal is system reliability, and the expenditures that may be required to ensure that the grid is functional are just beginning to be understood.
Responsible entities must protect High- and Medium-Impact BES Cyber Assets and BES Cyber Systems under the access restriction provisions of the CIP rules. In some cases, this may require significant investment, such as creating secure enclosures that meet access restriction requirements. Even where capital investment is not required, resources will be needed to implement and validate protective measures as well as to manage and monitor access and, in some cases, configuration.
section_title: Cybersecurity-Related Concerns of Electric Utilities
paragraphs: While mandatory and enforceable reliability standards exist for BES critical infrastructure protection, electric utilities are concerned about the potential for a major cybersecurity event to result in liability concerns that could have financial ramifications.
subsections: section_title: Liability from a Potential Major Cyber Event
paragraphs: As businesses involved in a commercial enterprise, utilities are aware that they may be vulnerable from a liability standpoint. While adherence to mandatory standards provides a measure for a "standard of care," it may not be enough to protect companies from legal actions. The American Public Power Association (APPA) summarized the issue as follows:
APPA is concerned that electric utilities may not be sufficiently protected from liability for negligence claims in failing to protect against such attacks even when they have taken every known precaution. Some states are considering legislation that could protect utilities from liability for cyber attacks, but no state or federal statutes currently exist to insulate electric utilities, including public power entities, from legal action in response to a cyber incident.... This and previous Congresses have considered legislation focusing on cybersecurity proposals which have included provisions that would grant liability protections to critical infrastructure owners and operators affected by cyber incident, but no such protections have been enacted into law.
EEI also voiced its concern over liability protection, and additionally considered the potential for unexpected costs for utilities arising from a potential major cyber event.
Costs associated with emergency mitigation are, by definition, unexpected and thus not included in a utility's rate base. To ensure emergency actions do not put undue financial strain on electric utilities, the industry supports mechanisms for recovering costs. In addition, electric utilities support liability protections for actions taken under an emergency order.
Various federal, state and other jurisdictions may allow utility companies to recover costs of cyber and physical security investments. And, in the event of a major cyber or physical security attack, electric utilities also may seek recovery of these costs from their customers in a public utility commission rates filing. 
section_title: Cybersecurity Insurance
paragraphs: According to DHS, cybersecurity insurance is generally designed to mitigate losses from a variety of cyber incidents, including data breaches, business interruption, and network damage. DHS believes "a robust cybersecurity insurance market could help reduce the number of successful cyberattacks by: (1) promoting the adoption of preventative measures in return for more coverage; and (2) encouraging the implementation of best practices by basing premiums on an insured's level of self-protection." DHS goes on to state that many companies (including electric utilities) choose not to carry insurance policies, citing the perceived high cost of those policies and confusion about what they cover. 
In recent years, the Department of Homeland Security's (DHS) National Protection and Programs Directorate (NPPD) has brought together a diverse group of private and public sector stakeholders—including insurance carriers, risk managers, IT/cyber experts, critical infrastructure owners, and social scientists—to examine the current state of the cybersecurity insurance market and how to best advance its capacity to incentivize better cyber risk management.... An October 2012 workshop focused on the challenges facing the "first-party" market which covers direct losses to companies arising from cyber-related incidents—including cyber-related critical infrastructure loss.... Based on what it had learned, NPPD hosted an insurance industry working session in April 2014 to assess three areas where it appeared progress could lead to a more robust first-party market: the creation of an anonymized cyber incident data repository; enhanced cyber incident consequence analytics; and enterprise risk management evangelization.
Some electric utilities companies view the likelihood of a major cyberattack as a potentially low risk event. However, in the opinion of one insurance industry broker, "[a] major energy catastrophe—on the same scale as ... Exxon Valdez or Deepwater Horizon—could be caused by a cyberattack, and, crucially, that cover for such a loss is generally not currently provided by the energy insurance market." 
Most insurance products available to utilities reportedly cover "relatively minor" occurrences such as data losses, or downtime caused by IT issues "but not major events like explosions at multiple facilities triggered remotely by hackers." The lack of coverage is said to arise from a clause in the insurance agreements of a number of energy sector companies which specifically exclude damage caused by software, viruses or malicious computer code. The lack of coverage will likely continue as long as the exclusionary clause is in effect. However, the clause is reported to remain because cybersecurity "is not well-understood by the insurance industry, making it difficult to design comprehensive products." Moreover, appraisers from the large insurance provider Lloyds of London are also reported to have found cybersecurity protection measures as "too weak" for a policy to be offered to power companies.
section_title: Issues
paragraphs: The electric utility industry is composed of many different companies of various sizes and various ownership and financial structures. Many utilities seem at present to view the potential for a major cybersecurity event as a low probability concern and to want to balance cybersecurity efforts and expenditures with the perceived risks. NERC's CIP Version 5 seeks to address that thinking by shifting the focus of utilities to provide the necessary levels of security for BES assets with low, medium, or high system impacts. However, many other joint federal and industry cybersecurity activities are cooperative, with voluntary adoption of the measures and metrics developed. The effectiveness of strategies developed and the levels of adoption of recommendations may require congressional evaluation.
Even with mandatory standards, the six failure scenario domains identified by NESCO illustrate the continuing potential vulnerability of the grid to cyber and physical attacks, or a combination of both. While improved cyber intrusion detection measures are a high priority, these are more likely to come from government-industry partnerships than from the utility industry's efforts alone. However, the advice of several initiatives and observers is essentially for electric utilities to embrace cybersecurity as part of their strategic business planning and operations. Cyber intrusions of the grid are believed to be happening, which may be seen as an indication that that more needs to be done by electric utilities to make the system secure. Whether electric utilities can make the investment financially (and recruit staff) for such a mission is also an issue. 
The threats facing the grid are evolving, and with each new intrusion or cyberattack, priorities to protect the system can shift. But that does not mean previous attacks can be considered past issues. SCADA and other control systems infected by worms such as HAVEX are also vulnerable to other actors who may take advantage of such incursions, using or modifying them for their own purposes. This can be a particular concern if, for example, a worm originated from a nation-state. The threat of retaliation would likely be a deterrent from its use by a nation-state, but a terrorist or similar organization would likely be undeterred by such a consequence, and may use the worm for its own purposes. Given the potential for damage to the nation's economy from a major cyberattack on the grid, some might suggest a greater focus on recovery is needed and should become as much a part of a cybersecurity strategy as are efforts to secure the system. 
The bulk electric system is subject to mandatory and enforceable critical infrastructure protection rules for cyber and physical security under the FERC's reliability mandate. However, the energy sector is only one of 16 critical infrastructure sectors identified by DHS. Given that the grid relies on several of the others (for example, for water and fuel transportation), the question of whether these other sectors should also have similar, mandatory standards focused on support of the electric power sector may be an issue for Congress to consider. 
Additionally, FERC still asserts that it does not have the ability to react to a "fast moving or imminent" cyberattack. Congress may want to consider whether FERC should have more authority to deal with cybersecurity threats in real time.
Congress enacted provisions in EPACT giving the Federal Energy Regulatory Commission responsibility for the reliability of the grid. EPACT specifically restricted FERC from exercising its reliability authority over distribution systems. Even with the recent redefinition of the BES, there are many points to access the grid beyond those covered by CIP standards from which a potential cyberattack could be launched. Congress may want to consider whether further protection of the grid is necessary, especially along the seams between the newly revised BES and distribution systems beyond FERC's reliability authority. Such actions may include standards (voluntary or mandatory) or defined best practices for facilities connecting to the grid at, for example, a specified voltage level below the bright-line threshold of 120 kV. 
Congress may want to consider ways to help companies deal with the costs of critical infrastructure protection. All BES designated facilities (whether these are low, medium or high risk) under CIP Version 5 will be covered by some level of the new requirements. Since the regulatory jurisdictions and financial structures of companies in the electric power industry can differ considerably, Congress may want to look at ways to lessen possible financial strains on electric utility systems with legitimate cost-compliance burden concerns.
Congress may also want to consider liability protection for electric utilities in the event of a major cyberattack. The coverage extended by insurance company products currently available may not extend to damage caused by a cyberattack. 
section_title: Selected Pending Legislation154
paragraphs: The following bills are related to cybersecurity issues presented in this report. While not specific to electric utilities, they address information sharing generally between federal and private sector companies. Electric utility companies would argue that the protections and two-way information sharing of the types proposed by these bills would likely promote disclosure of cyber incidents, thus potentially improving cybersecurity for all participants.
H.R. 1731 among other actions would amend the Homeland Security Act of 2002 ( P.L. 107-296 ) to enhance multidirectional sharing of information related to cybersecurity risks and strengthen privacy and civil liberties protections. The bill would allow for sharing of cyber threat indicators and other information related to cybersecurity risks and incidents with federal and nonfederal entities, including across sectors of critical infrastructure. The National Cybersecurity and Communications Integration Center (NCCIC) may enter into a voluntary information-sharing relationship with any consenting nonfederal entity for the purpose of sharing of cyber threat indicators and defensive measures. A nonfederal entity, not including a state, local, or tribal government that shares cyber threat indicators or defensive measures through the NCCIC, shall be deemed to have voluntarily shared such information.
H.R. 234 among other actions would direct the federal government to provide for the real-time sharing of actionable, situational cyber threat information between all designated federal cyber operations centers to enable integrated actions to protect, prevent, mitigate, respond to, and recover from cyber incidents. The bill also would allow the federal intelligence community to share cyber threat intelligence with private-sector entities and utilities possessing appropriate certifications or security clearances.
H.R. 85 among other actions would direct DHS to (1) work with critical infrastructure owners and operators and other state and local authorities to take proactive steps to manage risk and strengthen the security and resilience of the nation's critical infrastructure against terrorist attacks; (2) establish terrorism prevention policy to engage with international partners to strengthen the security and resilience of domestic critical infrastructure and critical infrastructure located outside of the United States; (3) establish a task force to conduct research into the best means to address the security and resilience of critical infrastructure in an integrated, holistic manner to reflect critical infrastructure's interconnectedness and interdependency; (4) establish the Strategic Research Imperatives Program to lead DHS's federal civilian agency approach to strengthen critical infrastructure security and resilience; and (5) make available research findings and guidance to federal civilian agencies for the identification, prioritization, assessment, remediation, and security of their internal critical infrastructure to assist in the prevention, mediation, and recovery from terrorism events. The bill also directs DHS to facilitate the timely exchange of terrorism threat and vulnerability information as well as information that allows for the development of a situational awareness capability for federal civilian agencies during terrorist incidents.
S. 456 among other actions would permit private entities to (1) disclose lawfully obtained cyber threat indicators to a private information sharing and analysis organization and the NCCIC; and (2) receive indicators disclosed by private entities, the federal government, or state or local governments. Liability protection would be given to entities that voluntarily share lawfully obtained indicators with NCCIC or a private information sharing and analysis organization if the organization self-certifies that it has adopted the best practices identified by the DHS-selected private entity.