Cybersecurity: Challenges in Securing the Electricity Grid
Released: 2012-07-17T00:00:00


Highlights: section_title: Why GAO Did This Study
paragraphs: The electric power industry is increasingly incorporating information technology (IT) systems and networks into its existing infrastructure (e.g., electricity networks, including power lines and customer meters). This use of IT can provide many benefits, such as greater efficiency and lower costs to consumers. However, this increased reliance on IT systems and networks also exposes the grid to cybersecurity vulnerabilities, which can be exploited by attackers. Moreover, GAO has identified protecting systems supporting our nation’s critical infrastructure (which includes the electricity grid) as a governmentwide high-risk area.

GAO was asked to testify on the status of actions to protect the electricity grid from cyber attacks. Accordingly, this statement discusses (1) cyber threats facing cyber-reliant critical infrastructures, which include the electricity grid, and (2) actions taken and challenges remaining to secure the grid against cyber attacks. In preparing this statement, GAO relied on previously published work in this area and reviewed reports from other federal agencies, media reports, and other publicly available sources.

section_title: What GAO Found
paragraphs: The threats to systems supporting critical infrastructures are evolving and growing. In testimony, the Director of National Intelligence noted a dramatic increase in cyber activity targeting U.S. computers and systems, including a more than tripling of the volume of malicious software. Varying types of threats from numerous sources can adversely affect computers, software, networks, organizations, entire industries, and the Internet itself. These include both unintentional and intentional threats, and may come in the form of targeted or untargeted attacks from criminal groups, hackers, disgruntled employees, nations, or terrorists. The interconnectivity between information systems, the Internet, and other infrastructures can amplify the impact of these threats, potentially affecting the operations of critical infrastructures, the security of sensitive information, and the flow of commerce. Moreover, the electricity grid’s reliance on IT systems and networks exposes it to potential and known cybersecurity vulnerabilities, which could be exploited by attackers. The potential impact of such attacks has been illustrated by a number of recently reported incidents and can include fraudulent activities, damage to electricity control systems, power outages, and failures in safety equipment.

To address such concerns, multiple entities have taken steps to help secure the electricity grid, including the North American Electric Reliability Corporation, the National Institute of Standards and Technology (NIST), the Federal Energy Regulatory Commission, and the Departments of Homeland Security and Energy. These include, in particular, establishing mandatory and voluntary cybersecurity standards and guidance for use by entities in the electricity industry. For example, the North American Electric Reliability Corporation and the Federal Energy Regulatory Commission, which have responsibility for regulation and oversight of part of the industry, have developed and approved mandatory cybersecurity standards and additional guidance. In addition, NIST has identified cybersecurity standards that support smart grid interoperability and has issued a cybersecurity guideline. The Departments of Homeland Security and Energy have also played roles in disseminating guidance on security practices and providing other assistance.

As GAO previously reported, there were a number of ongoing challenges to securing electricity systems and networks. These include:

A lack of a coordinated approach to monitor industry compliance with voluntary standards.

Aspects of the current regulatory environment made it difficult to ensure the cybersecurity of smart grid systems.

A focus by utilities on regulatory compliance instead of comprehensive security.

A lack of security features consistently built into smart grid systems.

The electricity industry did not have an effective mechanism for sharing information on cybersecurity and other issues.

The electricity industry did not have metrics for evaluating cybersecurity.

section_title: What GAO Recommends
paragraphs: In a prior report, GAO has made recommendations related to electricity grid modernization efforts, including developing an approach to monitor compliance with voluntary standards. These recommendations have not yet been implemented.

section_title: Letter
paragraphs: Thank you for the opportunity to testify at today’s hearing on the status of  actions to protect the electricity grid from cyber attacks.

As you know, the electric power industry is increasingly incorporating  information technology (IT) systems and networks into its existing  infrastructure (e.g., electricity networks including power lines and  customer meters). This use of IT can provide many benefits, such as  greater efficiency and lower costs to consumers. Along with these  anticipated benefits, however, cybersecurity and industry experts have  expressed concern that, if not implemented securely, modernized  electricity grid systems will be vulnerable to attacks that could result in  widespread loss of electrical services essential to maintaining our national  economy and security.

In addition, since 2003 we have identified protecting systems supporting  our nation’s critical infrastructure (which includes the electricity grid) as a  governmentwide high-risk area, and we continue to do so in the most  recent update to our high-risk list.

In my testimony today, I will describe (1) cyber threats facing cyber-reliant  critical infrastructures, which include the electricity grid, and (2) actions  taken and challenges remaining to secure the grid against cyber attacks.  In preparing this statement in July 2012, we relied on our previous work in  this area, including studies examining efforts to secure the electricity grid  and associated challenges and cybersecurity guidance. (Please see the  related GAO products in appendix I.) The products upon which this  statement is based contain detailed overviews of the scope of our reviews  and the methodology we used. We also reviewed documents from the  Federal Energy Regulatory Commission, the North American Electric  Reliability Corporation, the Department of Energy, including its Office of  the Inspector General, and the Department of Homeland Security  Industrial Control Systems Cyber Emergency Response Team, as well as  publicly available reports on cyber incidents. The work on which this  statement is based was performed in accordance with generally accepted  government auditing standards. Those standards require that we plan  and perform audits to obtain sufficient, appropriate evidence to provide a  reasonable basis for our findings and conclusions. We believe that the  evidence obtained provided a reasonable basis for our findings and  conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: The electricity industry, as shown in figure 1, is composed of four distinct  functions: generation, transmission, distribution, and system operations.  Once electricity is generated—whether by burning fossil fuels; through  nuclear fission; or by harnessing wind, solar, geothermal, or hydro  energy—it is generally sent through high-voltage, high-capacity  transmission lines to local electricity distributors. Once there, electricity is  transformed into a lower voltage and sent through local distribution lines  for consumption by industrial plants, businesses, and residential  consumers. Because electric energy is generated and consumed almost  instantaneously, the operation of an electric power system requires that a  system operator constantly balance the generation and consumption of  power.

Utilities own and operate electricity assets, which may include generation  plants, transmission lines, distribution lines, and substations—structures  often seen in residential and commercial areas that contain technical  equipment such as switches and transformers to ensure smooth, safe  flow of current and regulate voltage. Utilities may be owned by investors,  municipalities, and individuals (as in cooperative utilities). System  operators—sometimes affiliated with a particular utility or sometimes  independent and responsible for multiple utility areas—manage the  electricity flows. These system operators manage and control the  generation, transmission, and distribution of electric power using control  systems—IT- and network-based systems that monitor and control  sensitive processes and physical functions, including opening and closing  circuit breakers. As we have previously reported, the effective  functioning of the electricity industry is highly dependent on these control  systems. However, for many years, aspects of the electricity network  lacked (1) adequate technologies—such as sensors—to allow system  operators to monitor how much electricity was flowing on distribution  lines, (2) communications networks to further integrate parts of the  electricity grid with control centers, and (3) computerized control devices  to automate system management and recovery.
subsections: section_title: Modernization of the Electricity Infrastructure
paragraphs: As the electricity industry has matured and technology has advanced,  utilities have begun taking steps to update the electricity grid—the  transmission and distribution systems—by integrating new technologies  and additional IT systems and networks. Though utilities have regularly  taken such steps in the past, industry and government stakeholders have  begun to articulate a broader, more integrated vision for transforming the  electricity grid into one that is more reliable and efficient; facilitates  alternative forms of generation, including renewable energy; and gives  consumers real-time information about fluctuating energy costs.

This vision—the smart grid—would increase the use of IT systems and  networks and two-way communication to automate actions that system  operators formerly had to make manually. Electricity grid modernization is  an ongoing process, and initiatives have commonly involved installing  advanced metering infrastructure (smart meters) on homes and  commercial buildings that enable two-way communication between the  utility and customer. Other initiatives include adding “smart” components  to provide the system operator with more detailed data on the conditions  of the transmission and distribution systems and better tools to observe  the overall condition of the grid (referred to as “wide-area situational  awareness”). These include advanced, smart switches on the distribution  system that communicate with each other to reroute electricity around a  troubled line and high-resolution, time-synchronized monitors—called  phasor measurement units—on the transmission system.

The use of smart grid systems may have a number of benefits, including  improved reliability from fewer and shorter outages, downward pressure  on electricity rates resulting from the ability to shift peak demand, an  improved ability to shift to alternative sources of energy, and an improved  ability to detect and respond to potential attacks on the grid.

section_title: Regulation of the Electricity Industry
paragraphs: Both the federal government and state governments have authority for  overseeing the electricity industry. For example, the Federal Energy  Regulatory Commission (FERC) regulates rates for wholesale electricity  sales and transmission of electricity in interstate commerce. This includes  approving whether to allow utilities to recover the costs of investments  they make to the transmission system, such as smart grid investments.  Meanwhile, local distribution and retail sales of electricity are generally  subject to regulation by state public utility commissions.

State and federal authorities also play key roles in overseeing the  reliability of the electric grid. State regulators generally have authority to  oversee the reliability of the local distribution system. The North American  Electric Reliability Corporation (NERC) is the federally designated U.S.  Electric Reliability Organization, and is overseen by FERC. NERC has  responsibility for conducting reliability assessments and developing and  enforcing mandatory standards to ensure the reliability of the bulk power  system—i.e., facilities and control systems necessary for operating the  transmission network and certain generation facilities needed for  reliability. NERC develops reliability standards collaboratively through a  deliberative process involving utilities and others in the industry, which  are then sent to FERC for approval. These standards include critical  infrastructure protection standards for protecting electric utility-critical and  cyber-critical assets. FERC has responsibility for reviewing and approving  the reliability standards or directing NERC to modify them.

In addition, the Energy Independence and Security Act of 2007established federal policy to support the modernization of the electricity  grid and required actions by a number of federal agencies, including the  National Institute of Standards and Technology (NIST), FERC, and the  Department of Energy. With regard to cybersecurity, the act required  NIST and FERC to take the following actions:

NIST was to coordinate development of a framework that includes  protocols and model standards for information management to  achieve interoperability of smart grid devices and systems. As part of  its efforts to accomplish this, NIST planned to identify cybersecurity  standards for these systems and also identified the need to develop  guidelines for organizations such as electric companies on how to  securely implement smart grid systems. In January 2011, we  reported that NIST had identified 11 standards involving cybersecurity  that support smart grid interoperability and had issued a first version  of a cybersecurity guideline.

FERC was to adopt standards resulting from NIST’s efforts that it  deemed necessary to ensure smart grid functionality and  interoperability. However, according to FERC officials, the statute did  not provide specific additional authority to allow FERC to require  utilities or manufacturers of smart grid technologies to follow these  standards. As a result, any standards identified and developed  through the NIST-led process are voluntary unless regulators use  other authorities to indirectly compel utilities and manufacturers to  follow them.

section_title: The Electricity Grid Is Potentially Vulnerable to an Evolving Array of Cyber-Based Threats
paragraphs: Threats to systems supporting critical infrastructure—which includes the  electricity industry and its transmission and distribution systems—are  evolving and growing. In February 2011, the Director of National  Intelligence testified that, in the past year, there had been a dramatic  increase in malicious cyber activity targeting U.S. computers and  networks, including a more than tripling of the volume of malicious  software since 2009. Different types of cyber threats from numerous  sources may adversely affect computers, software, networks,  organizations, entire industries, or the Internet. Cyber threats can be  unintentional or intentional. Unintentional threats can be caused by  software upgrades or maintenance procedures that inadvertently disrupt  systems. Intentional threats include both targeted and untargeted attacks  from a variety of sources, including criminal groups, hackers, disgruntled  employees, foreign nations engaged in espionage and information  warfare, and terrorists. Table 1 shows common sources of cyber threats.

These sources of cyber threats make use of various techniques, or  exploits that may adversely affect computers, software, a network, an  organization’s operation, an industry, or the Internet itself. Table 2 shows  common types of cyber exploits.

The potential impact of these threats is amplified by the connectivity  between information systems, the Internet, and other infrastructures,  creating opportunities for attackers to disrupt critical services, including  electrical power. In addition, the increased reliance on IT systems and  networks also exposes the electric grid to potential and known  cybersecurity vulnerabilities. These vulnerabilities include an increased number of entry points and paths that can be exploited  by potential adversaries and other unauthorized users;  the introduction of new, unknown vulnerabilities due to an increased  use of new system and network technologies; wider access to systems and networks due to increased connectivity; an increased amount of customer information being collected and  transmitted, providing incentives for adversaries to attack these  systems and potentially putting private information at risk of  unauthorized disclosure and use.

In May 2008, we reported that the corporate network of the Tennessee  Valley Authority—the nation’s largest public power company, which  generates and distributes power in an area of about 80,000 square miles  in the southeastern United States—contained security weaknesses that  could lead to the disruption of control systems networks and devices  connected to that network. We made 19 recommendations to improve  the implementation of information security program activities for the  control systems governing the Tennessee Valley Authority’s critical  infrastructures and 73 recommendations to address specific weaknesses  in security controls. The Tennessee Valley Authority concurred with the  recommendations and has taken steps to implement them.

We and others have also reported that smart grid and related systems  have known cyber vulnerabilities. For example, cybersecurity experts  have demonstrated that certain smart meters can be successfully  attacked, possibly resulting in disruption to the electricity grid. In addition,  we have reported that control systems used in industrial settings such as  electricity generation have vulnerabilities that could result in serious  damages and disruption if exploited. Further, in 2007, the Department of  Homeland Security, in cooperation with the Department of Energy, ran a  test that demonstrated that a vulnerability commonly referred to as  “Aurora” had the potential to allow unauthorized users to remotely control,  misuse, and cause damage to a small commercial electric generator.  Moreover, in 2008, the Central Intelligence Agency reported that  malicious activities against IT systems and networks have caused  disruption of electric power capabilities in multiple regions overseas,  including a case that resulted in a multicity power outage. As  government, private sector, and personal activities continue to move to  networked operations, the threat will continue to grow.
subsections: section_title: Reported Incidents Illustrate the Potential Impact of Cyber Threats
paragraphs: Cyber incidents continue to affect the electricity industry. For example,  the Department of Homeland Security’s Industrial Control Systems Cyber  Emergency Response Team recently noted that the number of reported  cyber incidents affecting control systems of companies in the electricity  sector increased from 3 in 2009 to 25 in 2011. In addition, we and others  have reported that cyber incidents can affect the operations of energy  facilities, as the following examples illustrate:

Smart meter attacks. In April 2012, it was reported that sometime in  2009 an electric utility asked the FBI to help it investigate widespread  incidents of power thefts through its smart meter deployment. The  report indicated that the miscreants hacked into the smart meters to  change the power consumption recording settings using software  available on the Internet.

Phishing attacks directed at energy sector. The Department of  Homeland Security’s Industrial Control Systems Cyber Emergency  Response Team reported that, in 2011, it deployed incident response  teams to an electric bulk provider and an electric utility that had been  victims of broader phishing attacks. The team found three malware  samples and detected evidence of a sophisticated threat actor.

Stuxnet. In July 2010, a sophisticated computer attack known as  Stuxnet was discovered. It targeted control systems used to operate  industrial processes in the energy, nuclear, and other critical sectors.  It is designed to exploit a combination of vulnerabilities to gain access  to its target and modify code to change the process.

Browns Ferry power plant. In August 2006, two circulation pumps at  Unit 3 of the Browns Ferry, Alabama, nuclear power plant failed,  forcing the unit to be shut down manually. The failure of the pumps  was traced to excessive traffic on the control system network, possibly  caused by the failure of another control system device.

Northeast power blackout. In August 2003, failure of the alarm  processor in the control system of FirstEnergy, an Ohio-based electric  utility, prevented control room operators from having adequate  situational awareness of critical operational changes to the electrical  grid. When several key transmission lines in northern Ohio tripped  due to contact with trees, they initiated a cascading failure of 508  generating units at 265 power plants across eight states and a  Canadian province.

Davis-Besse power plant. The Nuclear Regulatory Commission  confirmed that in January 2003, the Microsoft SQL Server worm  known as Slammer infected a private computer network at the idled  Davis-Besse nuclear power plant in Oak Harbor, Ohio, disabling a  safety monitoring system for nearly 5 hours. In addition, the plant’s  process computer failed, and it took about 6 hours for it to become  available again.

section_title: Actions Have Been Taken to Secure the Electricity Grid, but Challenges Remain
paragraphs: Multiple entities have taken steps to help secure the electricity grid,  including NERC, NIST, FERC, and the Departments of Homeland  Security and Energy. NERC has performed several activities that are  intended to secure the grid. It has developed eight critical infrastructure  standards for protecting electric utility-critical and cyber-critical assets.

The standards established requirements for the following key  cybersecurity-related controls: critical cyber asset identification, security  management controls, personnel and training, electronic “security  perimeters,” physical security of critical cyber assets, systems security  management, incident reporting and response planning, and recovery  plans for critical cyber assets. In December 2011, we reported that  NERC’s eight cyber security standards, along with supplementary  documents, were substantially similar to NIST guidance applicable to  federal agencies.

NERC also has published security guidelines for companies to consider  for protecting electric infrastructure systems, although such guidelines are  voluntary and typically not checked for compliance. For example, NERC’s  June 2010 Security Guideline for the Electricity Sector: Identifying Critical  Cyber Assets is intended to assist entities in identifying and developing a  list of critical cyber assets as described in the mandatory standards.  NERC also has enforced compliance with mandatory cybersecurity  standards through its Compliance Monitoring and Enforcement Program,  subject to FERC review. NERC has assessed monetary penalties for  violations of its cyber security standards.

NIST, in implementing its responsibilities under the Energy Independence  and Security Act of 2007 with regard to standards to achieve  interoperability of smart grid systems, planned to identify cybersecurity  standards for these systems. In January 2011, we reported that it had  identified 11 standards involving cybersecurity that support smart grid  interoperability and had issued a first version of a cybersecurity  guideline. NIST’s cybersecurity guidelines largely addressed key  cybersecurity elements, such as assessment of cybersecurity risks and  identification of security requirements (i.e., controls); however, its  guidelines did not address an important element essential to securing  smart grid systems—the risk of attacks using both cyber and physical  means. NIST officials said that they intended to update the guidelines to  address this and other missing elements they identified, but their plan and  schedule for doing so were still in draft form. We recommended that NIST  finalize its plan and schedule for incorporating missing elements, and  NIST officials agreed. We are currently working with officials to determine  the status of their efforts to address these recommendations.

FERC also has taken several actions to help secure the electricity grid.  For example, it reviewed and approved NERC’s eight critical  infrastructure protection standards in 2008. Since then, in its role of  overseeing the development of reliability standards, the commission has  directed NERC to make numerous changes to standards to improve  cybersecurity protections. However, according to the FERC Chairman’s  February 2012 letter in response to our report on electricity grid  modernization, many of the outstanding directives have not been  incorporated into the latest versions of the standards. The Chairman  added that the commission would continue to work with NERC to  incorporate the directives. In addition, FERC has authorized NERC to  enforce mandatory reliability standards for the bulk power system, while  retaining its authority to enforce the same standards and assess penalties  for violations. We reported in January 2011 that FERC also had begun  reviewing initial smart grid standards identified as part of NIST efforts.  However, in July 2011, the commission declined to adopt the initial smart  grid standards identified as a part of the NIST efforts, finding that there  was insufficient consensus to do so.

The Department of Homeland Security has been designated by federal  policy as the principal federal agency to lead, integrate, and coordinate  the implementation of efforts to protect cyber-critical infrastructures and  key resources. Under this role, the Department’s National Cyber Security  Division’s Control Systems Security Program has issued recommended  practices to reduce risks to industrial control systems within and across all  critical infrastructure and key resources sectors, including the electricity  subsector. For example, in April 2011, the program issued the Catalog of  Control Systems Security: Recommendations for Standards Developers,  which is intended to provide a detailed listing of recommended controls  from several standards related to control systems. The program also  manages and operates the Industrial Control Systems Cyber Emergency  Response Team to respond to and analyze control-systems-related  incidents, provide onsite support for incident response and forensic  analysis, provide situational awareness in the form of actionable  intelligence, and share and coordinate vulnerability information and threat  analysis through information products and alerts. For example, it reported  providing on-site assistance to six companies in the electricity subsector,  including a bulk electric power provider and multiple electric utilities,  during 2009-2011.

The Department of Energy is the lead federal agency which is responsible  for coordinating critical infrastructure protection efforts with the public and  private stakeholders in the energy sector, including the electricity  subsector. In this regard, we have reported that officials from the  Department’s Office of Electricity Delivery and Energy Reliability stated  that the department was involved in efforts to assist the electricity sector  in the development, assessment, and sharing of cybersecurity  standards. For example, the department was working with NIST to  enable state power producers to use current cybersecurity guidance. In  May 2012, the department released the Electricity Subsector  Cybersecurity Risk Management Process. The guideline is intended to  ensure that cybersecurity risks for the electric grid are addressed at the  organization, mission or business process, and information system levels.  We have not evaluated this guide.
subsections: section_title: Challenges to Securing Electricity Systems and Networks
paragraphs: In our January 2011 report, we identified a number of key challenges that  industry and government stakeholders faced in ensuring the cybersecurity  of the systems and networks that support our nation’s electricity grid.These included the following:

There was a lack of a coordinated approach to monitor whether  industry follows voluntary standards. As mentioned above, under the  Energy Independence and Security Act of 2007, FERC is responsible  for adopting cybersecurity and other standards that it deems  necessary to ensure smart grid functionality and interoperability.  However, FERC had not developed an approach coordinated with  other regulators to monitor, at a high level, the extent to which  industry will follow the voluntary smart grid standards it adopts. There  had been initial efforts by regulators to share views, through, for  example, a collaborative dialogue between FERC and the National  Association of Regulatory Utility Commissioners, which had discussed  the standards-setting process in general terms. Nevertheless,  according to officials from FERC and the National Association of  Regulatory Utility Commissioners, FERC and the state public utility  commissions had not established a joint approach for monitoring how  widely voluntary smart grid standards are followed in the electricity  industry or developed strategies for addressing any gaps. Moreover,  FERC had not coordinated in such a way with groups representing  public power or cooperative utilities, which are not routinely subject to  FERC’s or the states’ regulatory jurisdiction for rate setting. We noted  that without a good understanding of whether utilities and  manufacturers are following smart grid standards, it would be difficult  for FERC and other regulators to know whether a voluntary approach  to standards setting is effective or if changes are needed.

Aspects of the current regulatory environment made it difficult to  ensure the cybersecurity of smart grid systems. In particular,  jurisdictional issues and the difficulties associated with responding to  continually evolving cyber threats were a key regulatory challenge to  ensuring the cybersecurity of smart grid systems as they are  deployed. Regarding jurisdiction, experts we spoke with expressed  concern that there was a lack of clarity about the division of  responsibility between federal and state regulators, particularly  regarding cybersecurity. While jurisdictional responsibility has  historically been determined by whether a technology is located on  the transmission or distribution system, experts raised concerns that  smart grid technology may blur these lines. For example, devices  such as smart meters deployed on parts of the grid traditionally  subject to state jurisdiction could, in the aggregate, have an impact on  those parts of the grid that federal regulators are responsible for— namely the reliability of the transmission system.

There was also concern about the ability of regulatory bodies to  respond to evolving cybersecurity threats. For example, one expert  questioned the ability of government agencies to adapt to rapidly  evolving threats, while another highlighted the need for regulations to  be capable of responding to the evolving cybersecurity issues. In  addition, our experts expressed concern with agencies developing  regulations in the future that are overly specific in their requirements,  such as those specifying the use of a particular product or technology.  Consequently, unless steps are taken to mitigate these challenges,  regulations may not be fully effective in protecting smart grid  technology from cybersecurity threats.

Utilities were focusing on regulatory compliance instead of  comprehensive security. The existing federal and state regulatory  environment creates a culture within the utility industry of focusing on  compliance with cybersecurity requirements, instead of a culture  focused on achieving comprehensive and effective cybersecurity.  Specifically, experts told us that utilities focus on achieving minimum  regulatory requirements rather than designing a comprehensive  approach to system security. In addition, one expert stated that  security requirements are inherently incomplete, and having a culture  that views the security problem as being solved once those  requirements are met will leave an organization vulnerable to cyber  attack. Consequently, without a comprehensive approach to security,  utilities leave themselves open to unnecessary risk.

There was a lack of security features built into smart grid systems.

Security features are not consistently built into smart grid devices. For  example, experts told us that certain currently available smart meters  had not been designed with a strong security architecture and lacked  important security features, including event logging and forensics  capabilities that are needed to detect and analyze attacks. In addition,  our experts stated that smart grid home area networks—used for  managing the electricity usage of appliances and other devices in the  home—did not have adequate security built in, thus increasing their  vulnerability to attack. Without securely designed smart grid systems,  utilities may lack the capability to detect and analyze attacks,  increasing the risk that attacks will succeed and utilities will be unable  to prevent them from recurring.

The electricity industry did not have an effective mechanism for  sharing information on cybersecurity and other issues. The electricity  industry lacked an effective mechanism to disclose information about  cybersecurity vulnerabilities, incidents, threats, lessons learned, and  best practices in the industry. For example, our experts stated that  while the electricity industry has an information sharing center, it did  not fully address these information needs. In addition, President  Obama’s May 2009 cyberspace policy review also identified  challenges related to cybersecurity information sharing within the  electric and other critical infrastructure sectors and issued  recommendations to address them. According to our experts,  information regarding incidents such as both unsuccessful and  successful attacks must be able to be shared in a safe and secure  way to avoid publicly revealing the reported organization and  penalizing entities actively engaged in corrective action. Such  information sharing across the industry could provide important  information regarding the level of attempted cyber attacks and their  methods, which could help grid operators better defend against them.  If the industry pursued this end, it could draw upon the practices and  approaches of other industries when designing an industry-led  approach to cybersecurity information sharing. Without quality  processes for information sharing, utilities will not have the information  needed to adequately protect their assets against attackers.

The electricity industry did not have metrics for evaluating  cybersecurity. The electricity industry was also challenged by a lack of  cybersecurity metrics, making it difficult to measure the extent to  which investments in cybersecurity improve the security of smart grid  systems. Experts noted that while such metrics are difficult to  develop, they could help compare the effectiveness of competing  solutions and determine what mix of solutions combine to make the  most secure system. Furthermore, our experts said that having  metrics would help utilities develop a business case for cybersecurity  by helping to show the return on a particular investment. Until such  metrics are developed, there is increased risk that utilities will not  invest in security in a cost-effective manner, or have the information  needed to make informed decisions on their cybersecurity  investments.

To address these challenges, we made recommendations in our January  2011 report. To improve coordination among regulators and help  Congress better assess the effectiveness of the voluntary smart grid  standards process, we recommended that the Chairman of FERC  develop an approach to coordinate with state regulators and with groups  that represent utilities subject to less FERC and state regulation to (1)  periodically evaluate the extent to which utilities and manufacturers are  following voluntary interoperability and cybersecurity standards and (2)  develop strategies for addressing any gaps in compliance with standards  that are identified as a result of this evaluation. We also recommended  that FERC, working with NERC as appropriate, assess whether  commission efforts should address any of the cybersecurity challenges  identified in our report. FERC agreed with these recommendations.

Although FERC agreed with these recommendations, they have not yet  been implemented. According to the FERC Chairman, given the  continuing evolution of standards and the lack of sufficient consensus for  regulatory adoption, commission staff believe that coordinated monitoring  of compliance with standards would be premature at this time, and that  this may change as new standards are developed and deployed in  industry. We believe that it is still important for FERC to improve  coordination among regulators and that consensus is reached on  standards. We will continue to monitor the status of its efforts to address  these recommendations.

In summary, the evolving and growing threat from cyber-based attacks  highlights the importance of securing the electricity industry’s systems  and networks. A successful attack could result in widespread power  outages, significant monetary costs, damage to property, and loss of life.  The roles of NERC and FERC remain critical in approving and  disseminating cybersecurity guidance and enforcing standards, as  appropriate. Moreover, more needs to be done to meet challenges facing  the industry in enhancing security, particularly as the generation,  transmission, and distribution of electricity comes to rely more on  emerging and sophisticated technology.

Chairman Bingaman, Ranking Member Murkowski, and Members of the  Committee, this concludes my statement. I would be happy to answer any  questions you may have at this time.

section_title: Contact and Acknowledgments
paragraphs: If you have any questions regarding this statement, please contact  Gregory C. Wilshusen at (202) 512-6244 or wilshuseng@gao.gov or  David C. Trimble, Director, Natural Resources and Environment Team, at  (202) 512-3841 or trimbled@gao.gov. Other key contributors to this  statement include Michael Gilmore, Anjalique Lawrence, and Jon R.  Ludwigson (Assistant Directors), Paige Gilbreath, Barbarol James, Lee  McCracken, and Dana Pon.

section_title: Appendix I: Related GAO Products
paragraphs: Cybersecurity: Threats Impacting the Nation. GAO-12-666T. Washington,  D.C.: April 24, 2012.

Cybersecurity: Challenges in Securing the Modernized Electricity Grid,  GAO-12-507T. Washington, D.C.: February 28, 2012.

Critical Infrastructure Protection: Cybersecurity Guidance Is Available, but  More Can Be Done to Promote Its Use. GAO-12-92. Washington, D.C.:  December 9, 2011.

High-Risk Series: An Update. GAO-11-278. Washington, D.C.: February  2011.

Electricity Grid Modernization: Progress Being Made on Cybersecurity  Guidelines, but Key Challenges Remain to Be Addressed. GAO-11-117.  Washington, D.C.: January 12, 2011.

Cybersecurity: Continued Attention Needed to Protect Our Nation's  Critical Infrastructure. GAO-11-865T. Washington, D.C.: July 26, 2011.

Critical Infrastructure Protection: Key Private and Public Cyber  Expectations Need to Be Consistently Addressed. GAO-10-628.  Washington, D.C.: July 15, 2010.

Cyberspace: United States Faces Challenges in Addressing Global  Cybersecurity and Governance. GAO-10-606. Washington, D.C.: July 2,  2010.

Cybersecurity: Continued Attention Is Needed to Protect Federal  Information Systems from Evolving Threats. GAO-10-834T. Washington,  D.C.: June 16, 2010.

Critical Infrastructure Protection: Update to National Infrastructure  Protection Plan Includes Increased Emphasis on Risk Management and  Resilience. GAO-10-296. Washington, D.C.: March 5, 2010.

Cybersecurity: Progress Made but Challenges Remain in Defining and  Coordinating the Comprehensive National Initiative. GAO-10-338.  Washington, D.C.: March 5, 2010.

Cybersecurity: Continued Efforts Are Needed to Protect Information  Systems from Evolving Threats. GAO-10-230T. Washington, D.C.:  November 17, 2009.

Defense Critical Infrastructure: Actions Needed to Improve the  Identification and Management of Electrical Power Risks and  Vulnerabilities to DOD Critical Assets. GAO-10-147. Washington, D.C.:  October 23, 2009.

Critical Infrastructure Protection: Current Cyber Sector-Specific Planning  Approach Needs Reassessment. GAO-09-969. Washington, D.C.:  September 24, 2009.

National Cybersecurity Strategy: Key Improvements Are Needed to  Strengthen the Nation’s Posture. GAO-09-432T. Washington, D.C.:  March 10, 2009.

Electricity Restructuring: FERC Could Take Additional Steps to Analyze  Regional Transmission Organizations’ Benefits and Performance.  GAO-08-987. Washington, D.C.: September 22, 2008.

Information Security: TVA Needs to Address Weaknesses in Control  Systems and Networks. GAO-08-526. Washington, D.C.: May 21, 2008.

Critical Infrastructure Protection: Multiple Efforts to Secure Control  Systems Are Under Way, but Challenges Remain. GAO-07-1036.  Washington, D.C.: September 10, 2007.

Cybercrime: Public and Private Entities Face Challenges in Addressing  Cyber Threats. GAO-07-705. Washington, D.C.: June 22, 2007.

Meeting Energy Demand in the 21st Century: Many Challenges and Key  Questions. GAO-05-414T. Washington, D.C.: March 16, 2005.

This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.


Question-summary annotations: questions: question: How have the threats to US cybersystems changed?
answer: The threats to systems supporting critical infrastructures are evolving and growing. In testimony, the Director of National Intelligence noted a dramatic increase in cyber activity targeting U.S. computers and systems, including a more than tripling of the volume of malicious software.
child_questions: question: What kind of threats are a concern?
answer: Varying types of threats from numerous sources can adversely affect computers, software, networks, organizations, entire industries, and the Internet itself. These include both unintentional and intentional threats, and may come in the form of targeted or untargeted attacks from criminal groups, hackers, disgruntled employees, nations, or terrorists.

question: Who perpetrates these threats?
answer: These include both unintentional and intentional threats, and may come in the form of targeted or untargeted attacks from criminal groups, hackers, disgruntled employees, nations, or terrorists.

question: What is the potential impact of these threats?
answer: The interconnectivity between information systems, the Internet, and other infrastructures can amplify the impact of these threats, potentially affecting the operations of critical infrastructures, the security of sensitive information, and the flow of commerce. Moreover, the electricity grid’s reliance on IT systems and networks exposes it to potential and known cybersecurity vulnerabilities, which could be exploited by attackers. The potential impact of such attacks has been illustrated by a number of recently reported incidents and can include fraudulent activities, damage to electricity control systems, power outages, and failures in safety equipment.

questions: question: Who has taken steps to address such concerns?
answer: To address such concerns, multiple entities have taken steps to help secure the electricity grid, including the North American Electric Reliability Corporation, the National Institute of Standards and Technology (NIST), the Federal Energy Regulatory Commission, and the Departments of Homeland Security and Energy.

question: What steps have been taken to address such concerns?
answer: These include, in particular, establishing mandatory and voluntary cybersecurity standards and guidance for use by entities in the electricity industry. For example, the North American Electric Reliability Corporation and the Federal Energy Regulatory Commission, which have responsibility for regulation and oversight of part of the industry, have developed and approved mandatory cybersecurity standards and additional guidance. In addition, NIST has identified cybersecurity standards that support smart grid interoperability and has issued a cybersecurity guideline. The Departments of Homeland Security and Energy have also played roles in disseminating guidance on security practices and providing other assistance.

questions: question: How does the electric power industry rely on information technology?
answer: The electric power industry is increasingly incorporating information technology (IT) systems and networks into its existing infrastructure (e.g., electricity networks, including power lines and customer meters).
child_questions: question: What is the use of such technology?
answer: This use of IT can provide many benefits, such as greater efficiency and lower costs to consumers.

question: What are the potential drawbacks of such technology?
answer: However, this increased reliance on IT systems and networks also exposes the grid to cybersecurity vulnerabilities, which can be exploited by attackers. Moreover, GAO has identified protecting systems supporting our nation’s critical infrastructure (which includes the electricity grid) as a governmentwide high-risk area.

questions: question: What does GAO's statement on the protection of the electricity grid discuss?
answer: Accordingly, this statement discusses (1) cyber threats facing cyber-reliant critical infrastructures, which include the electricity grid, and (2) actions taken and challenges remaining to secure the grid against cyber attacks.

question: Where did GAO source their information for this statement?
answer: In preparing this statement, GAO relied on previously published work in this area and reviewed reports from other federal agencies, media reports, and other publicly available sources.