Critical Infrastructure Protection: Cybersecurity of the Nation's Electricity Grid Requires Continued Attention
Released: 2015-10-21T00:00:00

Letter

Background

The electricity industry, as shown in figure 1, is composed of four distinct functions: generation, transmission, distribution, and system operations. Once electricity is generated—whether by burning fossil fuels; through nuclear fission; or by harnessing wind, solar, geothermal, or hydro energy—it is generally sent through high-voltage, high-capacity transmission lines to local electricity distributors. Once there, electricity is transformed into a lower voltage and sent through local distribution lines for consumption by industrial plants, businesses, and residential consumers. Because electric energy is generated and consumed almost instantaneously, the operation of an electric power system requires that a system operator constantly balance the generation and consumption of power.

Utilities and others own and operate electricity assets, which may include generation plants, transmission lines, distribution lines, and substations— structures often seen in residential and commercial areas that contain technical equipment such as switches and transformers to ensure smooth, safe flow of current and regulate voltage. Utilities may be owned by investors, municipalities, and individuals (as in cooperative utilities).

System operators—sometimes affiliated with a particular utility or sometimes independent and responsible for multiple utility areas— manage the electricity flows. These system operators manage and control the generation, transmission, and distribution of electric power using control systems—IT- and network-based systems that monitor and control sensitive processes and physical functions, including opening and closing circuit breakers.

As we have previously reported, the effective functioning of the electricity industry is highly dependent on these control systems. Nevertheless, for many years, aspects of the electricity network lacked (1) technologies— such as sensors—to allow system operators to monitor how much electricity was flowing on distribution lines, (2) communications networks to further integrate parts of the electricity grid with control centers, and (3) computerized control devices to automate system management and recovery.

Modernization of the Electricity Infrastructure

As the electricity industry has matured and technology has advanced, utilities have begun taking steps to update the electricity grid—the transmission and distribution systems—by integrating new technologies and additional IT systems and networks. Though utilities have regularly taken such steps in the past, industry and government stakeholders have begun to articulate a broader, more integrated vision for transforming the electricity grid into one that is more reliable and efficient; facilitates alternative forms of generation, including renewable energy; and gives consumers real-time information about fluctuating energy costs.

This vision—the smart grid—would increase the use of IT systems and networks and two-way communication to automate actions that system operators formerly had to make manually. Electricity grid modernization is an ongoing process, and initiatives have commonly involved installing advanced metering infrastructure (smart meters) on homes and commercial buildings that enable two-way communication between the utility and customer. Other initiatives include adding “smart” components to provide the system operator with more detailed data on the conditions of the transmission and distribution systems and better tools to observe the overall condition of the grid (referred to as “wide-area situational awareness”). These include advanced, smart switches on the distribution system to reroute electricity around a troubled line and high-resolution, time-synchronized monitors—called phasor measurement units—on the transmission system.

The use of smart grid systems may have a number of benefits, including improved reliability with fewer and shorter outages, downward pressure on electricity rates resulting from the ability to shift peak demand, an improved ability to more efficiently use alternative sources of energy, and an improved ability to detect and respond to potential attacks on the grid.

Regulation of the Electricity Industry

Both the federal government and state governments have authority for overseeing the electricity industry. For example, the Federal Energy Regulatory Commission (FERC) regulates rates for wholesale electricity sales and transmission of electricity in interstate commerce. This includes approving whether to allow utilities to recover the costs of investments they make to the transmission system, such as some smart grid investments. Meanwhile, local distribution and retail sales of electricity are generally subject to regulation by state public utility commissions.

State and federal authorities also play key roles in overseeing the reliability of the electric grid. State regulators generally have authority to oversee the reliability of the local distribution system. The North American Electric Reliability Corporation (NERC) is the federally designated U.S. Electric Reliability Organization, and is overseen by FERC. NERC has responsibility for conducting reliability assessments and developing and enforcing mandatory standards to ensure the reliability of the bulk power system—i.e., facilities and control systems necessary for operating the transmission network and certain generation facilities needed for reliability. NERC develops reliability standards collaboratively through a deliberative process involving utilities and others in the industry, which are then sent to FERC for approval. These standards include critical infrastructure protection standards for protecting electric utility-critical and cyber-critical assets. FERC has responsibility for reviewing and approving the reliability standards or directing NERC to modify them.

In addition, the Energy Independence and Security Act of 2007 established federal policy to support the modernization of the electricity grid and required actions by a number of federal agencies, including the National Institute of Standards and Technology (NIST), FERC, and the Department of Energy. With regard to cybersecurity, the act required NIST and FERC to take the following actions:

NIST was to coordinate development of a framework that includes protocols and model standards for information management to achieve interoperability of smart grid devices and systems. As part of its efforts to accomplish this, NIST identified cybersecurity standards for these systems and the need to develop guidelines for organizations such as electric companies on how to securely implement smart grid systems. In January 2011, we reported that NIST had identified 11 standards involving cybersecurity that support smart grid interoperability and had issued the first version of a cybersecurity guideline. In February 2012, NIST issued the 2.0 version of the framework that, according to NIST documents, added 22 standards, specifications, and guidelines to the 75 standards NIST recommended as being applicable to the smart grid in the 1.0 version from January 2010. In September 2014, NIST issued the first revision of the cybersecurity guidelines.

FERC was to adopt standards resulting from NIST’s efforts that it deemed necessary to ensure smart grid functionality and interoperability. However, according to FERC officials, the statute did not provide specific additional authority to allow FERC to require utilities or manufacturers of smart grid technologies to follow these standards. As a result, any standards identified and developed through the NIST-led process are voluntary unless regulators use other authorities to indirectly compel utilities and manufacturers to follow them.

Cyber Threats and Vulnerabilities Facing the Electricity Grid

Like threats affecting other critical infrastructures, threats to the electricity industry and its transmission and distribution systems are evolving and growing and can come from a wide array of sources. Risks to cyber- based assets can originate from unintentional or intentional threats. Unintentional threats can be caused by, among other things, natural disasters, defective computer or network equipment, software coding errors, and careless or poorly trained employees. Intentional threats include both targeted and untargeted attacks from a variety of sources, including criminal groups, hackers, disgruntled insiders, foreign nations engaged in espionage and information warfare, and terrorists.

These adversaries vary in terms of their capabilities, willingness to act, and motives, which can include seeking monetary gain or pursuing a political, economic, or military advantage. For example, adversaries possessing sophisticated levels of expertise and significant resources to pursue their objectives—sometimes referred to as “advanced persistent threats”—pose increasing risks. They make use of various techniques— or exploits—that may adversely affect federal information, computers, software, networks, and operations, such as a denial of service, which prevents or impairs the authorized use of networks, systems, or applications.

The potential impact of these threats is amplified by the connections between industrial control systems, supervisory control and data acquisition (or SCADA) systems, information systems, the Internet, and other infrastructures, which create opportunities for attackers to disrupt critical services, including electrical power. The increased reliance on IT systems and networks also exposes the electric grid to potential and known cybersecurity vulnerabilities. These include an increased number of entry points and paths that can be exploited; the introduction of new, unknown vulnerabilities resulting from an increased use of new system and network technologies; wider access to systems and networks due to increased connectivity; an increased amount of customer information being collected and transmitted, which creates a tempting target for potential attackers.

We and others have also reported that smart grid and related systems have known cyber vulnerabilities. For example, cybersecurity experts have demonstrated that certain smart meters can be successfully attacked, possibly resulting in disruption to the electricity grid. In addition, we have reported that control systems used in industrial settings such as electricity generation have vulnerabilities that could result in serious damages and disruption if exploited. Further, in 2007, the Department of Homeland Security, in cooperation with the Department of Energy, ran a test that demonstrated that a vulnerability commonly referred to as “Aurora” had the potential to allow unauthorized users to remotely control, misuse, and cause damage to a small commercial electric generator. Moreover, in 2008, the Central Intelligence Agency reported that malicious activities against IT systems and networks have caused disruption of electric power capabilities in multiple regions overseas, including a case that resulted in a multicity power outage. In January 2014, the Director of National Intelligence testified that industrial control systems and SCADA systems used in electrical power distribution and other industries provided an enticing target to malicious actors and that, although newer architectures provide flexibility, functionality, and resilience, large segments remain vulnerable to attack, which might cause significant economic or human impact. Further, in 2015 the Director testified that studies asserted that foreign cyber actors were developing means to access industrial control systems remotely, including those that manage critical infrastructures such as electric power grids. As government, private sector, and personal activities continue to move to networked operations, the threat will continue to grow.

Cyber incidents continue to affect the electric industry. For example, the Department of Homeland Security’s Industrial Control Systems Cyber Emergency Response Team noted that the number of reported cyber incidents affecting control systems of companies in the electricity subsector increased from 3 in 2009 to 25 in 2011. The response team reported that the energy sector, which includes the electricity subsector, led all others in fiscal year 2014 with 79 reported incidents. Reported incidents affecting the electricity subsector have had a variety of impacts, including hacks into smart meters to steal power, failure in control systems devices requiring power plants to be shut down, and malicious software disabling safety monitoring systems.

Actions Have Been Taken to Secure the Electricity Grid, but Continued Attention Is Required

As we have previously reported, multiple entities have taken steps to help secure the electricity grid, including NERC, NIST, FERC, and the Departments of Homeland Security and Energy. For example, NERC developed critical infrastructure standards for protecting electric utility– critical and cyber-critical assets. These standards established requirements for key cybersecurity-related controls: the identification of critical cyber assets, security management, personnel and training, electronic “security perimeters,” physical security of critical cyber assets, systems security management, incident reporting and response planning, and recovery plans for critical cyber assets. In December 2011 we reported that NERC’s cybersecurity standards, along with supplementary guidance, were substantially similar to NIST guidance applicable at the time to federal agencies.

NERC had also published security guidelines for companies to consider for protecting electric infrastructure systems, although these guidelines were voluntary and typically not checked for compliance. For example, some of this guidance was intended to assist entities in identifying and developing a list of critical cyber assets. As of October 2015, NERC listed about 30 critical infrastructure protection standards for cybersecurity, some of which were subject to enforcement, some which were subject to future enforcement, and some which were pending regulatory filing or approval. NERC also had enforced compliance with mandatory cybersecurity standards through its Compliance Monitoring and Enforcement Program, including assessing monetary penalties for violations.

NIST, in accordance with its responsibilities under the Energy Independence and Security Act of 2007, has identified cybersecurity standards for smart grid systems. Specifically, in August 2010 NIST had identified 11 such standards and issued the first version of a cybersecurity guideline. As we reported in January 2011, NIST’s guidelines largely addressed key cybersecurity elements, with the exception of the risk of attacks using both cyber and physical means—an element essential to securing smart grid systems. We recommended that NIST finalize its plan and schedule for incorporating the missing elements into its guidelines. In 2014, NIST issued updated guidelines, which address the relationship of smart grid cybersecurity to cyber-physical attacks and cybersecurity testing and certification. In addition, the updated guidelines describe the relationship of smart grid cybersecurity to NIST’s cybersecurity framework that was issued in February 2014. This framework, which was developed in accordance with Executive Order 13636, is to enable organizations—regardless of size, degree of cybersecurity risk, or cybersecurity sophistication—to apply the principles and best practices of risk management to improving the cybersecurity and resilience of critical infrastructure.

FERC had also taken several actions, including reviewing and approving NERC’s critical infrastructure protection standards in 2008. It had also directed NERC to make changes to the standards to improve cybersecurity protections. However, in 2012 the FERC Chairman stated that many of the outstanding directives had not been incorporated into the standards. We also noted in our January 2011 report that FERC had begun reviewing smart grid standards identified by NIST, but declined to adopt them due to insufficient consensus.

The Department of Homeland Security, in its capacity as the lead federal agency for cyber-critical infrastructure protection, had issued recommended practices to reduce risks to industrial control systems in critical infrastructure sectors, including the electricity subsector. The department has also provided on-site support to respond to and analyze security incidents and shared actionable intelligence, vulnerability information, and threat analysis with companies in the electricity subsector. In addition, the department, in accordance with Executive Order 13636, established a program to promote the adoption of the NIST cybersecurity framework.

As the lead agency responsible for critical infrastructure protection efforts in the energy sector, the Department of Energy, as we reported in December 2011, was involved in efforts to assist the electricity subsector in the development, assessment, and sharing of cybersecurity standards, according to department officials. In addition, the department has created sector-specific guidance to assist the sector in implementing the NIST cybersecurity framework. The guidance includes sections that explain framework concepts for its application, identify example resources that may support framework use, provide a general approach to framework implementation, and identify an example of a tool-specific approach to implementing the framework.

Challenges Existed to Securing Electricity Systems and Networks

In our January 2011 report we identified a number of key challenges that industry and government stakeholders faced in securing the systems and networks supporting the electricity grid.

Monitoring implementation of cybersecurity standards. Best practices for information security call for monitoring the extent to which security controls have been implemented. In our report, we noted that FERC had not developed an approach coordinated with other regulators to monitor, at a high level, the extent to which industry follows the voluntary smart grid standards it adopts. We recommended that FERC, in coordination with state regulators and groups that represent utilities subject to less FERC and state regulation, periodically evaluate the extent to which utilities and manufacturers are following voluntary interoperability and cybersecurity standards and develop strategies for addressing any gaps in compliance with standards that are identified as a result of this evaluation. However, FERC has not implemented this recommendation. While FERC reported that it has taken steps to collaborate with stakeholders, it has not taken steps to determine the extent to which the voluntary standards have been integrated into products or whether they are effective. Monitoring such efforts would help FERC and other regulators know if their approach to standards setting is effective or if changes are needed.

Clarifying regulatory responsibilities. Experts we spoke with during the course of our review in 2011 expressed concern that there was a lack of clarity about the division of responsibility between federal and state regulators, particularly regarding cybersecurity. While jurisdictional responsibility has historically been determined by whether a technology is located on the transmission or distribution system, experts raised concerns that smart grid technology may blur these lines because, for example, devices deployed on parts of the grid traditionally subject to state jurisdiction could, in the aggregate, affect the reliability of the transmission system, which falls under federal jurisdiction. Experts also noted concern about the ability of regulatory bodies to respond quickly to evolving cybersecurity threats. Clarifying these responsibilities could help improve the effectiveness of efforts to protect smart grid technology from cyber threats.

Taking a comprehensive approach to cybersecurity. To secure their systems and information, entities should adopt an integrated, organization-wide program for managing information security risk. Such an approach helps ensure that risk management decisions are aligned strategically with the organization’s mission and security controls are effectively implemented. However, as we reported in 2011, experts told us that the existing federal and state regulatory environment had created a culture within the utility industry of focusing on compliance with regulatory requirements instead of one focused on achieving comprehensive and effective cybersecurity. By taking such a comprehensive approach, utilities could better mitigate cybersecurity risk.

Ensuring that smart grid systems have built-in security features.

Information systems should be securely configured, including having the ability to record events that take place on networks to allow for detecting and analyzing potential attacks. Nonetheless, experts told us that certain currently available smart meters had not been designed with a strong security architecture and lacked important security features, such as event logging. By ensuring that smart grid systems are securely designed, utilities could enhance their ability to detect and analyze attacks, reducing the risk that attacks will succeed and helping to prevent them from recurring.

Effectively sharing cybersecurity information. Information sharing is a key element in the model established by federal policy for protecting critical infrastructure. However, the electric industry lacked an effective mechanism to disclose information about cybersecurity vulnerabilities, incidents, threats, lessons learned, and best practices. For example, experts we spoke with stated that while the industry had an information-sharing center, it did not fully address these information needs. Establishing quality processes for information sharing will help provide utilities with the information needed to adequately protect cyber assets against attackers.

Establishing metrics for evaluating cybersecurity. Metrics are important for comparing the effectiveness of competing cybersecurity solutions and determining what mix of solutions will make the most secure system. The electric industry, however, was challenged by a lack of cybersecurity metrics, making it difficult to determine the extent to which investments in cybersecurity improve the security of smart grid systems. Developing such metrics could provide utilities with key information for making informed and cost-effective decisions on cybersecurity investments.

In our January 2011 report, we recommended that FERC, working with NERC as appropriate, assess whether any cybersecurity challenges identified in our report should be addressed in commission cybersecurity efforts.

Since that time, FERC took the following actions. First, in 2011, it began evaluating whether cybersecurity challenges, including those identified in our report, should be addressed under the agency’s existing cyber security authority and efforts. As a part of this effort, the commission directed NERC to revise the electricity industry’s critical infrastructure protection (CIP) standards with the aim of addressing, among other things, cybersecurity challenges identified in our report. In November 2013, NERC issued updated CIP standards to address these and other cybersecurity challenges. Second, the commission held a technical conference in 2011 in which it solicited feedback from industry stakeholders to help inform the agency’s cybersecurity efforts. Third, in September 2012, the commission established an Office of Energy Infrastructure Security, which is to, among other things, help mitigate cybersecurity threats to electricity industry facilities, and to improve cybersecurity information sharing.

In summary, as they become increasingly reliant on computerized technologies, the electricity industry’s systems and networks are susceptible to an evolving array of cyber-based threats. Key entities, including NERC and FERC, are critical to approving and disseminating cybersecurity guidance and standards, while NIST, DHS, and the Department of Energy have additional roles to play in providing guidance and providing other forms of support for protecting the sector against cyber threats. Moreover, without monitoring the implementation of voluntary cybersecurity standards in the industry, FERC does not know the extent to which such standards have been adopted or whether they are effective. Given the increasing use of information and communications technology in the electricity subsector and the evolving nature of cyber threats, continued attention can help mitigate the risk these threats pose to the electricity grid.

Chairman Weber, Chairwoman Comstock, Ranking Members Grayson and Lipinski, and Members of the Subcommittees, this concludes my prepared statement. I would be happy to answer any questions you may have at this time.

Contact and Acknowledgments

If you or your staffs have any questions about this statement, please contact Gregory C. Wilshusen at (202) 512-6244 or wilshuseng@gao.gov. Other staff who contributed to this statement include Franklin J. Rusco, Director; Michael W. Gilmore; Bradley W. Becker; Kenneth A. Johnson; Jon R. Ludwigson; Lee McCracken; Jonathan Wall; and Jeffrey W. Woodward.

This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.