Electric Grid Cybersecurity
Released: 2018-09-04T00:00:00

Introduction

Electricity generation is vital to the commerce and daily functioning of the United States. The electric power grid in the United States comprises all of the power plants generating electricity, together with the transmission and distribution lines and systems which bring power to end-use customers. The grid also connects the many publicly and privately owned electric utility and other wholesale power companies in different states and regions of the United States. The U.S. electric grid has historically operated with a high level of reliability; however, the various parts of the electric power system are all vulnerable to failure due to natural, operational, or manmade events.

While natural and operational failures can be mitigated somewhat by planning and prudent investments, cybersecurity is a growing concern for both electric utilities and other critical infrastructure entities. Adoption of digital technologies has improved the efficiency and speed of operations and processes, and allowed for an almost instantaneous exchange of information between connected devices. Often, these digital devices are also connected to the internet to increase the ability to share information with a multitude of users and devices. While the benefits of internet-connected digital technologies are many, so too are the risks of a cybersecurity breach from exposure to a globally internet-connected environment.

The electric grid relies on a number of electronic devices, switches, and circuit breakers to regulate and report on the flow of electricity at different parts of the system. Together, these pieces of mechanical and automated equipment constitute the grid's industrial control system (ICS) network, managing power plant controls, transformer yard and power bus functions, transmission, and distribution substations. The grid's ICS networks essentially operate in a "control loop" in which sensors continually check key components, with variable responses against control variables to ensure that the system is functioning as designed. ICS networks control industrial processes in a number of energy and manufacturing operations. One particular type of ICS network common in the electric power industry is a supervisory control and data acquisition (SCADA) system which gathers information from remote stations across a utility system to control geographically dispersed assets.

In 2015, a cyber attack on distribution utility substations in Ukraine shut off power to over 225,000 utility customers for several hours, and was the first time that a cyber attack was publicly acknowledged to have caused a grid power outage. A second cyber attack in Ukraine in 2016 was reported on an electricity control center in the city of Kiev, shutting down substations which controlled 200 megawatts of capacity. The potential for a similar attack on the U.S. grid was seen as a possibility.

Some recent reports about foreign hackers targeting the U.S. electric power system and other critical infrastructure are summarized below. While these intrusions have not been reported as having resulted in significant disruptions, concerns have increased over the potential for these intrusions to result in damaging cyber attacks in the future. The intrusions, which have been directed at the ICS networks of energy, manufacturing, communications and nuclear entities, include the following:

Cyber intrusions on the SCADA systems of the Bowman Dam in Rye, New York resulted in federal indictments against a group of hackers linked to Iran's Islamic Revolutionary Guard Corps. Cyber intrusions in October 2017 were reported to have targeted electric company ICS networks in a reconnaissance and information gathering campaign attributed to North Korea. In March 2018, the United States Computer Emergency Readiness Team (US-CERT) issued an alert concerning cyber intrusions at critical energy and manufacturing infrastructure companies. The Department of Homeland Security and the Federal Bureau of Investigation concluded that Russian government hackers conducted a multi-stage intrusion campaign to access files on ICS networks. The malware conducted network reconnaissance, collecting information on ICS and SCADA systems before being found.

Further attacks on U.S. critical energy infrastructure are expected, as nation states view disruption of the U.S. economy as a potential target.

This report discusses the current state of electric grid cybersecurity, and the interconnected dependency of critical infrastructure with regard to electric sector reliability. Current efforts to ensure the reliability of the grid are highlighted, and potential grid vulnerabilities are explored with a focus on the electric power sector's mutual dependency on other critical infrastructure. Technologies and actions to address perceived future threats are described, and possible risks to approaches moored in technology-based cybersecurity defense systems. Finally, since the possibility does exist for a major cyber and/or physical security attack to result in significant damage or impairment, the potential need to build resilience into the grid to enable a quicker recovery is discussed.

Electric Grid Reliability

Congress gave the Federal Energy Regulatory Commission (FERC) authority to oversee the reliability of the bulk-power system under the Energy Policy Act of 2005 ( P.L. 109-58 ; EPACT05). Reliability standards were added as section 215 of the Federal Power A ct (FPA) in an effort to help ensure the reliable operation of the bulk power system so that "instability, uncontrolled separation, or cascading failures" will not occur as a result of a sudden disturbance. Section 215 of the FPA also defines FERC's jurisdiction in terms of "users, owners and operators" of the bulk power system.

FERC can approve or remand back reliability standards proposed by the Electric Reliability Organization (ERO) , which bulk-power system owners and operators must follow to help ensure the reliable operation of the grid. Currently, the North American Electric Reliability Corporation (NERC) serves as the ERO. NERC therefore proposes reliability standards for Critical Infrastructure Protection (CIP), which are updated considering the status of reliability and cybersecurity concerns for the grid. Reliability standards address programs ranging from vegetation clearances in electric transmission line rights-of-way to policies and procedures for critical infrastructure protection focused on the cyber- and physical security of power plants and supporting facilities. The standards are both mandatory and enforceable in that violators of reliability rules may be subject to a civil fine of up to $1 million per violation for each day that it continues. While the bulk electric power system has mandatory and enforceable standards for both cyber and physical security for critical infrastructure protection, these are developed on a consensus basis before being submitted to FERC, which determines whether to accept or remand the standard back to NERC for revision.

Under the Federal Power Act, FERC's authority is largely limited to wholesale power sales and the transmission of electricity in interstate commerce, while states have authority over retail sales by electric distribution systems. FERC acknowledges that EPACT05 excluded local distribution systems from its reliability mandate under Section 215 of the Federal Power Act, as not being part of the bulk power system. That criterion excluded facilities in Alaska and Hawaii, and virtually the entire grid in cities with large distribution systems like New York City. In 2012, FERC approved NERC's criteria for the definition of the bulk electric system. These criteria and definitions apply to all NERC regions and are a bright-line threshold including all Transmission Elements operated at 100 kilovolts (kV) or higher, and real power and reactive power resources connected at 100 kV or higher.

Some Recent Developments in Grid Cyber Policy

The increase in the number of cyber attacks aimed at U.S. critical energy infrastructure has led to heightened attention from the federal government. While a cyber attack on the U.S. grid similar to the cyber attacks in Ukraine was not expected to result in the same type of consequences (given the older electricity systems in place in Ukraine), the potential for financial market and economic disruption may be a legitimate concern.

Presidential Executive Order 13800

In 2017, President Trump issued Executive Order (E.O.) 13800 on "Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure" because the risks of cyber threats to critical infrastructure are perceived as a national security imperative. E.O. 13800 called for an assessment of a prolonged electric power outage resulting from a cyber attack, and an evaluation of the "readiness and gaps in the United States' ability to manage and mitigate consequences of a cyber incident against the electric subsector." The cyber supply chain and public-private cybersecurity information sharing were listed among a number of major cybersecurity potential vulnerabilities.

Department of Energy Establishes New Cybersecurity Office

The Fixing America's Surface Transportation Act (FAST Act; P.L. 114-94 ) gives the Department of Energy (DOE) new authority to order electric utilities and NERC to implement emergency security actions. DOE is designated as the lead sector specific agency for the Energy sector, with responsibilities for both physical and cyber security.

DOE has established a new Office of Cybersecurity, Energy Security, and Emergency Response (CESER) to "bolster DOE's efforts in cybersecurity and energy security." CESER is to focus on more coordinated preparedness and response to natural and man-made threats to energy infrastructure security.

Following E.O. 13800, DOE established a five-year strategy for reducing cyber risks in the U.S. energy sector which is intended to serve as the basis for CESER activities. Under the strategy, CESER will carry out the DOE's Office of Electricity's cybersecurity responsibilities in supporting the physical and cybersecurity needs of energy owners and operators.

Three main goals have been established under the strategy:

Strengthen Energy Sector Cybersecurity Preparedness — focuses efforts through Cybersecurity Risk Information Sharing Program (CRISP) activities; Coordinate Cyber Incident Response and Recovery — establishes a coordinated national cyber incident response capability for the energy sector to augment cyber mutual assistance. DOE's national laboratories are to develop an integrated set of specialized cyber resources and capabilities that can be deployed to help energy companies identify and respond to a cyber attack; and Accelerate Game-Changing R esearch, D evelopment, and D emonstration (RD&D) of Resilient E nergy D elivery S ystems —keys on research, development and demonstration of new cybersecurity tools and technologies for automated defense of future energy delivery systems.

Revised Voluntary Cybersecurity Framework

While the bulk electric system has mandatory and enforceable rules for cyber and physical security, other energy sectors do not. In April 2018, the National Institute of Standards and Technology (NIST) released its revised voluntary Cybersecurity Framework. The framework is a risk-based approach to cybersecurity that is generally applicable to industries using a range of IT technologies, including Internet of Things (IoT) devices. The Framework focuses on "using business drivers to guide cybersecurity activities and considering cybersecurity risks as part of the organization's risk management processes."

Cyber and Physical Security of the Grid

The energy sector is one of 16 infrastructure sectors designated as critical infrastructure by Presidential Policy Directive-21 (PPD-21). The stated goal of PPD-21 is to advance "a national unity of effort to strengthen and maintain secure, functioning, and resilient critical infrastructure." The energy sector under the policy directive includes electricity, oil, and natural gas. The reliance of virtually all industries on electric power is recognized by the U.S. Department of Homeland Security (DHS), which has the primary responsibility for implementing PPD-21.

A report released by the National Research Council (NRC) in 2012 recognized the vulnerability of the electric power delivery system to either cyber and/or physical attacks. The NRC report concluded that well-informed terrorists could black out a large region of the country for weeks or even months.

An event of this magnitude and duration could lead to turmoil, widespread public fear and an image of helplessness that would play directly into the hands of the terrorists. If such large extended outages were to occur during times of extreme weather, they could also result in hundreds or even thousands of deaths due to heat stress or extended exposure to extreme cold .

The largest power system disruptions experienced to date in the United States have caused high economic impacts. Considering that a systematically designed and executed terrorist attack could cause disruptions that were even more widespread and of longer duration, it is no stretch of the imagination to think that such attacks could entail costs of hundreds of billions of dollars—that is, perhaps as much as a few percent of the U.S. gross domestic product (GDP), which is currently about $12.5 trillion.

The NRC report further commented on the potential effects of a combined cyber and physical attack on the grid.

If they could gain access, hackers could manipulate SCADA systems to disrupt the flow of electricity, transmit erroneous signals to operators, block the flow of vital information, or disable protective systems. Cyber attacks are unlikely to cause extended outages, but if well coordinated they could magnify the damage of a physical attack. For example, a cascading outage would be aggravated if operators did not get the information to learn that it had started, or if protective devices were disabled.

Similar conclusions were reached in a 2015 report from the University of Cambridge and Lloyds of London, which stated that a targeted cyber attack could leave 15 states and 93 million people from New York City to Washington, D.C., without power. The scenario estimated the total impact to the U.S. economy at between $243 billion and $1 trillion, resulting from "direct damage to assets and infrastructure, decline in sales revenue to electricity supply companies, loss of sales revenue to business and disruption to the supply chain."

The 2013 attack on the Metcalf substation in California further cast light on the physical vulnerabilities of the grid. After someone broke into a nearby underground vault to cut telephone cables, snipers opened fire on the substation, knocking out 17 large power transformers sending power to Silicon Valley. A blackout was averted by rerouting power around the substation, and local power plants were called upon to produce more electricity. It took the local utility 27 days to restore the substation. The Federal Energy Regulatory Commission's (FERC's) chairman at the time reportedly said that "if [the attack] were widely replicated across the country, it could take down the U.S. electric grid and black out much of the country." Largely as a result of the grid vulnerabilities highlighted by this incident, FERC directed NERC to develop a physical security standard (which culminated in CIP-014).

Since the 2015 cyber attack in Ukraine, some have expressed increased concerns over the cybersecurity of interconnected U.S. electric power systems. The 2015 Ukraine cyber attack and blackouts demonstrated that an electric grid could be infiltrated, controlled, and rendered inoperable through Internet-connected systems by an outside, unauthorized entity.

Recovery from a well-planned cyber and physical attack on the grid could be complicated by the cost and vulnerability of critical components. While a physical attack on transmission towers to bring down power lines could cause blackouts, the strategic destruction of a number of critical high-voltage transformers could potentially cause long-lasting power outages. These transformers are large, and difficult to move. A large-scale attack may use up the limited inventory of spare units, and it may take months or years to build new units (due mainly to the size and often unique specifications of high-voltage transformers). The availability of other large components, such as high-voltage circuit breakers could also hamper recovery efforts. The security of the supply chain for grid devices and components is discussed later in this report.

Critical Infrastructure Protection Standards

NERC has a set of mandatory and enforceable standards for electricity reliability to protect the critical infrastructure of the bulk electric system (BES). NERC periodically updates the applicable version of the critical infrastructure protection cybersecurity (CIP) standards, which leads to a new compliance phase for the owners and operators of the BES.

The current iteration of NERC's standards is CIP Version 6, which contains several updates to Version 5 requirements, largely reflecting increased security for BES assets and training for utility personnel. Table 1 in the Appendix of this report lists the current standards in effect and several standards pending regulatory approval from FERC.

NERC's CIP Version 5 moved utility companies towards active planning for system security needs rather than solely compliance with the standards. It established criteria mandating that BES owner/operators focus on improving the security of critical assets. BES assets, were categorized as low or high impact, and were to be protected according to the level of requirements for that impact category. CIP Version 5 also required encryption of grid command and control signals; "role based" instead of "risk-based" classifications requiring multiple levels of compliance considering facilities with low, medium or high-level potential impacts on the BES; monitoring and control of remote access Internet connections (with inclusion of serial connections); multiple-factor authentication (rather than a one-step password for access), incident response recovery plans; physical security of BES cyber assets to prevent unauthorized physical entry and access; and cataloging of all software and all security patches on BES devices.

Grid Security Exercises

Every two years, the North American Electric Reliability Corporation (NERC) organizes a two-day grid security exercise (called GridEx) to test the electricity sector's ability to respond to grid security emergencies caused by cyber and physical attacks. The goals of GridEx include the determination of ways to best secure the grid and improve future response by improving communications among companies, state and federal agencies, identifying lessons learned, and engaging senior company leadership. The 2017 GridEx drill was the fourth iteration of the exercise, and had over 6,500 participants from the United States, Canada, and Mexico.

NERC released its public report of the results of GridEx IV drill, listing lessons learned and recommendations to enhance grid security.

Recommendations in the report included increasing coordination between utilities and federal, state and local governments, enhancing information sharing capabilities for the Electricity Subsector Coordinating Council [ESCC] and Energy Government Coordinating Council, developing ESCC processes for emergency orders and continuing to promote the Cyber Mutual Assistance Program.

A focus on recovery from a potential large-scale physical or cyber attack appears to be an increasing part of the exercises. The Cyber Mutual Assistance (CMA) program is intended to provide a pool of utility cybersecurity experts who can share their expertise with other utilities in the event of a disruption of electric or natural gas service, systems, and/or IT infrastructure due to a cyber emergency. NERC recommended that more utilities should participate in the CMA program. Additionally, NERC proposed that the ESCC and the Electricity Information Sharing and Analysis Center (E-ISAC) also increase their participation in the CMA program to encourage the efficient sharing of relevant information.

Cyber Threats to the Grid

The bulk power system faces new and evolving cybersecurity threats on a daily basis. Cyber risks can come from direct attacks aimed at the electric grid or other critical infrastructure which could impact the operations or security of the grid. Arguably, the greatest cyber threats to the grid have been attacks focused on manipulating industrial control systems which are increasingly connected to the Internet to manage the production and regional flows of electricity.

Industrial Control System Vulnerabilities

ICS-CERT issues an annual report on ICS network vulnerabilities based on reports of cyber intrusions. Private companies also issue similar reports drawn from ICS-CERT alerts and their own sources. As one example, in 2017, the security firm Dragos (which specializes in industrial-control systems) looked at 163 new security vulnerabilities it found in industrial control devices. It stated that the devices with the vulnerabilities it found were typically "insecure-by-design," since they were located deep within ICS networks. It found that 61% of these vulnerabilities would likely cause a "severe operational impact," if exploited in a cyber attack. Dragos said that about 15% of these vulnerabilities could be "leveraged to gain initial access into a control network," meaning that a hacker would likely have to first have gained access to a network in order to exploit the vulnerability.

Some Recent Malware Threats

Cyber intrusions on the electric grid have resulted in the deposits of malware on grid ICS networks with the capability of causing damage or taking over certain aspects of system control or functionality.

Triton

The Mandiant consulting company reported that it responded to a cyber intrusion at a critical infrastructure organization where malware was deployed to manipulate an industrial safety system.

The targeted systems provided emergency shutdown capability for industrial processes. We assess with moderate confidence that the attacker was developing the capability to cause physical damage and inadvertently shut down operations. This malware, which we call TRITON, is an attack framework built to interact with Triconex Safety Instrumented System (SIS) controllers. We have not attributed the incident to a threat actor, though we believe the activity is consistent with a nation state preparing for an attack.

Since the reported attack was focused on hacking SIS controllers, FireEye (a private security firm) stated its opinion that the intrusion was intended to be a high-impact attack with physical consequences, and that this was not the type of attack expected from a cyber-crime group aimed at financial extortion.

The Triconex equipment referred to by FireEye is manufactured by Schneider Electric, which reported that cyber attacks on its Triconex equipment were targeted.

The attack on the Schneider customer in part exploited a previously unknown, or zero day, vulnerability in Schneider's Triconex Tricon safety system firmware. And the hackers deployed a remote access trojan [i.e., a malware program that includes a back door for administrative control over the target computer] in the second stage of their exploitation, a first for malware that targets industrial control systems.

Crash Override/Industroyer

The malware deployed to attack a transmission system control center in the 2016 cyber attack in Ukraine was named "Industroyer" or "Crash Override" by cybersecurity companies ESET and Dragos. The malware accesses the same protocols used by electric grid systems to communicate with each other.

The platform fundamentally abuses the functionality of a targeted ICS system's legitimate control system to achieve its intended effect. While the known capabilities do not appear to be U.S.-focused, it is important to recognize that the general [tactics, techniques, and procedures] used in CrashOverride could be leveraged with modified technical implementations to affect U.S.-based critical infrastructure. With further modification, CrashOverride or similar malware could have implications beyond electric power so all critical infrastructure organizations should be evaluating their systems to susceptibilities.

This was reported to be the second known malware specifically designed to disrupt physical systems. The first malware recognized as targeting SCADA systems was the STUXNET computer worm, which was reported in 2010 to have destroyed centrifuges for uranium enrichment in Iran. The virus subsequently proliferated, with STUXNET subsequently being reported in 2012 to have spread to other company networks. However, no damage was reported to these other networks, due to the malware being designed to attack specific equipment.

BlackEnergy 2 and 3

In 2015, cyber attackers are reported to have used the BlackEnergy 2 malware to cause the grid failure in Ukraine. BlackEnergy 2 and 3 are versions of the BlackEnergy malware.

The malware uses a modular functionality on [small office/home office] routers to collect intelligence, exploit [local area network] devices, and block actor-configurable network traffic. The malware can render a device inoperable, and has destructive functionality across routers, network-attached storage devices, and central processing unit (CPU) architectures running embedded Linux.

BlackEnergy is a special potential vulnerability for critical infrastructure companies because the software is being used in an Advanced Persistent Threat (APT) form ostensibly to gather information. It can be used to monitor and interact with industrial control systems such as heating, ventilation, and air conditioning systems.

Potential Cyber Threat to Grid from the Internet of Things

Cyber threats to the grid can also emerge from attacks directed via Internet of Things (IoT) devices connected to networks. IoT devices have been increasingly targeted by botnet malware (whereby the hacker takes over the operation of a large number of infected devices) to launch denial-of-service or other cyber attacks. If such IoT cyber attacks were able to access electric utility operational or industrial control systems, they could potentially impair these systems or cause electric power networks to operate based on manipulated conditions or false information. For example, a potential IoT-based attack on residential or commercial thermostats could result in false power demand readings, causing a utility to ramp up power production unnecessarily. However, some IoT threats can possibly be mitigated by deliberate IoT device design, set-up, and maintenance practices.

Supply Chain Risks

The electric utility industry increasingly depends on Operational Technology (OT) and Information Technology (IT) systems for the safe and efficient production and delivery of electricity. OT and IT systems rely on hardware devices and software systems, procured from a variety of manufacturers and vendors, often from international sources. The security of the design, manufacture, and patch management practices of these devices and systems is a potential vulnerability due to their global nature, and the general lack of consistent oversight of standards and practices to prevent impaired or compromised functionality.

Managing cyber supply chain risks require ensuring the integrity, security, quality and resilience of the supply chain and its products and services. Cyber supply chain risks may include insertion of counterfeits, unauthorized production, tampering, theft, insertion of malicious software and hardware, as well as poor manufacturing and development practices in the cyber supply chain.

The components of smart grid devices present another potential vulnerability. Most of the smart meter, sensor, and other equipment makers are international companies who obtain their components from multinational sources. Taiwan, Singapore, China, and South Korea are among the largest overseas manufacturers of semiconductors and microprocessors for smart devices. The reliable operation of semiconductor and microprocessor-based devices is based on the low-level firmware controlling the device's basic functions. Firmware, in the form of fixed machine-language code, is found in almost all the electronic devices making up smarter grid products such as programmable controllers and programmable logic arrays. If access were gained to such devices (especially during the manufacturing process), a section of code could be covertly inserted in the device and activated in such a way as to impair its functioning in a reliable manner. Since testing all such devices is likely impractical, some might suggest random or statistically based testing of the firmware in smarter grid devices. But the impairment would not need to be placed in all such devices coming off an assembly line. If a large enough sample was impaired, the effect might be enough to cast doubt on the reliability of a whole class of such devices.

Older, legacy systems may also be affected by potential supply chain vulnerabilities. Legacy systems are a challenging vulnerability because upgrades and repairs of equipment may not include the installation of up-to-date, security-focused patches.

In 2016, FERC issued Order No. 829 directing NERC to develop a Critical Infrastructure Protection reliability standard that would require affected entities to develop and implement a plan that includes security controls for supply chain management for industrial control system hardware, software, and services associated with bulk electric system operations. According to FERC, the new or modified reliability standard should address:

Software integrity and authenticity; Vendor remote access; Information system planning; and, Vendor risk management and procurement controls.

FERC states that there is no requirement for any specific controls, nor does FERC require any "one-size-fits-all" requirement. According to FERC, the new or modified reliability standard should instead require responsible entities to develop a plan to meet the four objectives while providing flexibility to responsible entities as to how to meet those objectives.

In September 2017, NERC submitted a petition for approval of the new Reliability Standard CIP-013-1, addressing supply chain risk management, and proposed revisions to two existing reliability standards (i.e., CIP-005-6 and CIP-010-3). The proposed set of new and revised standards would address cybersecurity risks in the supply chain by:

Establishing and implementing organizationally defined processes that integrate a cybersecurity risk management framework (proposed CIP-013-1); Implementing methods to identify active vendor remote access sessions and disable active vendor remote access when necessary (proposed modification to CIP-005-5); and, Verifying the identity of software publishers, and the integrity of all software and patches intended for use on BES Cyber Systems (proposed modification to CIP-010-2).

Other Grid Cybersecurity Issues

There are gaps in cybersecurity for electric power and energy systems. Some gaps are related to regulatory jurisdiction, while other gaps may relate to cost and relative complexity to address the issue. But considering the potential impact of a major grid cybersecurity event, the gaps may require further attention.

Operation Technology (OT) Systems

OT systems are often used by electric utilities to monitor and control power production processes. While these technologies have been considered air-gapped (i.e., separate from IT systems), modernization of ICS networks has led to OT and IT systems becoming increasingly interconnected. And while a lot of attention has been focused on IT system cybersecurity, this is not always the case for OT networks.

OT systems are often directly connected to the Internet, in some cases so that third-party vendors can remotely connect to the system to perform diagnostics and maintenance. In many of these instances, the OT systems are not protected by a firewall and are outdated, so they lack modern security features that would typically be used to protect an internet-facing connection (e.g. multi-factor authentication, strong passwords, logging and monitoring).

Economic challenges, resource constraints, business requirements and the pace of technological change are factors which are reported as making it nearly impractical to completely segregate OT networks from IT networks.

Human Factor in Cybersecurity

Many cybersecurity breaches are caused by individuals falling prey to phishing or similar attacks which are used to gain credentials to access utility systems. The human factor is thus considered by many to be the weakest link in cybersecurity. This was the case in Ukraine, as hackers sent out malware-carrying emails. After links in the emails were opened by legitimate users, hackers acquired the credentials needed to access control and operations systems to cause blackouts at regional distribution utilities. Development and deployment of better tools to secure the human interface could potentially reduce cybersecurity threats via email systems, in particular. In the meantime, targeted phishing attacks are reported to be increasing.

[In September 2017,] Dragos picked up a new adversary, code-named "Covellite." ... Covellite has been targeting electric utilities in the U.S., Europe, and parts of East Asia with spear-phishing attacks that employ code and infrastructure eerily similar to that used by the so-called Lazarus Group, the most destructive and outright criminal of the state-sponsored hacking gangs.

Multi-factor authentication is one security method focused on the human factor, as it requires two or more credentials (i.e., a password, a biometric factor, and/or a security token) to verify an individual's identity prior to gaining access to a network. Therefore, a combination of something you know (i.e. a password), something you have (i.e., a token), or something you are (i.e., a biometric) establishes you as a legitimate user.

Electric Power Cybersecurity Gaps

FERC has authority over wholesale power sales and the transmission of electricity in interstate commerce, while states have authority over retail sales by electric distribution systems. FERC acknowledged that the Energy Policy Act of 2005 excluded local distribution systems from its reliability mandate under Section 215 of the Federal Power Act, as not being part of the bulk power system. FERC's revised 2012 definition brought some of these larger distribution system components under BES regulation, without bringing the distribution utilities under FERC's broader jurisdiction. However, most distribution systems are not required to comply with NERC CIP cybersecurity standards.

Mutual Dependency of Critical Infrastructure

Electricity production depends in large part upon other critical infrastructure sectors for fuel, fuel delivery, and support systems. PPD-21 also establishes Energy and Communications systems as "uniquely critical" infrastructure. NERC itself concluded in its report on GridEx III that, after a major grid disruption, restarting generation and energizing transmission and distribution systems would be a first priority. Restoring service to communications systems, oil and gas, water supply/treatment, and hospital customers would be a secondary priority.

However, while the bulk electric system has mandatory and enforceable physical and cybersecurity rules, other critical infrastructure needed for the electric power sector to function does not. It is unlikely that an adversary capable of causing extreme impairment to the electric power system would overlook other, less protected critical infrastructure.

Cybersecurity risks against the power and pipeline sectors are similar, as both use similar control systems, and there appears to be a broad consensus that cyber threats to this infrastructure are on the rise. Furthermore, with ever-greater physical interdependency between electricity generators and the natural gas pipelines that supply their fuel, many in Congress recognize that grid and pipeline cybersecurity are intertwined.

Artificial Intelligence for Cybersecurity

With the introduction of digital Smart grid technologies to enhance and modernize grid operations, the speed and processing power of microprocessor-based ICS networks enhances the efficiency and control of power production and flows across electricity transmission and distribution systems. While the benefits to the electric power system and its users are many, there are potential risks as many IT and OT systems are connected to the Internet to improve data collection and information sharing. However, this exposure to the Internet leads to increased cybersecurity risks.

Artificial Intelligence

Artificial Intelligence (AI) is one of the technologies being deployed to mitigate cybersecurity risks. AI is a combination of computational technologies, machines, and software which have the capability to learn from inputs and be self-directed. AI allows computer systems to simulate human learning and problem solving.

Artificial intelligence algorithms are designed to make decisions, often using real-time data. They are unlike passive machines that are capable only of mechanical or predetermined responses. Using sensors, digital data, or remote inputs, they combine information from a variety of different sources, analyze the material instantly, and act on the insights derived from those data. With massive improvements in storage systems, processing speeds, and analytic techniques, they are capable of tremendous sophistication in analysis and decision making.

The speed of processing of AI systems are currently seen as providing protection for ICS and other networks that human operators may not be able to match, especially as cyber attackers are employing increasingly sophisticated methodologies.

One form of AI is Machine learning—algorithms based on statistical techniques—which give computer systems the ability to learn from a set of situations, and make decisions based upon alternative scenarios in reaction to those situations rather than from programmer instructions. The algorithms also adapt in response to new data and experiences to improve efficacy over time. Under these circumstances, AI can potentially respond to a cyber attack scenario far more quickly than a human decision maker.

Data Analytics

Electric utilities are collecting massive amounts of data from ICS networks and customer-information systems. Generally, this accumulation is referred to as "Big data."

Big data refers to the growth in the volume of structured and unstructured data, the speed at which it is created and collected, and the scope of how many data points are covered. Big data often comes from multiple sources and arrives in multiple formats.

Using Data Analytic techniques, Big data can be turned into useful information. High performance computing can take advantage of fast processing to examine data sets collected from Smart Grid systems into operational information, providing insights into customer behavior. It can also be used to recognize (or potentially predict) patterns or trends in data of new physical or cybersecurity threats to the grid.

Risks with AI and Machine Learning

The processing speed of Smart grid devices, coupled with the use of AI systems, also presents a cybersecurity potential vulnerability. AI systems learn from experience, and some observers say that these systems may be of limited use in cybersecurity defenses. Machine learning decisions made are based on the data the machine learning is trained and tested on. Machine learning is also subject to bias inherent in the data used to train the machines, as the coding reflects the preconceptions of the coding's programmers.

AI systems are typically only as good as the data on which they are trained. They crystallize any biases or falsehoods found in their training data [Barocas, S., and A. D. Selbst, "Big Data's Disparate Impact," California Law Review , vol. 104, 2016.] The application of AI to surveillance or cybersecurity for national security opens a new attack vector based on this data diet vulnerability. Adversaries may learn how to systematically feed disinformation to AI surveillance systems, essentially creating an unwitting automated double agent.

Thus, the bias of the programming can restrict how the machine learning addresses a situation. However, AI is a tool that can be used for offensive as well as defensive cybersecurity applications.

The next generation of situation-aware malware will use AI to behave like a human attacker: performing reconnaissance, identifying targets, choosing methods of attack, and intelligently evading detection. Just as organizations can use artificial intelligence to enhance their security posture, cybercriminals may begin to use it to build smarter malware.

Adversaries may discover how to use AI to stage future attacks on the grid, designed to disguise the intrusion and then overwhelm defenses.

One factor restricting intelligence in malware is the need for small malware payloads to prevent detection… But it is conceivable that future developments in swarm or distributed AI may result in strategic botnets with small malware payloads but devastating effects.

Improving Grid Cybersecurity

The Aurora simulation in 2007 was the first known event which proved that power plants could be vulnerable to a cyber attack.

An AURORA attack results when a circuit breaker or breakers are opened and closed, resulting in an out-of-phase condition that can damage alternating current (AC) equipment connected to the grid. A demonstration of this for the Department of Homeland Security, conducted at the Idaho National Laboratory (INL) in 2007, was broadcast by CNN.

AURORA demonstrated how a cyber attack could be used to destroy power generation equipment.

Three years later, the Stuxnet attack against the industrial control system of an Iranian nuclear fuel enrichment plant provided the next warning. Electric utilities were now aware that they must be prepared to address cyberthreats from a number of potential sources.

Cybersecurity threats can arise from a number of sources, including deliberate cyber attacks by professional hackers, and acts of malice from discontented current or former employees. They can also result from professional attackers, industrial spies, and organized crime groups, and other groups with hacking capabilities such as hacktivists. However, some observers would say that while terrorists e.g., in seeking to damage the U.S. economy) may be able to buy the technical capacity for a cyber attack on the grid from hacktivists, they would be more likely to seek an attack causing direct physical destruction.

Increasing Cyber Monitoring and Incident Reporting

NERC aims to increase monitoring of the bulk electric system, and has proposed a plan for the E-ISAC to be staffed 24 hours daily. NERC states in its proposed 2019 budget that:

24x7 onsite capabilities could provide significant benefits to members, including (1) timely analysis and information sharing regarding developing physical or cyber security incidents that are discovered or occur outside of normal hours, and (2) the continued development of actionable intelligence during the overnight and weekend hours to enhance industry's preparation for, and response to, any potential physical or cyber security threat or incident.

FERC Increasing Reporting of Cyber Incidents

FERC also seeks increased reporting of cyber incidents. Currently, under critical infrastructure protection reliability standard CIP-008-5 for (Cyber Security – Incident Reporting and Response Planning), incidents must be reported only if they have compromised or disrupted one or more reliability tasks. FERC has directed NERC to expand the CIP-008 standard to require reporting of any attempts to break into a company's networks, rather than only reporting incidents that compromise a company's critical operations:

Responsible entities must report cyber security incidents that compromise, or attempt to compromise, a responsible entity's Electronic Security Perimeter (ESP) or associated Electronic Access Control or Monitoring Systems (EACMS);

Cyber security incident reports should be standardized to improve the quality of reporting and allow for ease of comparison across reports, analysis, and trending;

Cyber security incident reports would be sent to those organizations best equipped to assess threats and communicate them to industry. Specifically, reports will continue to be sent to the Electricity Information Sharing and Analysis Center (E-ISAC); the reports would also be sent to the Department of Homeland Security's Industrial Control Systems Cyber Emergency Response Team (ICS-CERT). NERC would file an annual, public and anonymized summary of the reports with the Commission.

Mandatory DOE Reporting of Grid Incidents and Disturbances

DOE, for its part, has established its own mandatory reporting requirements for U.S. electric utilities experiencing emergency incidents and disturbances.

Form OE-417 alerts the Department of Energy to electrical emergency incidents and disruptions. The ability of the DOE to quickly respond to energy emergencies that may impact the nation's infrastructure and help alleviate or prevent further disruptions depends on the industry's prompt response. As such, the timely filing of this form is of paramount importance.

Electric power incidents and outages have various criteria for reporting depending on the level of urgency of the situation. An Emergency Alert must be filed within one hour of an incident, and includes physical attacks causing major interruptions or impacts to critical infrastructure facilities or to operations, cyber incidents causing interruptions of electrical system operations, and incidences of uncontrolled loss of 300 Megawatts or more of firm system loads (i.e., power provided to customers that is continuously available on demand and which is subject to interruption only under extreme circumstances) for 15 minutes or more from a single incident.

Normal reports (due within six hours of company incidents), and System reports (for wider system issues, due by the later of 24 hours after the recognition of the incident or by the end of the next business day) have lesser criteria for notification of DOE.

DOE states that in addition to national security response, the information collected by Form OE-417 is to be used for reporting on electric power emergency incidents and disturbances in monthly Energy Information Administration (EIA) reports, and that it may use the data to develop legislative recommendations and reports to Congress, and as a basis for DOE investigations following severe, prolonged, or repeated electric power reliability problems.

Enhancing the Threat/Risk Assessment

Many cybersecurity actions are reactive to the last threat discovered. While intrusion detection is considered a priority, some experts say that mitigation of cyber threats requires a focus on attackers, not the attacks to address their motivations (e.g., to extort money or to cause damage). Others might differ, saying that the focus should be on the attack and the system vulnerability exploited. Some utilities are undertaking security improvements in modernization programs, while other improvements would potentially have to be undertaken as special projects because of limitations for cost recovery under traditional cost-of-service ratemaking regulations under state government jurisdiction. In such instances, the improvements may have to be justified as "used or useful" in providing electricity service to customers in utility rate cases.

Very often, the relative level of sophistication of the threat is related to the origin of the threat. Since many cyberthreats appear to originate from foreign entities (including some with nation state affinities), intelligence on the existence and nature of the threat, as well as the capability of dealing with the threat, often relies on the federal government's national security apparatus. Therefore, the information communicated from the government is generally more useful when it is both timely and relevant as to the severity of a threat, and communicate whether a need exists for immediate action. The electricity industry then provides the expertise necessary for understanding the relative risk to the grid of the potential threat, and the appropriate avenues for communicating the threat information.

The National Cybersecurity and Communications Integration Center (NCCIC) under the Department of Homeland Security's National Protection and Programs Directorate largely has the role of informing the electricity industry of cyber and physical threats to the grid. The NCCIC is focused on cyber situational awareness, incident response, and management, and coordinates with the Electricity Information Sharing and Analysis Center (E-ISAC), operated by the North American Electric Reliability Corporation.

The E-ISAC gathers and analyzes security information, coordinates incident management, and communicates mitigation strategies with stakeholders within the Electricity Subsector, across interdependent sectors, and with government partners.

The E-ISAC runs the voluntary NERC Cybersecurity Risk Information Sharing Program, which aims to facilitate a nearly real-time sharing of government enhanced threat information, enhance situational awareness, and better protect critical infrastructure. CRISP deploys passive sensors called Information-Sharing Devices (ISDs) on participant company networks. The ISDs send encrypted data to an analysis center operated by the Pacific Northwest National Laboratory, which analyzes the data, sending alerts with mitigation measures to CRISP participants through a secure network. As of the end of 2015, 75% of U.S electricity customers were covered by companies which had deployed CRISP. The Electricity Subsector Coordinating Council (ESCC), an entity led by industry chief executive officers and is the principal liaison between the federal government and the electric power sector, has called for the E-ISAC to be the "central source of information sharing between the Electricity Subsector and the government."

Building Resiliency into the Grid

There has been speculation that a major cyber attack may be inevitable, given the many diverse actors in the cyber threat space with both political and apolitical motivations. Given such scenarios, some resources are focused on actions and technologies which can aid recovery from a cyber attack. Several potential courses to improve resiliency and which may quicken recovery efforts from a potential attack on the grid are discussed below.

Building the Smart Grid

New technologies are being considered for their potential to enhance electric power transmission and distribution system resiliency. For example, a 2013 report from the Electric Power Research Institute (EPRI) reviews innovative technologies for their ability to make the distribution system more resilient to weather-related power outages or terrorist attacks. These innovations range from use of plug-in electric vehicles and solar photovoltaic systems as back-up power supplies for residences, to community energy storage projects using batteries.

Smart Grid technologies have also been proposed for reliability and resiliency. Sensors and automated controls can use real-time data to reconfigure a utility network to isolate problems. One such system is called Dynamic Circuit Reconfiguration.

Once deployed, these systems serve two roles. First, they limit the number of customers affected by faults.... Second, once the fault is isolated ... the systems enable restoration of service to unaffected sections from adjacent [circuit connections].

EPRI emphasizes that such practices "must be tailored to events of different magnitudes and to different types of disruption (wind, flood, tsunami, earthquake, and terrorist or cyber attacks, etc.)."

While Smart Grid solutions would utilize fast acting sensors and tools to gather and analyze information, the controls for the system would likely have to be located in a combination of central and distributed locations to aid a resilient cybersecurity strategy. However, distributed data centers powered by energy supplies independent of the grid may be needed to ensure that recovery from a cyber attack is not hampered by the loss of information and data needed to recover operations and business systems.

Distributed Energy Resources

Distributed resources and microgrids are also being considered both in terms of making the current grid more resilient and as an increased element of the future grid. The state of New York (among others) has been working with investor-owned electric utilities on a plan to deploy distributed resources at scale as part of its plan to modernize its energy systems. The ability of microgrids to operate independently of the grid has potential in a cyber attack or other emergency, and power can be generated by fossil fuel, combined heat and power plants, or renewable energy systems. Microgrids are also being investigated by the DOE as an element of a modern energy future for the grid. Distributed generation is growing and could potentially be a source for black start power in the event of a grid failure, but these smaller power plants would have to be protected against cybersecurity attacks if they were to help in a black start situation.

Building a Strategic Reserve of Critical Components

Large, high voltage electric power transformers (LPTs) have received special attention as a critical component of the bulk electric system which could be targeted in physical and cyber attacks. Reserves of LPTs are few since these are high cost items, and LPTs are not commonly manufactured in the United States. LPTs require a fairly long lead time to manufacture, and may be designed to meet a customer's specifications. The investor-owned electric utilities have had a transformer sharing program in place since 2006 with those utilities that wanted to participate. Nonetheless, Section 61004 of the FAST Act required DOE to submit a plan to Congress evaluating the feasibility of establishing a Strategic Transformer Reserve for the storage, in strategically located facilities, of spare large power transformers and emergency mobile substations to temporarily replace critically damaged LPTs and substations.

In March 2017, DOE submitted a report to Congress on the strategic reserve, highlighting the issues of time to build, cost, and potential federal ownership of a strategic reserve, as well as issues of where to place and maintain a strategic reserve. DOE found that given FERC's approval of CIP-014 reliability standards, supporting enhanced industry programs for spare transformer sharing might be a better way to achieve a strategic reserve. DOE also stated that it is encouraging manufacturers to design transformers to meet high resilience standards for electromagnetic pulse (EMP) and geomagnetic disturbances (GMD), as well as physical and cybersecurity.

However, given industry's general reticence to allocate funding for potentially high impact, but low frequency events (such as EMP attack, GMD, severe weather, or seismic events as mentioned in the FAST Act), it is unclear whether an enhanced industry approach alone would meet the concerns of many in Congress with regard to a strategic reserve.

Other Issues for Congress

The electric power industry does not have the intelligence gathering capabilities to deal with the many cyber and physical threats to the grid, many of which appear to originate internationally. Instead, the U.S. government analyzes all-source intelligence to understand threats to the energy grid and shares that information with the electricity industry, which has the capability and expertise to understand the risks posed to the grid. How that information could be better disseminated and on a timelier basis has been raised as an issue by the electric power industry.

The bulk electric system is subject to mandatory and enforceable critical infrastructure protection rules for cyber and physical security under the FERC's reliability mandate. However, the energy sector is one of 16 critical infrastructure sectors identified by the Department of Homeland Security. Given that the grid relies on several of the other sectors (for example, for water and fuel transportation), the question of whether these other sectors should also have similar, mandatory standards focused on support of the electric power sector may be an issue for Congress to consider.

The electric power system in the United States is evolving, but not consistently across sectors and regions of the country. While some may say such inconsistencies may add a level of complexity that may make a nationwide cyber event more unlikely, the consistent development of a modern electric power system would likely add to the prospects of U.S. economic health and competitiveness. Policy options designed to ensure that the developing electric power system is as secure as possible will likely be a major consideration for Congress.

Recent Legislation

115th Congress

The Grid Cybersecurity Research and Development Act ( H.R. 4120 ), introduced in October 2017, would require the DOE to develop an initiative to mitigate the consequences on the electric grid of cyber attacks by increasing grid cybersecurity. DOE would also be required to work with other agencies and the private sector to develop guidance for cybersecurity research and development to improve electric sector cybersecurity. NIST would be required to develop voluntary training standards, and maintain a public database of cybersecurity training programs. The ESCC would be required to develop a coordinated interagency strategic plan to advance grid cybersecurity capabilities.

The Pipeline and Liquefied Natural Gas Facility Cybersecurity Preparedness Act ( H.R. 5175 ), introduced in March 2018, would require the Secretary of Energy to carry out a program in consultation with other federal agencies, states, and the energy sector to ensure security, resiliency, and survivability of natural gas pipelines, hazardous liquid pipelines, and liquefied natural gas facilities. The DOE would also be required to coordinate response and recovery to physical and cyber incidents impacting the energy sector, and demonstrate advanced cybersecurity and technologies projects for physical and cybersecurity.

The Cyber Sense Act of 2018 ( H.R. 5239 ), introduced in March 2018, would establish a voluntary DOE program for testing product cybersecurity and technologies intended for use in the bulk-power system, including products related to ICS. It would also authorize the DOE to provide technical assistance to electric utilities, product manufacturers, and other electricity sector stakeholders to help mitigate cybersecurity vulnerabilities.

The Enhancing Grid Security through Public-Private Partnerships Act ( H.R. 5240 ), introduced in March 2018, would promote and advance physical and cybersecurity of electric utilities. The bill would require the Secretary of Energy to carry out a program (in concert the Energy Reliability Organization, industry stakeholders, and other federal agencies) to, among other activities, develop voluntary implementation of maturity models, self-assessments, and auditing methods to assess the physical and cybersecurity of electric utilities; provide training for electric utilities to address and mitigate supply chain risks; increase opportunities for sharing best practices; assist with cybersecurity training for electric utilities; and advance the cybersecurity of third-party vendors that work in partnerships with electric utilities.

The Promoting Cybersecurity for Rural Electric Utilities Act ( S. 2991 ), introduced in June 2018, would amend the Rural Electrification Act of 1936 (7 U.S.C. 931 et seq.) to provide that cybersecurity and grid security improvements are eligible for electric loans and guarantees under that act.

Appendix. Bulk Electric System Critical Infrastructure Protection Standards