Information Security Blog

Ethical Hacker Roundup – Making A Grid Smarter

25 Flares

These Energy IT Security links are part of a weekly series, Ethical Hacker Roundup, featuring the information security and cyber security related articles that we’ve read over and thought worth sharing from the past week.

These articles have were emailed to us, shared on Twitter @pivotpointsec, Google Plus and read in RSS subscriptions this week.

Sharing PII Doesn’t Make Smart Grid Smarter

Washington recognizes that cybersecurity surrounding Smart Grid technology needs drastic improvement. In fact, NIST has been working with the Department of Homeland Security to improve security efforts. However, NIST is not the de facto standard for this technology. In fact, there are many standards (AMI-SEC, NERC, ISO 27002), which is one of the many difficulties that the Energy industry faces when trying to secure the grid.

The Precise Act enables agencies to share personally identifiable information (PII) within Government infrastructure as long as the appropriate controls are in place to protect the data. As you can see on page 9 – line 14 under Access to Information, it looks as like the plan is to anonymize data.

precise-act

“…why should so much effort and legislation be expended on protecting a system that’s fundamentally flawed in the first place?” - Jason Healey, Director of Cyber Statecraft Initiative at Atlantic Council

With Smart Grid security still in its infancy, do you think the Precise Act is smart, or do you think the Government is premature in its involvement?

Which First? Secure The Grid Or Secure The Cloud?

Even before a definitive standard for Smart Grid Security has been finalized, there are talks of meter data management to the cloud. In fact, Verizon and eMeter have already created a partnership to get the ball rolling.

There are a few questions that need answering as the Energy industry utilizes the cloud.

What standard will the grid be compliant with? (e.g., NIST, IEEE)
Will energy companies be required to achieve a certification? (e.g., ISO 27001, NERC, NISTIR-7628)
What form of cloud with the technology use? (Private, Public, Hybrid)
Will the cloud be required to achieve its own certification? (e.g., FedRAMP, ISO 27001)

The movement to the public cloud is already happening (e.g., Silver Springs Networks offerings) – without better guidance the question is it being done securely. Knowing that the Government is likely to utilize FedRAMP as their cloud security standard, should the Energy industry be considering the same for their clouds? Should the consideration also be directed towards a Hyper-Hybrid cloud solution?

Comment with your thoughts, we’d love to hear them.

Securing the Grid

Your Energy IT Security concerns can and should be addressed by an independent and objective Information Assurance firm. Pivot Point Security can help your Energy Company align its key initiatives with security best practices to ensure the integrity of the grid. See how we can help.

23
MAR

Free Whitepaper: Stop Wasting Money on Penetration Testing

Penetration Testing is most frequently performed to:

Substantiate the net effectiveness of a mature control environment
Prove to a third party that an environment is secure/trustworthy
Quickly assess the security of a less mature control environment (in a sense a technical risk assessment)
To validate that significant changes did not have unanticipated results

Free Download: A Best Practices Guide to Database Security

Because data is only as secure as the systems & processes it relies on – a holistic approach to data security is essential. This roadmap is not meant to be exhaustive but rather to stimulate the necessary thought process to put you on the path to good data security.

Best Practices for Firing A Network Security Administrator

Want to know how to fire a Network Admin? Need to know what precautions to take? Firing any employee can be a stressful event. Firing one who has significant knowledge of and privileged access to your Information Technology/Security infrastructure is even more stressful, as the risks are so notable.