These Energy IT Security links are part of a weekly series, Ethical Hacker Roundup, featuring the information security and cyber security related articles that we’ve read over and thought worth sharing from the past week.
Washington recognizes that cybersecurity surrounding Smart Grid technology needs drastic improvement. In fact, NIST has been working with the Department of Homeland Security to improve security efforts. However, NIST is not the de facto standard for this technology. In fact, there are many standards (AMI-SEC, NERC, ISO 27002), which is one of the many difficulties that the Energy industry faces when trying to secure the grid.
The Precise Act enables agencies to share personally identifiable information (PII) within Government infrastructure as long as the appropriate controls are in place to protect the data. As you can see on page 9 – line 14 under Access to Information, it looks as like the plan is to anonymize data.
“…why should so much effort and legislation be expended on protecting a system that’s fundamentally flawed in the first place?” - Jason Healey, Director of Cyber Statecraft Initiative at Atlantic Council
With Smart Grid security still in its infancy, do you think the Precise Act is smart, or do you think the Government is premature in its involvement?
Even before a definitive standard for Smart Grid Security has been finalized, there are talks of meter data management to the cloud. In fact, Verizon and eMeter have already created a partnership to get the ball rolling.
There are a few questions that need answering as the Energy industry utilizes the cloud.
- What standard will the grid be compliant with? (e.g., NIST, IEEE)
- Will energy companies be required to achieve a certification? (e.g., ISO 27001, NERC, NISTIR-7628)
- What form of cloud with the technology use? (Private, Public, Hybrid)
- Will the cloud be required to achieve its own certification? (e.g., FedRAMP, ISO 27001)
The movement to the public cloud is already happening (e.g., Silver Springs Networks offerings) – without better guidance the question is it being done securely. Knowing that the Government is likely to utilize FedRAMP as their cloud security standard, should the Energy industry be considering the same for their clouds? Should the consideration also be directed towards a Hyper-Hybrid cloud solution?
Comment with your thoughts, we’d love to hear them.
Securing the Grid
Your Energy IT Security concerns can and should be addressed by an independent and objective Information Assurance firm. Pivot Point Security can help your Energy Company align its key initiatives with security best practices to ensure the integrity of the grid. See how we can help.