The U.S. Power Grid’s Cyber War Games

From: Environmental Defense Fund

By John Finnigan

In the 1983 thriller WarGames, Matthew Broderick plays a teen-age computer geek who unknowingly signs onto a Pentagon computer while hacking into a toy company’s new computer game. Thinking that he’s simply playing a game called Global Thermonuclear Warfare, Broderick launches the game and nearly starts a nuclear war.  The North American Electric Reliability Council (NERC) will hold its own war game next month with a simulated attack on the U.S. power grid.

The drill, called GridEx II, will take place on November 13-14 of this year. The participants will include 65 utilities and eight regional transmission organizations, representing most of the nation’s electricity customers.  The drill will test how well the electric utility industry and the grid itself respond to physical and cyber attacks.

A NERC Critical Infrastructure Protection Committee (CIPC) working group will begin the drill by sending participants a series of simulated physical and cyber attacks, climaxing in a national security emergency.  Participants will then respond and interact with each other, just as they would in a real emergency.  The simulation will last 36 hours, and the CIPC working group will evaluate the participants’ responses and provide feedback on how their actions impact the ongoing scenario.  After the drill, the working group will analyze the results and prepare a report on lessons learned.

The drill is timely.  Our nation’s power grid is under constant cyber attack, according to a survey of electric utilities by U.S. House Representatives Henry Waxman and (now Senator) Edward Markey. James Clapper, the Director of National Intelligence, described cyber attacks as a soft war that is already underway and a dire global threat in his April 2013 World Threat Assessment of the US Intelligence Community.  The Department of Homeland Security investigated over 200 serious cyber attacks against critical facilities during the first half of 2013, and more than half of these targeted the grid.

Adequate Investment

The U.S. has developed a number of cyber security protections for the grid, but we must do more.  Our country needs to make adequate investments in cyber security.  With the huge budget deficits that the U.S. has incurred in recent years, the proper level of government spending is often at issue.  Given the devastating consequences of a cyber attack on the grid, this is one area where we can’t afford to cut corners.  Our leaders must ensure that federal budget cuts do not impair the Department of Energy’s and the Department of Homeland Security’s means to protect our nation’s critical energy infrastructure from cyber attacks.

Broader FERC Authority

We also need legislation granting the Federal Energy Regulatory Commission (FERC) broader authority to protect against cyber attacks.   FERC is charged with protecting the grid against cyber attacks, but it doesn’t have the legal authority it needs to do so.  FERC has pleaded with Congress to fix this oversight.

The Federal Power Act grants FERC authority over the bulk power system, but most of the smart grid equipment that creates vulnerabilities is installed on local distribution systems beyond its jurisdiction.  As a result, the National Institute of Standards and Technology (NIST) has put together a three-volume set of smart grid cyber security standards – but these standards are voluntary.  FERC is working with the National Association of Regulatory Utility Commissioners to monitor whether utilities are following these voluntary standards, but this is not enough.  The threat of grid cyber attacks is too real, and the potential consequences too dire.  The NIST standards should be mandatory and FERC’s authority should extend to critical distribution infrastructure that puts the bulk power system at risk.

Any new legislation should empower FERC to act proactively.  FERC should have the means to take timely actions to counter clear and present dangers as they arise.  Unfortunately, NERC’s process for adopting cyber standards is slow and unwieldy.  Because FERC’s present jurisdiction is passive in nature, it can only approve standards developed by NERC.  Congress should expand FERC’s authority to act in case of emergency.

Coordinated Enforcement

The appropriate boundary between federal and state control over electricity service has been disputed for over a century, since Thomas Edison’s day.  And, until recently, the manner of providing electric service had not changed much since Edison’s era.  The smart grid is beginning to modernize our energy infrastructure by marrying the Internet to the electric grid.  Just as the Internet is a matter of interstate commerce, so are critical smart grid facilities that could disrupt the bulk power system.  We can ease jurisdictional tensions by following an existing model that uses a federal-state partnership to enforce federal standards – interstate pipeline safety.

Interstate pipeline safety standards are established by the Pipeline and Hazardous Materials Safety Administration (PHMSA), a branch of the Department of Transportation.  Although the PHMSA sets the standards, any state can assume responsibility for enforcing them within their borders.  The state simply needs to follow the federal standards at a minimum and apply the same enforcement penalties.  While not perfect, this federal-state partnership has generally succeeded in ensuring pipeline safety in a cost-effective manner.

Information Sharing

We also need legislation to enable better practices for sharing information about cyber threats.  At the moment, we have two venues where the government and utilities voluntarily share this information:

  • the Department of Homeland Security National Cybersecurity and Communications Integration Center (NCCIC); and
  • the NERC Electricity Sector – Information Sharing and Analysis Center (ES-ISAC).

Perhaps a better approach would be to establish a new, independent organization to act as a single clearinghouse for cyber security threats.  Today, government agencies share alerts and notifications about impending cyber threats.  But the information often fails to provide sufficient detail for the private sector to take action.

Read Complete Article

 

Facebooktwittergoogle_plusredditpinterestlinkedinmail

8 responses to “The U.S. Power Grid’s Cyber War Games”

  1. Aleks Shamles says:

    I like games with a military theme, like cs go. Lately, I have been playing this game quite often, and I also found a cool online skin shop where now I buy cs go skins. For many people, this is a stupid waste of money, even my friends don’t understand me in this regard, but for me, buying ssg 08 csgo Death Strike skin is a great joy. In general, I decided that if it brings me pleasure, then I’m doing everything right.

  2. Sam Jonson says:

    So it’s spring break where I am and I wanted to build a minecraft server for the kids.

    (I have done sys admin for years but i have never used this app before.)

    So I created a Ubuntu 20.04 server loaded, Bedrock server on to it.

  3. Harry Fields says:

    A number of these servers are in fact produced by big video game developers that have the skills and also resources to supply an incredible expertise on the Wow. Such designer firms see to it that the features that they incorporate into their servers work with all sort of operating units along with web browsers. In this manner, they make sure that their services can be used by every person around the planet.

  4. Harry Fields says:

    You need to find the best server for you to enjoy the game. The process depends on many factors that can affect the connection to the server. It is worth considering whether you have an official version of the game, what mods are installed, whether they are supported by the hosting, etc. In general, I advise you to look at minecraft servers to find the best one for you. After that, you can create a single world and make it open online. Now, knowing your IP, friends can easily connect to you.

  5. James Taylor says:

    Hello, the fact is that online casinos are spreading around the world more and more every year. Moreover, everyone is so attracted by the fact that you can quickly win a large sum of money.

  6. StephenBarrett says:

    Hello. I’m very busy at work and looking for a way to relax a little and have fun. Colleagues at work advised me to try playing in an online casino. But I’m full of doubts. Do you think it’s worth it for me to do this?

  7. MosesHarper says:

    I know how to help you. If you think that making money is difficult, then I will tell you that this is how I worked as a waiter, worked at many other jobs, and, frankly, it was very hard for me, I did not have enough money at all, I was very sad https:// tower.bet/crash and then at one fine moment I just found a casino site and now I don’t deny myself and just play my favorite games that I can earn money from.

  8. Jaylir21 Coe says:

    I often have moments when I get bored and don’t know what to do with myself. If you want to pass the time, as I do, I recommend a computer game Worldle . It is simple yet immerses you completely in the process.  Playing this game time passes quickly.

Leave a Reply

Your email address will not be published.

Please Answer: *