Why NERC will attack the grid November 13 (and what it could mean for utilities)

Nov 07

Quick Take: More and more people are jumping on the smart grid cybersecurity bandwagon. And many of them are jumping on for the purpose of complaining that
utilities aren’t doing enough, as in the example below.–

By Jesse Berst

The North American Electric Reliability Council (NERC) is about to launch a simulated attack on the U.S. power grid. The drill will begin with a series of simulated attacks, both physical and cyber. Scheduled to last 36 hours, the “war games” will climax with a simulated national emergency.

The participants include 65 utilities and eight regional transmission organizations. They will respond and interact just as they would in a real emergency. After the drill, NERC’s Critical Infrastructure Protection Committee (CIPC) will evaluate and critique the results. The working group will then analyze the results and prepare a report.

As explained in a post at the Environmental Defense Fund, the Director of National Intelligence, James Clapper, believes we are already at war — a so-called “soft war” that has the power grid under constant cyberattack.

“Given the devastating consequences of a cyber attack on the grid, this is one area where we can’t afford to cut corners,” writes author John Finnigan. He calls for legislation granting the Federal Energy Regulatory Commission (FERC) broader authority to protect against cyber attacks. Although FERC has the mandate to protect the grid, it doesn’t have the necessary legal authority. “FERC has pleaded with Congress to fix this oversight,” he says.

FERC has authority over the high-voltage transmission grid, but it is the medium-voltage distribution grid that is most at risk. Finnigan also complains that cyber security standards from the National Institute of Standards and Technology (NIST) are voluntary when they should be mandatory. He favors an approach similar to the federal-state partnership that manages interstate pipeline safety.

He also asks that “utilities should commit to following cybersecurity best practices, rather than doing the bare minimum.” He claims that only 20% of all utilities follow NERC’s cybersecurity recommendations.

Jesse Berst is the founder and Chief Analyst of SGN and Chairman of the Smart Cities Council, an industry coalition.