Are You a Key Energy or Telecom Cybersecurity Professional? Let Us Know

DCT Associates will soon publish its first public product, an Energy and Telecom Cybersecurity databook, which we hope will serve as a useful reference tool for technical, operational and policy professionals working in the energy and telecom cybersecurity arenas.  It's a big task, but our goal is to help everyone navigate the complex cybersecurity arena by focusing first on the two most important critical infrastructure sectors, energy and telecom.

The book will feature concise snapshots of the technical, policy and organizational challenges and opportunities in the hideously complex cybersecurity world.  We'll start off providing an overview of who does what, where and why, (which may be a fool's errand when it comes to the arcane and complex world of cybersecurity, but that makes the work all the more fun).

As part of the project we've developed a directory of nearly 400 individuals that we've loosely categorized as key technical, legal, policy, government and operational experts on cybersecurity in the energy and telecom realms - but we don't want to overlook anyone.    We're including all kinds of organizations in our list, including technology supply, academic, trade, government, consulting and industry organizations, along with key contacts at energy and telecom companies.  If you believe you or a colleague should be featured as a key contact, please fill out a form we've set up to collect the relevant pieces of information we seek.

Although we encourage as many suggestions as possible, we're not making any commitments to including all submissions in the directory; we reserve editorial judgment to make the list as useful and targeted as possible.  Drop me an email at cynthia@dct-associates.com if you have any questions or comments.

Image Courtesy of Photoxpress.

Read More

It’s the Back-Up Power, Stupid: Communications, Electricity and Service Restoration Following Hurricane Sandy

Hurricane Sandy, like Hurricane Katrina before it, highlights a little-examined but perennial riddle:  what comes first in restoring life to normal after a major crisis, electricity or communications?  Without electricity, there can be no form of electronic communications but without the ability to communicate, power providers are ill-equipped to restore electricity in anything but a haphazard manner.

In the wake of Sandy’s damage, both critical infrastructure providers, telecommunications and electricity, were hard hit with outages due to downed lines and damaged, flooded hardware.  But as the days wore on, a crucial distinction emerged between the two providers:  with no electricity and back-up fuel in extremely short supply, communications providers simply had no power to operate their networks, particularly their wireless networks.  Last Friday, the FCC commented on the situation, acknowledging that “replenishing fuel supplies for generators that are enabling communications networks to continue operating is a particularly critical challenge.”

This assessment echoes the conclusions of an FCC panel asked to address how well communications networks fared in the aftermath of Hurricane Katrina.  That panel found that among the chief causes of communications failure after Katrina were faulty batteries used by the telcos combined with lack of power given that utilities had been knocked out too.  The panel also found that communications networks owned and operated by utilities fared fairly well because they were designed to remain intact to aid restoration of service following a significant event. 

The importance of maintaining robust communications in a crisis situation is one of the top reasons why utilities tenaciously argue they need to maintain their own communications networks, such as private land mobile radio communications and fiber and microwave-based systems that allow system-wide communications, independent of and apart from the so-called “public carrier” networks.   Since the dawn of both industries, which occurred at roughly the same time period -- Alexander Graham Bell and Thomas Edison were both pushing wires to homes and businesses simultaneously -- utilities have been fighting with telecom providers to maintain their own communications networks while telecom providers have been arguing that this duplication of infrastructure is a waste of society’s resources and ignores the highly specialized and valuable expertise that telecom companies bring to the table. 

And both industries are correct.  Utilities are rarely on the cutting-edge of technology innovation, a handicap that is becoming clear, for example, in the cybersecurity arena, where communications providers must develop razor sharp protection schemes or else lose out to smarter, more technologically savvy rivals, while utilities have no economic incentive – and indeed are often discouraged by regulators – to spend more money or time on maintaining digital security.  And yet, when it comes to crisis situations, it all comes down to back-up power.

To keep their communications networks running, most utilities use interim battery and long-term generator back-up which is usually indefinite – practically unlimited storage of diesel, gas or other fuel sources is one of the perks of being a power company.   No other industry, including telecom providers, can keep back-up power going for more than a day or two.  A study I conducted in 2010 found that one of the top reasons utilities are reluctant to rely on communications providers is "insufficient levels of power back-up."  Another top reason that utilities are reluctant to rely on phone company networks for their mission critical functions, according to the study’s findings, are "concerns over disaster preparedness" on the part of telecom providers.

While telecom companies have made great strides since Katrina in ensuring better power back-up during crisis situations, Hurricane Sandy answers, for now, the riddle of what comes first in restoring life to normal, electricity or communications.  The answer, of course, is that they both come first.

(With full disclosure, I spent three-and-a-half years studying what most people, prior to the advent of the “smart grid,” used to consider the arcane niche of “utility communications” on behalf of the utility industry.  But I also spent years many more years before that conducting analyses on behalf of a host of traditional communications providers so I’d like to think I’m coming at this fully informed by the cultures and arguments of both industries.)

Image source:  Power outage screen capture from Google Maps.

Read More

Utilities, Tech Industry Face Culture Clash in the Smart Grid

(Washington, DC)  As the nation’s electric infrastructure struggles to get smarter, a culture clash has emerged between the rapid-pace high-tech industry and the very slow-moving utility industry as they both try to inject intelligence into the grid.  Google-backed Silicon Valley-based Silver Spring Networks has experienced this first-hand as it pitches its 21^st Century software, networking and platform solutions to utilities.

“We have to work to the biorhythms of our clients,” Eric Dresselhuys, Silver Spring’s EVP of Global Development said today at GridWeek 2012, held here.  “A utility client said ‘we don’t want you to force us into an upgrade more than every seven years.’ It made me realize the chasm we have to cross.”

“This [technology change] is coming at us in a lot of different directions,” Heather Sanders, Director of Smart Grid Technologies and Strategy, California ISO said.  The biggest challenge, Sanders said, is not technological but regulatory, with heavily rate-regulated utilities constrained by state public utility commissions in terms of how easily they can spend capital to upgrade technology.

“It's not clear that there is a regulatory meeting of the minds on how we're going to pay for this,” Dresselhuys said.  Regarding a recent case of regulatory lag in Illinois, “the absolute amount of money we're talking about here is so small, $1.50 per customer per month.  Nothing's happening and it's stunning.”

Not all utilities are foregoing technology upgrades pending regulatory approval.  “We're spending money on projects for which we don't have regulatory approval because we have to move forward,” Lee Krevat, Smart Grid Director San Diego Gas & Electric (SDG&E) said.

Indeed, SDG&E is out ahead of the industry’s vendors, asking for more up-to-date technologies than the vendors’ products offer.  “We have things that we want and they don't exist the way we want them,” Krevat said.  “It's the utility wanting to move faster than the suppliers.  It's bizarre.”

Read More

Nod to Energy in Obama's Speech Tonight? Maybe, Even If It's "Boring"

Energy independence has been a staple of American presidential politics since the early 1980s, a hot button issue that nevertheless hasn't triggered the vitriolic level of discord between the two parties typical of other important (and not so important) issues.  High-wire fights over drilling and cap-and-trade notwithstanding, both parties are generally rowing in the same direction on energy independence and efficiency.

Over the past month both parties have embraced the "all-of-the-above" approach, a pragmatic view of energy issues, recognizing that the shift to renewable energy will be a longer slog than optimists thought.  At  a panel during the Democratic National Convention yesterday, Howard Dean, former Democratic Governor of Vermont and a one-time presidential contender himself acknowledged what Democrats have reluctantly embraced:  The country and the economy is dependent on non-renewable energy sources and will be for a long time.   "We're going to need petroleum for the foreseeable future," Dean said.

Still, it's a good idea for the government to push the country in the direction of non-renewable energy as much as is practicable, Dean said.  "I do think there are some reasons to spread out the use of this stuff and to minimize carbon footprint."

One barrier to the shift to renewable energy sources, or to lowering energy consumption, is that to most consumers "energy is boring," according to Art Lasky, President and Founder of consumer energy management company Opower, speaking on a separate panel at the DNC yesterday.  Although "90% of people at this convention and elsewhere would say saving money is important...the only time you think about energy in the home is when the power is out," he said, noting that research shows the average customer spends only six minutes per year actively engaged with their energy utility.

If that's the case, will Obama push energy issues high on his reelection agenda and will we hear much about energy in tonight's speech?  According to some sources, Obama plans to promote his track record on energy issues tonight, pointing to reduced oil imports, improved vehicle efficiency and more renewable energy generation.

In his now-revered nominating speech, Bill Clinton mentioned but only touched on energy, praising Obama's all-of-the-above energy strategy.  It's possible that because both parties seem to agree on the big points, or that most people think the topic is boring, that energy isn't a big issue this election season that will sway voters one way or the other.

Read More

Utility Cyber Security Hampered by Standards, Vendors, Industry Culture

Electric utilities are our nation's critical infrastructure ground zero. But the lack of standards, vendor inadequacy and the glacial pace of utility technological change are among the top challenges to keeping the grid safe from digital threats according to industry experts speaking at the Smart Grid Security Virtual Summit today.  It's very difficult for utilities to "create a process to achieve security because they are always waiting for a standard," Ward Pyles, Senior Security Analyst, Southern Company said.

Speaking of the morass of ever-changing cyber security protocols available to utilities from the government and private sector groups, Pyles recommended that each utility develop its own standard and then stick to it.  "It's hard to choose what is the best one for you but you have to look at each of them and then create your own standard.  Pick one if you can and if you can't come up with a compilation."

Utility vendors must be more attentive to, and utilities must demand in their RFPs and RFIs, stronger cyber security technologies, Ward said.  "We're seeing solutions today that have default passwords that are embedded in code," a cyber security risk that utilities must mitigate.

"There is little or no cybersecurity in the devices utilities deploy," Patrick Miller, President and CEO of utility security group EnergySec said.  "The vendors have come a long way but it is still not a pretty picture."

The utility culture is "much more resistant to change," facing technology life cycles that typically span twenty years, making the new digital era particularly challenging for utilities looking to implement adequate cyber security procedures according to John Stewart, a cyber security specialist engineer at the Tennessee Valley Authority.  IT technology is truly a "different paradigm" for most utilities, Stewart said. The IT sector is a culture of constant change and "it's definitely different from the power industry" where change is "not one of our cultural strong suits."

Moreover, utilities don't have the luxury of interrupting service to install new software or technologies, as do many IT-based businesses.  "It's hard to imagine a world where substations operate in a patch Tuesday mindset," he said.  

Stewart argues that cyber security and utility communications infrastructure be separated from core operations while minimizing the amount of "daylight" between security and core function devices.  "Longer term we will push vendors toward more modular solutions that separate security and communications from core functionality just because the two industries are so different."

Slide from presentation by John Stewart, TVA

Read More

Information Sharing, Flexibility Are Key to Utility Cyber Security, Officials Tell Senate

Mechanisms should be put into place that allow for adequate, actionable information sharing among utility cyber security specialists and government agencies charged with monitoring security threats, a group of government and industry self-regulatory officials said today during a hearing held by the Senate Committee on Energy and Natural Resources.”There should be a mechanism in place for sharing that [cyber threat] information in a timely and effective manner,” Gregory Wilshusen, Director of Information and Technology at the General Accounting Office (GAO) said during his testimony.

The widely recognized problem in sharing information about cyber threats was documented in a GAO study, which found that sensitive national security-related cyber threat information wasn't being filtered down to electric utilities. “The information that DHS provided was not meeting the expectation of their private partners. The information was not actionable and timely,” Wilshusen said.

“The information is ad hoc across agencies,” Gerry Cauley, President and CEO of the North American Electric Reliablity Corporation (NERC) testified. “We have very limited access to clearances within the industry, particularly on the top secret side.”

“We hear from our utilities that it is a one-way information street,” Todd Snitchler, Chairman of the Ohio Public Utilities Commission said, referring to the frustration utilities experience in not gaining early knowledge about threats well-know among federal security organizations.  Also hindering the flow of two-way information is fear of liability or exposure when they do report threats to state or federal authorities. “Anonymous sharing would help,” Snitchler added.

Although minimum technical standards, such as those developed by NERC or under development by the National Institutes of Standards and Technology (NIST) are essential for maintaining adequate cyber security, flexibility to respond to unique threats in fluid situations is equally essential.

“Individual entities have to have the latitude to have the directive but not be so prescriptive as to tie them into a certain response,” Joseph McClelland, Director of the Office of Electric Reliability at the Federal Energy Regulatory Commission said. “The standard needs to compel action but provide latitude.”

Multiple layers of standards and instructions are needed to provide that flexibility, Wilshusen said. “You don't want to have to change the standard when a new threat comes along.”

Committee Chair Jeff Bingaman (D-NM) pressed the witnesses to address the threat of electromagnetic pulses (EMP) to the power grid from enemy attack or solar flares, an issue raised last week by former Republican Speaker of the House Newt Gingrich in a widely published op-ed piece following the Northeast storm-induced power outages. McClelland said that coordinated studies need to be done and standards need to be developed to address EMP threats. 

Bingaman was not, however, satisfied with this reponse. “I get this feeling we might be studying this issue while the electric grid collapses,” he said.

Senator Al Franken (D-MN) probed the issue of supply chain threats given that many of the components, such as semiconductors, that make up the new digital grid are manufactured in countries, such as China or North Korea, which may have a vested interested in monitoring or controlling the U.S. Grid. Wilshusen conceded that supply chain threats are real. “IT supply chain is a vulnerability. We looked at several agencies, DHS, Energy and Department of Defense and we found that agencies haven't adequately developed mechanism to address that vulnerability.”

The hearing took place in advance of a compromise cyber security bill that the Senate will likely begin considering by the end of next week. Championed by Joseph Lieberman (I-CT), the legislation will focus on information sharing among critical infrastructure industries and federal agencies. Lieberman and the Obama Administration have been pushing for legislation that allows the Department of Homeland Security to impose minimum, mandated security requirements on critical infrastructure, including utilities.

Read More